Recent by Daniel Nashed 

Domino does not shutdown cleanly when Windows is rebooted or shutdown  

By Daniel Nashed | 9/11/24 6:23 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

When stopping the Domino service manually, the Windows service control manager (SCM) waits sufficient time to shutdown Domino cleanly. But it turns out a Windows shutdown or reboot does not wait sufficient time for service termination. This is critical because it would kill running Domino processes without notice. Even with transaction log enabled, this isn't a desirable situation.

How to find out what is eating my disk space on Linux?  

By Daniel Nashed | 9/11/24 6:22 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

If you don't know the Linux tool ncdu, this will make your day. The tool by default scans from where you are or any directory you specify. Specially when running on WSL you might want to use excludes. On top there is a delete option, which can be quite helpful when you find large files you don't need. I am using it for years and it did safe my IT life more than once. And it is very fast...

Domino One Touch Setup (OTS) advanced examples and helpers  

By Daniel Nashed | 7/29/24 3:22 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

OTS is a very powerful and flexible feature of Domino 12+ which has been extended in each dot release since then. I am OTS a lot in the container world. But it also works on Windows. It perfectly fits into the container world. And we added a couple of integration points into the container image. Because I got a couple of questions I wrote up some examples, related information and also an Lotus Script agent to extend the functionality. The agent is intended to be an example how to wrote own integrations and also to leverage and extend the existing agent for own needs.

Pretty-Printing JSON in Notes Client and Domino  

By Daniel Nashed | 7/29/24 3:20 AM | Development - Notes / Domino | Added by Roberto Boccadoro

The Lotus Script class for reading and writing JSON is that easy. There are not many examples and some functionality is missing. JSON can be either condensed without any new lines and indentation. That's great when you use it for back-end processing or REST services. Why is pretty printing important But in some cases you need pretty formatted JSON. Specially when you want to maintain it manually and extend it. For example for Domino OTS JSON files :-) When you use JSON based configuration pretty printed JSON is very helpful. Condensed JSON is also difficult to check into Git. Everything looks modified when it is a single line.

HCL Nomad server 1.0.12 IF1 shipped with same file name than 1.0.12  

By Daniel Nashed | 7/22/24 6:13 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

Nomad 1.0.12 has been replaced with a 1.0.2 IF1 version. MHS has only the new version. The old version can't be downloaded any more. But they left the file names the same. So you can't distinct the files by name once you downloaded them. So you have to delete the old file and re-download it. The same file name with a different content (resulting in a different hash and size), breaks automation. For example it broke the Domino container build automation.

Running Domino Windows container image on Windows 2022  

By Daniel Nashed | 7/8/24 1:43 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

Two years ago I have been looking into Domino in a Windows container already. The main purpose was to understand the technology and if this makes sense to be used in general. IMHO container technology is mainly helpful on Linux. Containers on Linux use core OS level functionality, which is part of the Linux kernel. Only Linux makes sense for production use for me. But a Windows container can be a great test environment for automation testing and other test use cases. I revisited my container build on Windows this weekend and first updated it to Domino 14 and also updated all involved tooling like 7Zip. In addition I looked into how I could leverage a Windows container image for testing.

New Nomad Server features -- ACME HTTP-01 challenge support & HTTP redirects via port 9080  

By Daniel Nashed | 7/8/24 1:42 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

There are two new features in the latest Nomad Server versions, introduced to Nomad Server without big notice. I just got the question from a partner why Nomad Server now binds port 9080 in addition to port 9443 and the internal communication port (only loop back). The port might be used by other applications like the IBM Spectrum Protect (TDP) -- which was the problem in this customer case. It turns out the TDP Java based restore GUI and does not work in combination without changing or disabling the port.

Building applications in a build container  

By Daniel Nashed | 5/13/24 4:32 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

Specially when developing for different target versions of an OS or an application a build container can be very helpful. But build containers are also really helpful in larger teams when everyone should use the exact same build environment. The Domino container project supports adding the Notes/Domino C-API SDK to the container image. In case of Domino libnotes.so is required. Therefore compiling requires at least an installed Domino server with the same or newer version than the SDK version. I built a Domino 14.0 FP1 image including C-API 14.0 and tagged it hclcom/domino:build. For this blog post I am using the simple test program in the container projects automation test directory --> https://github.com/HCL-TECH-SOFTWARE/domino-container/tree/main/testing The directory is defined as a volume inside the container /build.

