Environment data in Vault
Vault is supported for storing sensitive key-value pairs for Docker configuration. If you want to use this method of environment configuration, set CONFIGURE_MODE to Vault. With this setting, startup scripts fetch environment-related data from Vault when you start a Docker container.
EnvironmentName
(For example,
Non-production), and EnvironmentType
(For example,
auth).
Storing key-value pairs in Vault
To set up Vault, see the Vault website. When you have a Vault ready for use, you can complete the following steps to store and retrieve key-value pairs.- Create a mount point based on the {Tenant}.For example,
init_json='json_data={"type":"generic","description":"description","config":{"max_lease_ttl":"876000"}}' header="X-Vault-Token:vaultToken"
curl -X POST -H $header -H "Content-Type:application/json" -d '{"type":"generic","description":"description","config":{"max_lease_ttl":"876000"}}' http://vaultIP:vaultPort/v1/sys/mounts/tenant
- Store key-value pair data by using the following
command.
For example, to store the value "mall" for a key name "dbName" under path MyCompany/Non-production/auth/dbName:curl -X POST -H "X-Vault-Token:vaultToken" -d '{"value":"value"}' http://vaultIP:vaultPort/v1/tenant/environmentName/enviromentType/targetKey
curl -X POST -H "X-Vault-Token:7f47efbb-b162-619b-0ced-448079d91b77" -d '{"value":"mall"}' http://myhostname.com:8200/v1/MyCompany/Non-production/auth/dbName
Retrieving key-value pairs in Vault
Retrieve key-value pair data by using the following command.curl -X GET -H "X-Vault-Token:vaultToken" http://VaultIP:VaultPort/v1/tenant/environmentName/enviromentType/targetKey | jq -r .data.value
Key-value data structure in Consul/Vault
The following tables list all of the default key-value paths on Consul/Vault.
The default EnvType values are auth
and
live
. The only exception is the additional
EnvType named data
for the
search-query-app
application.
You can add your key-value paths based on your business requirements and define custom logic to fetch them.
- Base deployment configurations
HCL Digital Experience integration
Must-Gather logging
LDAP integration
IBM MQ integration
KeyPath | Mandatory/Optional | Sample value | Comments |
---|---|---|---|
Tenant/EnvName/domainName | Optional | default.svc.cluster.local | If no value is specified, then the default
default.svc.cluster.local is used. |
Tenant/EnvName/externalDomainName | Optional | mycompany.com | This value specifies the store-web external domain name, which can be
recognized by your browser. For example, in the hostname
|
Tenant/EnvName/zookeeperHost | Mandatory | Specify a value if you want to set a zookeeperHost value, instead of using the default value. | |
Tenant/EnvName/zookeeperPort | Optional | Specify a value if you want to set a zookeeperPort value, instead of using the default value. | |
Tenant/EnvName/zookeeperScheme | Optional | Specify a value if you want to set a zookeeperScheme value, instead of using the default value. | |
![]() |
Mandatory | Specify the Redis hostname that NiFi will connect to for event messages. | |
![]() |
Optional | Specify the Redis host port number that NiFi will connect to for event messages. | |
Tenant/EnvName/kafkaServers | Optional | Specify a value if you want to enable ZooKeeper and Kafka. The format for
this key-value pair is as
follows:
|
|
Tenant/EnvName/zooKeeperServers | Optional | Specify a value if you want to enable ZooKeeper and Kafka. The format for
this key-value pair is as
follows:
|
|
Tenant/EnvName/EnvType/txnPort | Optional | Specify a value if you want to set txnPort, instead of using the default value. | |
Tenant/EnvName/EnvType/txHost | Optional | Specify a value if you want to set txHost, instead of using the default value. | |
Tenant/EnvName/EnvType/txPort | Optional | Specify a value if you want to set txPort, instead of using the default value. | |
Tenant/EnvName/EnvType/xcHost | Optional | Specify a value if you want to set xcHost, instead of using the default value. | |
Tenant/EnvName/EnvType/xcPort | Optional | Specify a value if you want to set xcPort, instead of using the default value. | |
Tenant/EnvName/EnvType/storeHost | Optional | Specify a value if you want to set storeHost, instead of using the default value. | |
