$CATALINA_HOME/conf/server.xml

** tag <Server>/<Service>/<Connector> 加入下列屬性：

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true"
               redirectPort="8443"

               defaultSSLHostConfigName="demo.ezteamwork.com"
               maxParameterCount="10000"
               address="0.0.0.0"
               URIEncoding="UTF-8"
               compression="on"
               maxPartCount="-1"
               maxPostSize="-1"
               server="Confidential"
               >
        <SSLHostConfig hostName="demo.ezteamwork.com" protocols="+TLSv1.2,+TLSv1.3"
                       ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256" >
            <Certificate certificateKeystoreFile="/home/ctu/letsencrypt/demo.ezteamwork.com.p12"
                         certificateKeyAlias="tomcat"
                         certificateKeystoreType="JKS", or "PKCS12"
                         certificateKeystorePassword="changeit"
                         certificateKeyPassword="If not specified, the default behaviour for JSSE is to use the certificateKeystorePassword."
                         type="UNDEFINED", "RSA", "DSS", or "EC" />
        </SSLHostConfig>
    </Connector>

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
               maxThreads="150" SSLEnabled="true"

               defaultSSLHostConfigName="demo.ezteamwork.com"
              maxParameterCount="10000"
               address="0.0.0.0"
               URIEncoding="UTF-8"
               compression="on"
               maxPartCount="-1"
               maxPostSize="-1"
               server="Confidential" >
		<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol"
        
		                 compression="on" overheadDataThreshold="0" />
        <SSLHostConfig hostName="demo.ezteamwork.com" protocols="+TLSv1.2,+TLSv1.3"
                       ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256">
            <Certificate certificateKeyFile="/home/ctu/ssl_key/demo.ezteamwork.com-eckey.pem"
                         certificateFile="/home/ctu/ssl_key/demo.ezteamwork.com-cert.pem"
                         certificateChainFile="/home/ctu/ssl_key/demo.ezteamwork.com-ca.pem"
                         type="UNDEFINED", "RSA", "DSS", or "EC" />
        </SSLHostConfig>
    </Connector>

** tag <Server>/<Service>/<Engine>/<Realm> 加入下列屬性：

      <Realm className="org.apache.catalina.realm.LockOutRealm">

        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
               resourceName="UserDatabase">
            <CredentialHandler className="org.apache.catalina.realm.MessageDigestCredentialHandler" algorithm="sha-512" />
        </Realm>

      </Realm>

** tag <Server>/<Service>/<Engine> 選擇性加入下列 屬性 與 RewriteValve：

      <Host name="demo.ezteamwork.com"  appBase="webapps-demo.ezteamwork.com"
            unpackWARs="true" autoDeploy="true">
        <Alias>*.trial.ezteamwork.com</Alias>
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="access_log-demo.ezteamwork.com" suffix=".txt"
               pattern="%h %l %u %t &quot;%r&quot; %s %b" />
        <Valve className="org.apache.catalina.valves.rewrite.RewriteValve" />
      </Host>

----------------------------------------------------------------------------------------

SSL/TLS connector 預設使用 NIO implementation(protocol="org.apache.coyote.http11.Http11NioProtocol")
要改為 APR/native implementation(protocol="org.apache.coyote.http11.Http11AprProtocol")，需要 Tomcat native library(安裝時也會自動安裝 Apache Portable Runtime library)
EPEL repo 就收錄 Tomcat native library，安裝步驟：

dnf install epel-release
dnf install tomcat-native

----------------------------------------------------------------------------------------

$CATALINA_HOME/conf/tomcat-users.xml 的 tag <tomcat-users/> 中，加入下列 tags

<tomcat-users>

  <role rolename="manager-gui"/>
  <role rolename="manager-script"/>
  <role rolename="manager-jmx"/>
  <role rolename="manager-status"/>
  <user username="ctu" roles="manager-gui,manager-script,manager-jmx,manager-status"
password="a9a23dd5206c9bc56d830e928589e2c1e6e9251feac50a073fe85765dcd520a5$1$ff87a35f1c4b866a94b337bb44677b326bf6fa3f6d92487b6764b8f6a34ac974869c498a8b42474752a1b5ae1d3acc285a7497852055871aa6ad9691d12dc666" />
  <!-- <user username="ctu" roles="manager-gui,manager-script,manager-jmx,manager-status" password="ta1hs1ung" /> -->
  
