### Install and verify Java on VM

Source: https://flowcrypt.com/docs/technical/workspace-key-manager/usage/deployment.html

Install Java on the VM and verify the installation by checking the Java version. The output should display the installed Java version.

```bash
sudo apt install default-jre
```

```bash
java -version
```

--------------------------------

### Start FlowCrypt WKM app

Source: https://flowcrypt.com/docs/technical/workspace-key-manager/usage/deployment.html

Start the FlowCrypt WKM app. Confirm the service is running by checking for the line `Listening on https://...` in the command line output.

```bash
sudo java -jar flowcrypt-workspace-key-manager-demo.jar
```

--------------------------------

### GET /api/health - Health Check Response

Source: https://flowcrypt.com/docs/technical/external-service/usage/external-service-api.html

Example JSON response from the health check endpoint, which is an empty object.

```json
{}

```

--------------------------------

### GET /api/ - Environment Info Response

Source: https://flowcrypt.com/docs/technical/external-service/usage/external-service-api.html

Example JSON response from the environment info endpoint, containing vendor, service, orgId, and version fields.

```json
{
  "vendor": "FlowCrypt",
  "service": "external-service",
  "orgId": "evaluation.org",
  "version": "2020-01-DEV"
}

```

--------------------------------

### Sample flowcrypt-wkd-server.properties Configuration

Source: https://flowcrypt.com/docs/technical/wkd-server/latest/technical-overview.html

Sample configuration file for the WKD server. Includes general settings (org.id, api.hostname, api.port, api.accept.hosts, api.https.enabled, api.cors.origins, api.error.format, api.openapi.enabled, wkd.domain) and commented-out pull sync (LivePullFromEkmStore) and push sync (DatabaseStore) parameters for PostgreSQL and CockroachDB.

```properties
# https://flowcrypt.com/docs/technical/wkd-server/latest/technical-overview.html

######################################################
################ GENERAL - WKD #######################
######################################################

org.id=evaluation.org

api.hostname=0.0.0.0
# Users need to be able to access this server over the HTTPS 443 port:
#  - When using a Reverse Proxy for SSL termination, you can leave the port below as is (or choose any port you like)
#    and have the Reverse Proxy serve users at the 443 port.
#  - When not using a Reverse Proxy, you need to set the 443 port and enable HTTPS below.
api.port=32953
api.accept.hosts=localhost:32953
api.https.enabled=false
#api.https.key.file=flowcrypt-email-key-manager.p12
#api.https.key.password=password
api.cors.origins=*
api.error.format=id_only
api.openapi.enabled=false

# This is your primary email domain. If a WKD request does not specify a domain, this domain will be used as the default.
wkd.domain=yourdomain.org

###########################################################
################# PULL SYNC PARAMETERS ####################
###########################################################

# ----------- Uncomment to use Pull Sync -----------------

# (pull) An optional Truststore to override the default JRE Truststore and verify internal SSL certs.
#truststore.file=truststore-to-verify-kmip-server.p12
#truststore.password=password
#truststore.include.default=true

# (pull) WKD Server will live-fetch public keys from your EKM instance.
#store.type=LivePullFromEkmStore
## Typically, your EKM instance will be accessible only on an internal network, while WKD server is publicly accessible.
## This URL needs to be reachable from the WKD server.
#store.ekm.url=https://ekm.yourinternaldomain.org

###########################################################
################# PUSH SYNC PARAMETERS ####################
###########################################################

# ----------- Uncomment to use Push Sync -----------------

# (push) You can configure some instances to be read-only.
#wkd.push.readonly=false

# (push) Limit IPs that can use the PUSH endpoints (IPs of EKM instances, comma-separated. Empty means ALL IPs ARE ALLOWED).
#wkd.push.source.ips=

# (push) EKM authenticates itself with a self-issued JWT that EKM verifies against authentication public key.
#auth.service.pushsync.verification.key=

# (push) EKM will push public key updates to WKD, which stores it independently in a PostgreSQL database.
#store.type=DatabaseStore
#store.database.vendor=postgres
#store.postgres.host=localhost
#store.postgres.port=5432
#store.postgres.database=db_wkd
#store.postgres.schema=public
#store.postgres.update.schema=true
#store.postgres.username=user_wkd
#store.postgres.connections=10
#store.postgres.connection.timeout.seconds=5
#store.postgres.connection.idletimeout.seconds=600
#store.postgres.connection.maxlifetime.seconds=1740
#store.postgres.auth.method=password|cert
##store.postgres.auth.password=your_postgres_pwd
##store.postgres.auth.cert=/path/to/client.crt
##store.postgres.auth.key=/path/to/client.key
##store.postgres.auth.ca=/path/to/ca.crt

# (push) EKM will push public key updates to WKD, which stores it independently in a CockroachDB database.
#store.type=DatabaseStore
#store.database.vendor=cockroach
#store.cockroach.host=localhost
#store.cockroach.port=26257
#store.cockroach.database=db_wkd
#store.cockroach.schema=wkd
#store.cockroach.update.schema=true
#store.cockroach.username=user_wkd
#store.cockroach.connections=10
#store.cockroach.connection.timeout.seconds=5
#store.cockroach.connection.idletimeout.seconds=600
#store.cockroach.connection.maxlifetime.seconds=1740
#store.cockroach.auth.method=password|cert
#store.cockroach.auth.password=your_cockroachdb_pwd
#store.cockroach.auth.cert=/path/to/client.crt
#store.cockroach.auth.key=/path/to/client.key
#store.cockroach.auth.ca=/path/to/ca.crt
```