Tenant/EnvName/EnvType/storePort | Optional | Specify a value if you want to set storePort, instead of using the default value. | |
Tenant/EnvName/EnvType/storeWebHost | Optional | Specify a value if you want to set storeWebHost, instead of using the default value. | |
Tenant/EnvName/EnvType/storeWebPort | Optional | Specify a value if you want to set storeWebPort, instead of using the default value. | |
Tenant/EnvName/EnvType/reactStoreHost | Optional | Specify a value if you want to set reactStoreHost, instead of using the default value. | |
Tenant/EnvName/EnvType/reactStorePort | Optional | Specify a value if you want to set reactStorePort, instead of using the default value. | |
Tenant/EnvName/EnvType/reactStoreServiceHost | Optional | Specify a value if you want to set reactStoreServiceHost, instead of using the default value. | |
Tenant/EnvName/EnvType/reactStoreServicePort | Optional | Specify a value if you want to set reactStoreServicePort, instead of using the default value. | |
Tenant/EnvName/EnvType/crs-sslport | Optional | Specify if you want to set the store access security port to SSLPort. | |
Tenant/EnvName/EnvType/crs-nonsslport | Optional | Specify if you want to set the store access non-security port to NONSSLPort. | |
Tenant/EnvName/EnvType/searchPort | Optional | Specify a value if you want to set searchPort, instead of using the default value. | |
Tenant/EnvName/EnvType/searchScheme | Optional | Specify a value if you want to set searchScheme, instead of using the default value. | |
Tenant/EnvName/EnvType/searchMasterHost | Optional | Specify a value if you want to set searchMasterHost, instead of using the default value. | |
Tenant/EnvName/EnvType/searchSlaveHost | Optional | Specify a value if you want to set searchSlaveHost, instead of using the default value. | |
Tenant/EnvName/EnvType/searchRepeaterHost | Optional | Specify a value if you want to set searchRepeaterHost, instead of using the default value. | |
Tenant/EnvName/searchPort | Optional | Specify a value if you want to set searchPort, instead of using the default value. | |
Tenant/EnvName/searchMasterHost | Optional | Specify a value if you want to set searchMasterHost, instead of using the default value. | |
Tenant/EnvName/searchSlaveHost | Optional | Specify a value if you want to set searchSlaveHost, instead of using the default value. | |
Tenant/EnvName/searchRepeaterHost | Optional | Specify a value if you want to set searchRepeaterHost, instead of using the default value. | |
![]() |
Optional | Specify a value if you want to set queryHost, instead of using the default value. | |
![]() |
Optional | Specify a value if you want to set queryPort, instead of using the default value. | |
Tenant/EnvName/nifiHost | Optional | Specify a value if you want to set a nifiHost value, instead of using the default value. | |
Tenant/EnvName/nifiPort | Optional | Specify a value if you want to set a nifiPort value, instead of using the default value. | |
Tenant/EnvName/nifiScheme | Optional | Specify a value if you want to set a nifiScheme value, instead of using the default value. | |
Tenant/EnvName/nifiWebHttpPort | Optional | Specify a value if you want to set a nifiWebHttpPort value, instead of using the default value. | |
Tenant/EnvName/registryHost | Optional | Specify a value if you want to set a registryHost value, instead of using the default value. | |
Tenant/EnvName/registryPort | Optional | Specify a value if you want to set a registryPort value, instead of using the default value. | |
Tenant/EnvName/registryScheme | Optional | Specify a value if you want to set a registryScheme value, instead of using the default value. | |
Tenant/EnvName/queryHost | Optional Removed in 9.1.12.0+ |
Specify a value if you want to set a queryHost value, instead of using the default value. | |
Tenant/EnvName/queryPort | Optional Removed in 9.1.12.0+ |
Specify a value if you want to set a queryPort value, instead of using the default value. | |
Tenant/EnvName/queryScheme | Optional | Specify a value if you want to set a queryScheme value, instead of using the default value. | |
