TimeBridge Green2Glass Installation

IBM i compatible step by step guide

Table of Contents

Introduction Pre-requisites Frontend Installation Mapepire Installation Java Middleware Installation Verify Product Installation Security Considerations (Installation Scope)

Introduction

This document provides a comprehensive, step-by-step guide for installing the TimeBridge G2G product on an IBM i environment. It covers the complete setup process, including installation of the Angular-based frontend and the Java middleware components required to run the application seamlessly. In addition, the guide includes detailed instructions for installing and configuring Mapepire. The verification steps are to ensure all components are correctly set up and functioning as expected. This document is intended for system administrators and technical teams responsible for environment setup and aims to ensure a smooth and reliable installation experience.

Pre-requisites

  1. A legal agreement must be worked out between Programmers.io and the customer
  2. VPN: Ensure you are connected to the VPN (if required)
  3. 3 Ports: 2 ports for Java Services and 1 for Apache Server
  4. One IBM i user (SECADM Authority required)
  5. Java 8 minimum supported
  6. Mapepire installation required
  7. A TLS certificate (IBM i Digital Certificate Manager – DCM) – Optional
  8. HTTPS port availability (for example 443 or custom) – Optional

Frontend Installation

Step 1: Create an HTTP server

  1. Open the URL in a browser:

    http://<MachineIP>:2001/HTTPAdmin
    (Note: The URL is case-sensitive.)

  2. Follow these steps:
    • Provide the server’s name as g2g_ui.

    • Use default options and continue clicking Next until you reach the port screen.

    • If required, update the port number to run the frontend on a different port. By default, we are using 4200 for the frontend.

      • Again, use default options and continue clicking Next (3-4 times) until the confirmation screen appears.
      • Verify the details and click Finish.


  3. Go to the Proxy tab and then reverse proxy.


    • Add three key value pairs and select the request type to Client requests

    Key

    URL

    /G2G_ASSETS

    http://<MachineIP>:<UI-PORT>/g2g/assets/

    /G2G_UI

    http://<MachineIP>:<UI-PORT>/g2g

    /G2G-Prod

    http://<MachineIP>:<BACKEND-PORT>

      • Example


  4. Verify the proxy setup.


  5. Once created, the server screen will appear. Click the Play button to start the HTTP server.

  6. Confirm that the server status shows as Running.


Step 2: Enabling HTTPS for TimeBridge G2G (Optional configuration)

  1. Create/import a certificate in IBM i DCM.
  2. Open Digital Certificate Manager.

    http://<MachineIP>:2001/dcm

    Here, you should:

    1. Open or create the *SYSTEM certificate store.
    2. Import or create a server certificate for the hostname/IP users will access.
    3. Create or use an application ID for this HTTP Server instance. For example: QIBM_HTTP_SERVER_G2G
    4. Assign the server certificate to that application ID.

    The important part is that this application ID must match the value you put in the HTTP Server config as SSLAppName. IBM notes that SSLAppName identifies the secure application and is used by DCM to associate the certificate with that HTTP server application.


  3. Add SSL module and HTTPS listener.
      • Open /www/g2g_ui/conf/httpd.conf file and add this near your existing LoadModule lines:

    LoadModule ibm_ssl_module /QSYS.LIB/QHTTPSVR.LIB/QZSRVSSL.SRVPGM

      • Then add an HTTPS listener. Standard HTTPS is port 443:

    Listen *:443

  4. Wrap your HTTPS config in a <VirtualHost *:443>


    Example:

    <VirtualHost *:443>
    ServerName 129.40.95.249

        SSLEngine On
    SSLAppName QIBM_HTTP_SERVER_G2G

        DocumentRoot /www/g2g_ui/htdocs

        <Directory />
    Require all denied
    </Directory>

        <Directory /www/g2g_ui/htdocs>
    Require all granted
    </Directory>

        ProxyPass /G2G_ASSETS http://129.40.95.249:4200/g2g/assets/
    ProxyPassReverse /G2G_ASSETS http://129.40.95.249:4200/g2g/assets/

        ProxyPass /G2G_UI http://129.40.95.249:4200/g2g
    ProxyPassReverse /G2G_UI http://129.40.95.249:4200/g2g

        ProxyPass /G2G-Prod http://129.40.95.249:8082
    ProxyPassReverse /G2G-Prod http://129.40.95.249:8082
    </VirtualHost>


Step 3: Upload the webpack

  1. Paste the Angular build in the htdocs folder of the Apache Server created (for example: /www/g2g_ui/htdocs).



  2. Copy and paste complete Angular Folder build to this folder.


    Note: Always make sure that the server name must be “g2g_ui” (as used in the configuration while sever creation) and path be like “/www/g2g_ui/htdocs”.

      1. Please delete all the files in the directory and then Copy all folders from Angular folder and upload them to /www/g2g_ui/htdocs/ on the server.

  3. Run the command:
    • CHGAUT OBJ(‘/www/g2g_ui/htdocs/‘) USER(QTMHHTTP) DTAAUT(*RX) SUBTREE(*ALL)

  4. Verify the upload:
    • Open the URL in a browser:
      http://<IP>:<UI-PORT>/g2g-admin


Mapepire Installation

Official instructions are available for installing Mapepire on your IBM i server, and you can refer to the official installation link for the most up-to-date guidance. The steps outlined below are based on what was applicable at the time this document was created.

Step 1: Install with yum.