Domino Container Project: software.txt link & new start script version  

By Daniel Nashed | 5/9/24 3:22 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

The container project contains a software.txt file with all the web-kits used to build images. For some technical reasons the file was located in two places. 1. The build.sh script uses software.txt for checking web-kits before the image build starts. 2. The actually image build process uses software.txt to verify the downloaded web-kits before installing them. software.txt and current_version.txt can also be added to a custom software directory (SOFTWARE_DIR) or remote download location (DOWNLOAD_FROM).

HCL SafeLinx 1.4.2 available -- New best friend "Domino CertMgr"  

By Daniel Nashed | 5/2/24 9:21 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

This was a quite high rated AHA idea. So the SafeLinx team and Domino team teamed up to implement it. The flow is integrated into the SafeLinx UI and SafeLinx also allows ACME challenge "passthru". There isn't any change in CertMgr needed. It is implemented in a way that you could implement your own integration flows. If you have a specific integration idea, ping me. I can point you to the right direction.

Updating autoupdate.nsf with the new template (14.0 08.03.2024)  

By Daniel Nashed | 4/17/24 3:56 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

The new fit & finish work and the new autcat.nsf integration requires template changes. Please make sure you are getting the template version 14.0 from 08.03.2024 and not the earlier version from 03.11.2023 shipped with Domino 14. When deploying the container image I noticed an issue with the folder permissions where the container image is getting template updates for Fixpacks. The directory /opt/hcl/domino/notes/latest/linux/data1_bck/140FP1/localnotesdata contains updated templates. But the directory can be only accessed by "root" and the container runs with the "notes" user. This is not new to 14.0 FP1. Also 12.0.2 fixpacks had the same permissions, but nobody noticed the missing updates.

Domino AutoUpdate AUT Catalog integration in action  

By Daniel Nashed | 4/17/24 3:54 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

When the new integration is enabled, client web-kits are just pushed to AUT Catalog. The push will also happen for existing web-kits once the document is updated with data containing the Metadata XML. No manual steps needed. The documents and the new view have a button to directly jump into AUT Catalog. The button on top only shows up for software pushed to AUT Catalog. AUT Catalog sometimes has multiple documents for the same web-kit.

Adding TOTP to your own application  

By Daniel Nashed | 4/16/24 5:10 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

The oathtool is the standard tool on Linux. It comes as a command-line tool or a dynamic and static link lib to be used in your own applications. You can statically link the code into your application and generate TOTP codes and also validate them. The homepage contains information about the command line tool "oathtool" and also the lib "liboath". https://www.nongnu.org/oath-toolkit/ Example how to use it on command-line. The example used the base32 encoded secret for "test". oathtool --totp -b ORSXG5AK

Linux - Using Cron to schedule periodic jobs like certificate updates  

By Daniel Nashed | 4/11/24 5:10 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

In all the years I have never looked into cron. But it is really a very straightforward functionality, which is used by Linux itself. You can either schedule user specific jobs or use /etc/cron.d files or /etc/crontab. There is a certificate update script --> https://github.com/HCL-TECH-SOFTWARE/domino-cert-manager/blob/main/examples/nginx/cert_upd_nginx.sh

Howto convert cert formats from and to PEM  

By Daniel Nashed | 4/11/24 5:09 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

CertMgr uses PEM internally for all operations. The PEM format is the most important format. But you might get your files from your admin or a CA in different formats. CertStore can import and export PEM and PKCS12 (PFX, p12). But this might not always work in the way you expect it because of legacy encryption. I just wrote a new howto document providing some background and providing OpenSSL command line options.