Tenant/EnvName/ingestHost | Optional | Specify a value if you want to set an ingestHost value, instead of using the default value. | |
Tenant/EnvName/ingestPort | Optional | Specify a value if you want to set an ingestPort value, instead of using the default value. | |
Tenant/EnvName/ingestScheme | Optional | Specify a value if you want to set an ingestScheme value, instead of using the default value. | |
Tenant/EnvName/elasticSearchHost | Mandatory | Specify a value if you want to set an elasticSearchHost value, instead of using the default value. | |
Tenant/EnvName/elasticSearchPort | Optional | Specify a value if you want to set an elasticSearchPort value, instead of using the default value. | |
Tenant/EnvName/elasticSearchScheme | Optional | Specify a value if you want to set an elasticSearchScheme value, instead of using the default value. | |
Tenant/EnvName/EnvType/toolingBaseUrl | Optional | https://tooling-web-host:port/path-to-tooling-spa | This value is used by Management Center to load tooling single page
application (SPA) from the tooling web server.![]() Once ingress is enabled, you must configure this toolingBaseUrl to use the store domain. |
Tenant/EnvName/certs/CertName | Optional | demo2/qa/certs/demo2qa-test={‘certificate’: ‘asdfadsfadsfads’, ‘destination_host’: ‘adsfadsf’, ‘issuing_ca’: ‘fadsfadsfads’, ‘keystorepass’: ‘adsfadsfads’, ‘private_key’: ‘adsfadsfasd’} | You can add third-party certificate records. |
KeyPath | Mandatory/Optional | Sample value | Comments |
---|---|---|---|
Tenant/EnvName/EnvType/jdbcUrl | Optional | If you want to change the database connection URL, specify a value. | |
Tenant/EnvName/EnvType/jdbcDriver | Optional | If you want to change the database driver location in Nifi, specify a value. | |
Tenant/EnvName/EnvType/dbType | Mandatory | The database type. Accepted values are:
|
|
Tenant/EnvName/EnvType/dbSSLEnable | Optional | false |
Specify whether the database connection uses SSL. Accepted values are:
false . |
Tenant/EnvName/EnvType/dbHost | Mandatory | The database host name for the environment. | |
Tenant/EnvName/EnvType/dbName | Mandatory | The database name. | |
Tenant/EnvName/EnvType/dbPort | Mandatory | The database port number. | |
Tenant/EnvName/EnvType/dbUser | Mandatory | The HCL Commerce database user name. | |
Tenant/EnvName/EnvType/dbPassword | Mandatory | The HCL Commerce database user password. | |
Tenant/EnvName/EnvType/dbPassEncrypt | Mandatory | The encrypted HCL Commerce database user password. | |
Tenant/EnvName/EnvType/dbaUser | Mandatory | The database administrator user name. | |
Tenant/EnvName/EnvType/dbaPassEncrypt | Mandatory | The encrypted database administrator user password. | |
Tenant/EnvName/EnvType/spiUserName | Mandatory | The spiuser user name. | |
Tenant/EnvName/EnvType/spiUserPwd | Mandatory | The ASCII encrypted spiuser user password. | |
Tenant/EnvName/EnvType/adminSpiUserPwd | Mandatory | The plain text spiuser user password. | |
Tenant/EnvName/EnvType/dbXA | Optional | boolean | |
Tenant/EnvName/EnvType/merchantKeyEncrypted | Mandatory | The encrypted merchant key, encrypted with the key encryption key. The
merchant key was created when you or an administrator loaded the HCL Commerce database schema. For more information, see: Important: You must specify your own merchant key and key
encryption key values for the security of your HCL Commerce installation. Do not
use the default values contained within the provided sample configuration files and
documentation examples. |
|
![]() |
Optional | The plain text key that is used to encrypt the merchant key. The key encryption key is required to be 32 characters. |
KeyPath | Mandatory/Optional | Sample value | Comments |
---|---|---|---|
Tenant/EnvName/nifiClusterIsNode | Optional | false |
Specify whether the NiFi installation is a standalone
installation. Accepted values are:
false . |
Tenant/EnvName/nifiElectionMaxWait | Optional | 1 min | Specify a value if you want to if you want to set the maximum wait time for the NiFi election node service. |
Tenant/EnvName/nifiJvmHeapInit | Optional | Specify a value if you want to set a nifiJvmHeapInit value,
instead of using the default value. |
|
Tenant/EnvName/nifiJvmHeapMax | Optional | Specify a value if you want to set a nifiJvmHeapMax value,