  1. Call QP2TERM.
  2.  Run this command:

/QopenSys/pkgs/bin/yum install mapepire-server -y



Step 2: Install service commander

  1. Run this command:

/QopenSys/pkgs/bin/yum install service-commander -y


Step 3: Start Mapepire

  1.  Run this command:

    /QopenSys/pkgs/bin/sc start mapepire

  2.  Run this command to check status:

    /QopenSys/pkgs/bin/sc status mapepire

  3. Run this command in QSH (This will give the Mapepire hostname that needs to be updated in start.sh file for Java installation):

    Openssl s_client -connect <IBM IP>:8076 – showcerts


Java Middleware Installation

Step 1: Upload Java artifact

  1. Connect to the IFS.
  2. Navigate to the “/www” directory and create a new folder “g2g_java”.


  3. Copy and paste all contents of the Java Folder build to this folder.

Step 2: Upload license shell script

  1. Update “licence_host” in the “licnese_start.sh” file with the license jar port.

Step 3: Upload product start shell script

  1. Update the Server_Port with Java Main Jar port. Eg. 8082.
  2. Update the Server_Name key with Apache server name given when creating the server. Eg. g2g_ui.
  3. Update the G2g Frontend_Port with port given when creating the Apache server. Eg.4200.
  4. Update licence_port with the licensing Jar port.
  5. Update the app_features_key with the feature key.
  6. Update Mapepire details.

  7. Upload this updated file to the folder.


Step 4: Start Java as a service

  1. Run the following command on Green Screen to set an environment variable:

    ADDENVVAR ENVVAR(QIBM_QSH_CMD_OUTPUT) VALUE(*NONE)

  2. Submit the License job using the command: (First Deploy the License jar)

    SBMJOB CMD(QSH CMD(‘/www/g2g_java/licence_start.sh’)) JOB(G2G_LIC) JOBQ(QSYSNOMAX)

  3. Verify that the Licensing job is running then only start the G2G_MAIN job.
    • Run WRKACTJOB command and press F7 and search G2G_LIC.



  4. Submit the backend job using the command:

    SBMJOB CMD(QSH CMD(‘/www/g2g_java/start.sh’)) JOB(G2G_MAIN) JOBQ(QSYSNOMAX)

  5. Verify the job status:
    • Use the WRKACTJOB command to confirm if the job has started.
    • Check logs in the directory (/www/g2g_java/log).

Verify Product Installation

Frontend

Open the Admin URL in a browser to confirm frontend is running:
http://<IP>:<UI-PORT>/g2g-admin

Note: Please contact PIO support to get the credentials for Admin Web.
After login to the Admin Web, you can ensure that the product is installed correctly.


Java middleware

Verify the Java service logs to ensure the service started successfully.

  1. Find the logs at below location:

    /www/g2g_java/logs

  2. Open the log file and you will be able to see the server started successfully.


Security Considerations (Installation Scope)

This section describes the key security considerations for installing and deploying TimeBridge Green2Glass (G2G) on IBM i. G2G is designed to work with the native IBM i security framework and does not introduce any separate or proprietary security mechanisms. The following points help establish a secure baseline and align with standard enterprise practices.

  1. Use of Native IBM i Security
    G2G relies entirely on the built-in security features of IBM i, including:

    • User profile-based authentication
    • Object-level authority controls
    • TLS/SSL support through the IBM HTTP Server

    All access control, auditing, and system-level security are managed by the IBM i operating system. G2G does not override or bypass these controls.

  2. HTTPS Communication (Recommended)
    To ensure secure communication between users and the application, HTTPS should be enabled on the IBM HTTP Server (Apache) used by G2G.

    • TLS certificates should be managed using IBM i Digital Certificate Manager (DCM)
    • The Apache instance for G2G (g2g_ui) should be configured to use an HTTPS port
    • All browser access to G2G interfaces (such as /g2g-admin and /g2g) should use HTTPS

    Note: Communication between the Apache reverse proxy and backend Java services may remain over HTTP because it is limited to internal network traffic. If required, this can also be secured with HTTPS based on organizational policies.

  3. User Profiles and Authorities
    For installation and operation:

    • Installation requires a user profile with *SECADM authority
    • Avoid running runtime services under highly privileged profiles such as QSECOFR
    • Use a dedicated service profile for G2G operations
    • Grant appropriate access to required directories, including:
      • /www/g2g_ui
      • /www/g2g_java
      • Mapepire installation and runtime locations

    Access should follow the principle of least privilege.

  4. File and Directory Permissions

    • Web directories must allow read and execute access for the Apache runtime user (QTMHHTTP)
    • Configuration files, license data, and logs should be restricted to authorized users only

    Proper permission settings are essential to prevent unauthorized access within the IFS.

  5. Network and Port Exposure
    G2G uses multiple ports for frontend, backend, and supporting services during installation.
    Recommended practices:

    • Expose only necessary ports externally
    • Restrict backend Java and Mapepire ports to internal networks wherever possible
    • Use firewalls and IBM i TCP/IP configurations to control access

    G2G does not handle firewall or port management.

  6. Logging and Audit Awareness

    • Application logs are stored in: /www/g2g_java/logs
    • These logs are intended for troubleshooting and operational monitoring
    • System-level auditing is controlled by IBM i settings and policies

    Organizations can enable additional auditing features on IBM i to meet compliance or regulatory requirements.

  7. Scope Disclaimer
    This document covers only installation-related security aspects. Broader security practices, such as compliance, monitoring, and risk management will remain the responsibility of the customer and their IBM i environment configuration.