Domino meets Grafana & Loki  

By Daniel Nashed | 4/8/24 12:45 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

The latest Sametime version offers a graphical statistics dashboard based on Grafana and Prometheus. Domino statistics out of the box don't play well with Grafana. Prometheus needs a pull model and the Domino Stats Package added in Version 10 only supports the push model. Sametime uses the push gateway, but because the Domino statistic names need to be transformed anyway, I wrote a small servertask to provide the stats to be included into the node_exporter, which already is used to provide Linux system statistics. Beside statistics I also looked into Grafana Loki to collect logs and make them available over the Grafana interface. The data is collected by promtail.

SNMP with Domino on Docker  

By Daniel Nashed | 4/1/24 1:59 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

Simple Network Management Protocol (SNMP) is a rarely used functionality in Domino, which has been implemented in Domino in the last century. But I got a request from a customer to get SNMP working with Domino in a container to monitor the server. On Kubernetes there are other ways to monitor servers. But for a stand-alone Docker host, SNMP could still make sense and can be implemented.

Important: Domino ID Vault -- Don’t remove old servers if still referenced in user documents  

By Daniel Nashed | 3/28/24 4:22 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

When you migrate to new servers, you have to be aware of the following limitation, which is documented in 12.0.2/14.0 but also affects older servers. To ensure you can recover all user.IDs make sure the server document is still present and the server is still in the ID vault configuration. See the following warning in help and Kbase document. This is a recent update in documentation and I just sent it to a customer during a server upgrade/move workshop.

Introducing Domino Borg Backup Integration V2  

By Daniel Nashed | 3/19/24 2:34 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

Borg Backup is an interesting backup option for Linux (https://www.borgbackup.org/) and also works inside a Domino container with a local or remote repository. The first integration with Domino Backup used bash scripts and Borg commands. But this had limitations due to the way Borg handles backups. Each database was stored in a separate repository. I have been looking for direct integration to avoid this overhead and store all backup data into a single backup. There is a newer option to import tar data directly into Borg as a stream -> https://borgbackup.readthedocs.io/en/stable/usage/tar.html.

High Domino Backup performance with native ZFS storage on Proxmox  

By Daniel Nashed | 3/19/24 2:32 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

Domino 12+ default native backup is a very easy to use option, which also works on Docker containers. The resulting backup to a file target is always consistent, because delta information is always applied to the backup file. But a file target raises the challenge that the whole NSF data will be copied to the target file-share or disk. Therefore a de-duplicating target is highly recommended. I took a look into ZFS in detail in my new local setup to test out performance.

Looking into S3 performance numbers for MinIO -- Is this the right target for backup?  

By Daniel Nashed | 3/19/24 2:31 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

I know MinIO for a while and I have been using it for DAOS T2 testing early on. Years later they are now grow up and play in the cloud native storage league. Still the devil is in the detail and for using it in production environment customers hopefully use the enterprise subscription to get tuning support. Paying for support this doesn't make it a cheap storage any more if you look at their price tag.

First look at openSUSE Leap 15.6 Beta with Domino 14  

By Daniel Nashed | 3/19/24 2:26 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

As some of you know from earlier discussions, the latest currently available SUSE Enterprise and openSUSE Leap 15.5 ships with a too old glibc to work out of the box with Domino 14. You could still run it on a Docker(or Podman) host, because the container image brings the glibc run-time with it and only uses the kernel from the Docker host. openSUSE Leap and SUSE Enterprise (SLES) share the repositories and are technically more or less the same. SUSE Linux 15.6 is scheduled for mid 2024 I have been looking into openSUSE Leap earlier with their Alpha version. Now the official beta is available for download As expected Domino 14 works natively with the updated glibc. The requirement is glibc 2.34+. This Linux version will introduce glibc 2.38. But SUSE also switched again to a new major kernel version with a Service Pack. This means HCL will have to re-rest SUSE Linux once the final version is released. It will take some time to have fully tested and support SUSE supported for Domino 14.0.

Important: For Domino SMTP with ECDSA keys for STARTTLS inbound  

By Daniel Nashed | 3/19/24 2:23 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

The short version of you don't want to know all the technical details: If you choose a ECDSA key for your web server, make sure you have also a RSA key for SMTP inbound connections In case you are interested in the technical details, read on ...