instead of using the default value. |
|
Tenant/EnvName/elasticSearchEnabled | Mandatory | boolean | Specify whether the environment uses Elasticsearch-based search or Solr-based
search. Accepted values are:
|
Tenant/EnvName/authJWKS | Mandatory | Specify a value to set the JSON Web Key Set (JWKS) and key ID on the Transaction server. This is used to sign and validate the JSON Web Token
(JWT). To genereate a JWKS, see the generateJWKS utility. |
|
Tenant/EnvName/sessionKeyEncrypt |
|
The encrypted session key, encrypted with the key encryption key. The Session
key was created when you or an administrator loaded the HCL Commerce
database schema. Important: You must specify your
own Merchant key and key encryption key values for the security of your HCL Commerce installation. Do not use the default values contained within the
provided sample configuration files and documentation examples. |
|
Tenant/EnvName/enableFeatureNlp | Optional | boolean | Specify a value if you want to set the natural language processing
feature. Note: This feature requires the
Elasticsearch-based search solution. Accepted values are:
![]() |
Tenant/EnvName/EnvType/searchQueryBaseUrl | Optional | https://search.demodevauth.hclcomdev.com/ or https://search.demodevlive.hclcomdev.com/ | Specify a Search server to be used by Management Center to generate mock search results. |
![]() |
Optional | EN | Specify a comma separated list of language codes for natural language processing. |
![]() |
Optional | boolean | Specify whether or not to enable the lemmatization feature for natural language processing. |
![]() |
Optional | Specify an additional comma separated list of Java package names that the query service should scan for processing. |

KeyPath | Mandatory/Optional | Sample value | Value description |
---|---|---|---|
![]() |
Mandatory | yes, or no | Accepted values
are:
The default value is yes. If enabled, the deploymentType parameter is required to be specified. |
![]() |
Mandatory | development, staging, or production | The deployment type. This value is required when allowTelemetry value is yes, but is ignored if the allowTelemetry value is set to no. Accepted values are:
|
KeyPath | Mandatory/Optional | Sample value | Comments |
---|---|---|---|
Tenant/EnvName/EnvType/traceSpecification/ts-app | Optional | If you want to change the trace specification for the Transaction server, specify a value. | |
Tenant/EnvName/EnvType/traceSpecification/search-app | Optional | If you want to change the trace specification for the Search server, specify a value. | |
Tenant/EnvName/EnvType/traceSpecification/crs-app | Optional | If you want to change the trace specification for the Store server, specify a value. | |
Tenant/EnvName/EnvType/traceSpecification/xc-app | Optional | If you want to change the trace specification for the Customization server, specify a value. | |
Tenant/EnvName/EnvType/traceSpecification/search-ingest-app | Optional | If you want to change the trace specification for the Ingest server, specify a value. | |
Tenant/EnvName/EnvType/traceSpecification/search-query-app | Optional | If you want to change the trace specification for the Query server, specify a value. | |
![]() |
Optional | If you want to change the trace specification for the Cache Manager application, specify a value. | |
![]() |
Optional | If you want to change the trace specification for the Must-Gather application, specify a value. |
KeyPath | Mandatory/Optional | Sample value | Comments |
---|---|---|---|
Tenant/EnvName/EnvType/jvmContainerSupport | Optional | ||
Tenant/EnvName/EnvType/redisPasswordEncrypt | Optional | ||
Tenant/EnvName/EnvType/kafkaTopicPrefix | Optional | ${TENANT}${ENVIRONMENT}${ENVTYPE} | Specify a value if you want to config ZooKeeper and Kafka. If no value is specified, the following default value is applied: ${TENANT}${ENVIRONMENT}${ENVTYPE} |
Tenant/EnvName/EnvType/healthCenterEnable | Optional | boolean | Specify a value if you want to enable Health Center. Accepted values
are:
|
![]() |
Optional | boolean | Specify whether to enable or disable single sign-on (SSO). Accepted values
are:
The default value is false. For more information, see Enabling single sign-on. |