--------------------------------

### GET /api/error - Error Logging Test Response

Source: https://flowcrypt.com/docs/technical/external-service/usage/external-service-api.html

Example JSON response from the error logging test endpoint, containing a 500 code and an intentional exception message.

```json
{
  "code": 500,
  "message": "Intentional unhandled exception to test logging integration",
  "details": "..."
}

```

--------------------------------

### H2 database setup commands and JDBC URLs

Source: https://flowcrypt.com/docs/technical/enterprise/configuration/h2.html

Use these commands and JDBC URLs to set up an H2 database for evaluation or local testing. First create a directory for the database files, then run the H2 console to inspect or debug data. The JDBC URL creates a persistent file-based database, and the optional CIPHER=AES variant enables AES encryption of the entire database.

```bash
mkdir -p /data/enterprise_server_h2
```

```bash
java -jar h2*.jar
```

```text
jdbc:h2:file:/data/enterprise_server_h2;DB_CLOSE_DELAY=-1
```

```text
jdbc:h2:file:/data/enterprise_server_h2;CIPHER=AES
```

--------------------------------

### Test database store connection with --test-store-connection

Source: https://flowcrypt.com/docs/technical/enterprise/configuration/cockroachdb.html

Run this command to test the connection between EKM and the configured database. It connects to the data store and issues one search command. The successful output shows the store session starting, a search command being tested, and a round trip latency of 8ms.

```bash
java -jar flowcrypt-<service-name>.jar --test-store-connection

```

```text
INFO  com.flowcrypt.utils.Reflection - Registering DatabaseStore as Store implementation
INFO  c.f.keymanager.TestStoreConnection - initiating test
INFO  c.f.keymanager.TestStoreConnection - store session started successfully
INFO  c.f.keymanager.TestStoreConnection - testing store search command
INFO  c.f.keymanager.TestStoreConnection - round trip latency: 8ms
INFO  c.f.keymanager.TestStoreConnection - closing session
INFO  c.f.keymanager.TestStoreConnection - success

```

--------------------------------

### Create DB Encryption Key with --create-db-encryption-key

Source: https://flowcrypt.com/docs/technical/enterprise/configuration/db-store-encryption.html

Run after configuring the store encryption properties (except the key itself for source=properties and the identifier for source=kmip). The command creates a new database encryption key based on the configured store.encryption.key.source and prints the key or identifier to configure.

```bash
java -jar flowcrypt-email-key-manager.jar --create-db-encryption-key

```

--------------------------------

### Run WKD Server with java -jar

Source: https://flowcrypt.com/docs/technical/wkd-server/latest/technical-overview.html

Starts the WKD server using the specified configuration file. By default, the server listens on http://localhost:32953; change this and other settings in the flowcrypt-wkd-server.properties file.

```bash
java -jar flowcrypt-wkd-server.jar --config=flowcrypt-wkd-server.properties
```

--------------------------------

### Orchestrator properties example

Source: https://flowcrypt.com/docs/technical/enterprise/configuration/orchestrator.html

Example configuration properties for the Orchestrator service on the EAP. Set these after generating the signing key and enabling the service. The lifecycle processor can be either RotateKeyPairLifecycleProcessor or ExtendKeyPairExpirationLifecycleProcessor.

```properties
orchestrator.timer.enabled=true
orchestrator.timer.seconds=60
orchestrator.batch.size=50
orchestrator.key.pair.lifecycle.processor=RotateKeyPairLifecycleProcessor
orchestrator.key.pair.expiration.threshold.days=60

```

--------------------------------

### GET /documentation

Source: https://flowcrypt.com/docs/technical/enterprise/configuration/network.html

Serves the documentation page.

```APIDOC
## GET /documentation

### Description
Serves the documentation page.

### Method
GET

### Endpoint
/documentation
```

--------------------------------

### JVM heap size configuration with -Xms and -Xmx

Source: https://flowcrypt.com/docs/technical/enterprise/configuration/deployment-checklist.html

Sample command to set the minimum and maximum JVM heap size using the -Xms and -Xmx flags, allowing optimization of resources allocated to the JVM.

```bash
java -jar flowcrypt-<service>.jar -Xms16G -Xmx16G
```

--------------------------------

### Test store connection with --test-store-connection

Source: https://flowcrypt.com/docs/technical/workspace-key-manager/latest/technical-overview.html

Run the WKM jar with the --test-store-connection flag to validate that the store is properly configured. On success, the command returns status 0 on Unix systems and prints the shown log output.

```bash
java -jar flowcrypt-workspace-key-manager.jar --test-store-connection

```

```text
Registering StdoutLogger as a Logger implementation
INFO  Reflection - Registering MasterKeyStore as Store implementation
INFO  MasterKeyStore - Successfully validated MasterKeyStore Test Vector
INFO  c.f.keymanager.TestStoreConnection - initiating test
INFO  c.f.keymanager.TestStoreConnection - success

```

--------------------------------

### GET /key-pairs

Source: https://flowcrypt.com/docs/technical/enterprise/configuration/network.html

Lists all key pairs.

```APIDOC
## GET /key-pairs

### Description
Lists all key pairs.

### Method
GET

### Endpoint
/key-pairs
```