Introducing the Domino native Linux installer and Domino Linux Menu  

By Daniel Nashed | 3/19/24 2:21 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

When I ask a question like "why admins are not moving to Domino on Linux" I might have a plan in my head already. I cannot solve all the challenges for you at once. But I am helping over years with my Domino Start Script to get Domino on Linux easier to run. The start script already helps to perform standard operations. Istallation is and some other operations might be still more complicated at first glance on Linux. I introduced a build menu into the HCL Domino Community image process recently. And I took that logic and I am making it available for native installations as well. This new option also offers automated downloads via the recently released Domino Download script

Domino 14.0 on Linux does not work on very old CPUs  

By Daniel Nashed | 3/6/24 4:55 PM | Infrastructure - Notes / Domino | Added by Oliver Busse

Domino 14.0 requires glibc 2.34 because it is build on Redhat Linux 9.1. Glibc is the Linux C run-time which is a core building blog of Linux and can't be changed. This means you can't run it on Linux versions which don't have at least glibc 2.34. Glibc 2.34 itself doesn't work on old CPUs not supporting at least a CPU with microarchitecture level x86-64-v2

Auth0 ODIC OpenID with Domino & Some other interesting findings  

By Daniel Nashed | 2/22/24 1:21 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

We are working on a ODIC setup with a German business partner for a larger German customer. Auth0 is one of the major providers. We got it working but only with some tricks for now. It turned out the Auth0 OIDC endpoint has a cache expiration for 15 seconds. This looks like a setting that can't be changed. The Domino OIDC cache uses the expiration header to invalidate the cache. So our cache on the Domino side was constantly reloading and invalid in some cases. You really have to have an expiration that is at least a couple of minutes. Better at least 1 hour. Faking the cache expiration This has been reported to HCL and the team is working on an enhancement. Meanwhile I came up with a work-around setting up a Fake provider on a NGINX server to forward the requests.

Domino Backup/Restore with multiple configurations and targets  

By Daniel Nashed | 2/22/24 1:14 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

Domino Back/Restore is a flexible framework for native Domino backup. The dominobackup.nsf plays an important role for backup and restore operation. It contains the following type of content. Backup/restore/prune configuration Inventory documents for restore operations Restore requests Backup logs You could run backup with different excludes defined on command-line. Or just backup selected databases or incremental backups. But there cannot be different active configurations nor different backup retention in one dominobackup.nsf

Domino autoupdate.nsf for fast internal software downloads  

By Daniel Nashed | 2/22/24 1:13 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

Domino Autoupdate has been introduced in Domino 14.0. It offers automatic downloads from My HCLSoftware download, which has been on early access in parallel and has been released at the same time. My Engage session will go into detail about the functionality with tips and tricks and additional information round both features and the new Domino Download script (https://nashcom.github.io/domino-startscript/domdownload/). But I want already provide some details about options available today with simple integrations.

Easy to use container image providing ICAP support for ClamAV for Domino CScan  

By Daniel Nashed | 2/22/24 1:11 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

My friend and fellow Ambassador Roberto Boccadoro submitted an Engage session about Domino CScan with ICAP. Sadly his session did not make it into the agenda. But he is part of two OpenNTF sessions. This session idea lead to a new OpenSource project I initiated to help with ICAP support. Thanks Roberto for pushing me to get this implemented! :-) The new project provides a simple to build container image, which natively offers ICAP services over TLS with a ClamAV container in the back-end. The container is ready to be consumed with Domino CScan/ICAP (https://help.hcltechsw.com/domino/14.0.0/admin/conf_scanningattachmentsforviruses.html). It comes with a docker-compose file which glues the official ClamAV container with this new image.

Running Domino in LXC containers on Proxmox requires a trick  

By Daniel Nashed | 2/22/24 1:10 AM | Infrastructure - Notes / Domino | Added by Roberto Boccadoro

Now that VMware might not be everyone's darling any more because of it's new mother ship, I took another look at Proxmox. I know them for quite a while and they are doing a great job. I rebuilt a Intel NUC with 2 TB NVMe disk with the current version of Proxmox. Proxmox supports full VMs and also LXC -- which is an interesting option for testing in lab environments. You can setup a new Linux test machine in minutes from a template. And there are ready to use templates for all major Linux distributions. I had a post long time ago about Proxmox automation on command-line.