![]() |
Optional (Mandatory if ssoEnable is set to true.) | Specify the domain name that contains a set of hosts to which SSO
applies. Accepted values are:
The default value is false. This key value is required to be defined if ssoEnable is set to true. For more information, see Enabling single sign-on. |
|
![]() |
Optional (Mandatory if ssoEnable is set to true.) | boolean | Specify whether an SSL connection is used for SSO requests. Accepted
values are:
This key value is required to be defined if ssoEnable is set to true. For more information, see Enabling single sign-on. |
![]() |
Optional | boolean | Specify whether to enable or disable the single sign-on (SSO)
keepAliveSession feature on the Transaction server. Accepted values are:
The default value is false. For more information, see Enabling single sign-on. |

KeyPath | Mandatory/Optional | Sample value | Comments |
---|---|---|---|
![]() |
Optional | The hostnames for either the
auth or live
instances of HCL Digital Experience (DX). This
is required to integrate HCL Commerce
with DX.Note:
|
|
![]() |
Optional | 443 | The port number for the HCL Digital Experience (DX) auth or
live instance. The default value
is set to 443 if the DX
hostname has been set and there is no custom value
specified. |
![]() |
Optional | https | http | The scheme for the HCL Digital Experience (DX) auth or
live instance. The default value
is set to https if the DX
hostname has been set and there is no custom value
specified. |

KeyPath | Mandatory/Optional | Sample value | Comments |
---|---|---|---|
![]() |
Mandatory | The Elasticsearch log host name used by Must-Gather. | |
![]() |
Mandatory | The Elasticsearch log port number used by Must-Gather. | |
![]() |
Optional | The maximum number of documents to retrieve from the Elasticsearch log. |

KeyPath | Mandatory/Optional | Sample value | Comments |
---|---|---|---|
![]() |
Mandatory | The LDAP bind password XOR encoded by the
WebSphere Application Server V8.5.5 Liberty
securityUtility utility. For
example:
For more information on the securityUtility utility, see securityUtility command in the WebSphere Application Server V8.5.5 Liberty documentation. |
|
![]() |
Mandatory | The LDAP server type. Accepted values
are:
|
|
![]() |
Mandatory | The fully qualified LDAP server host name. | |
![]() |
Mandatory | The LDAP server port number. | |
![]() |
Mandatory | boolean | Specify whether the LDAP server requires an
SSL connection. Accepted values are:
|
![]() |
Mandatory | The LDAP bind distinguished name (DN). The value must be in lower case. | |
![]() |
Mandatory | The LDAP property names that are used to log into the application server. | |
![]() |
Mandatory | The LDAP search base distinguished name (DN). The value must be in lower case. | |
![]() |
Optional | Specify a value for the Realm name, instead
of using the default value. The default value is
Note: If you are integrating with
HCL Digital Experience, you must use the same
Realm name for both. |
|
![]() |
Optional | The LDAP user search filter. Only used for the custom LDAP type. | |
![]() |
Mandatory | The LDAP user prefix. | |
![]() |
Mandatory | The full distinguished name (DN) that maps to the HCL Commerce root organization. The value must be in lower case. | |
![]() |
Mandatory | The full distinguished name (DN) that maps to the HCL Commerce default organization. The value must be in lower case. |

KeyPath | Mandatory/Optional | Sample value | Comments |
---|---|---|---|
![]() |
Mandatory | Specify whether to enable IBM MQ integration. Accepted values are:
|
|
![]() |
Mandatory | The session timeout value. | |
![]() |
Mandatory | The maximum number of connections allowed with IBM MQ. | |
![]() |
Mandatory | The hostname of the IBM MQ server. | |
![]() |
Mandatory | The port number of the IBM MQ server. | |
![]() |
Mandatory | The IBM MQ Queue Manager used by HCL Commerce to connect to the IBM MQ server. | |
![]() |
Mandatory | The IBM MQ Error Queue Name. | |
![]() |
Mandatory | The IBM MQ Queue Name. | |
![]() |
Mandatory | The IBM MQ Queue Name to process messages in series. | |
![]() |
Mandatory | The IBM MQ Queue Name to process messages in parallel. | |
![]() |
Mandatory | The IBM MQ Outbound Queue Name. |