</tomcat-users>

----------------------------------------------------------------------------------------

$CATALINA_HOME/conf/web.xml

** 避免 JSP 回報 "is exceeding the 65535 bytes limit"
<servlet-name> 為 "jsp" 的 tag <servlet/> 中，加入下列 <param-name> 為 "mappedfile" 的 tag <init-param/>

    <servlet>
        <servlet-name>jsp</servlet-name>
        <servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
        <init-param>
            <param-name>fork</param-name>
            <param-value>false</param-value>
        </init-param>
        <init-param>
            <param-name>xpoweredBy</param-name>
            <param-value>false</param-value>
        </init-param>

        <init-param>
            <param-name>mappedfile</param-name>
            <param-value>false</param-value>
        </init-param>

        <load-on-startup>3</load-on-startup>
    </servlet>

** 啟用 HSTS：加入下列 <filter-name> 為 "httpHeaderSecurity" 的 tag <filter/>

    <filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <async-supported>true</async-supported>
        <init-param>
          <param-name>hstsEnabled</param-name>
          <param-value>true</param-value>
        </init-param>
        <init-param>
          <param-name>hstsMaxAgeSeconds</param-name>
          <param-value>31536000</param-value>
        </init-param>
        <init-param>
          <param-name>hstsIncludeSubDomains</param-name>
          <param-value>true</param-value>
        </init-param>
        <init-param>
          <param-name>hstsPreload</param-name>
          <param-value>true</param-value>
        </init-param>
       <init-param>
          <param-name>antiClickJackingEnabled</param-name>
          <param-value>true</param-value>
        </init-param>
       <init-param>
          <param-name>antiClickJackingOption</param-name>
          <param-value>SAMEORIGIN</param-value>
        </init-param>
    </filter>

再於 <!-- ==================== Built In Filter Mappings ====================== --> 下方
找到 httpHeaderSecurity 的 <filter-mapping>，移除註解讓 filter 啟用

    <filter-mapping>
        <filter-name>httpHeaderSecurity</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
    </filter-mapping>

** 設定 cookie 只能 https only
於 <!-- ==================== Default Session Configuration ================= --> 下方的 tag <session-config/> 中，
加入下列 tag <cookie-config/> 

    <session-config>
        <session-timeout>30</session-timeout>

        <cookie-config>
            <http-only>true</http-only>
            <secure>true</secure>
        </cookie-config>

    </session-config>

----------------------------------------------------------------------------------------

$CATALINA_HOME/conf/context.xml

** 避免啟動 tomcat 出現 "Exception loading sessions from persistent storage"，將下列 <Manager> 的註解移除

    <Manager pathname="" />

** 設定 cookie 只能 same site，加入下列 <CookieProcessor/> 
** 建議只有 company domain 與 common server name 一致，且無 http 與 https 切換，才加入這個設定，
** 否則登入時，因 cookie JSESSIONID 會被瀏覽器遺棄，造成首次燈入會失敗。

    <CookieProcessor className="org.apache.tomcat.util.http.LegacyCookieProcessor" sameSiteCookies="strict" />

----------------------------------------------------------------------------------------

Window's Monitor Tomcat / Tag Java

-Xms4096m
-Xmx4096m
-XX:PermSize=640m # for JDK < 8
-XX:MaxPermSize=640m # for JDK < 8
-XX:MetaspaceSize=640m # for JDK >= 8
 -XX:MaxMetaspaceSize=640m # for JDK >= 8
-XX:+UseParallelGC # for JDK < 17
-XX:ParallelGCThreads=4 # for JDK < 17
-XX:+UseParallelOldGC # for JDK < 17
-XX:+UseZGC # for JDK >= 17
-XX:+ZGenerational # for JDK >= 17
-XX:MaxGCPauseMillis=100
-XX:+UseAdaptiveSizePolicy
-Dfile.encoding=UTF-8
-Dsun.jnu.encoding=UTF-8
#-XX:SoftRefLRUPolicyMSPerMB=10 # Solve: Metaspace OOM after redeploying a web application in Tomcat multiple times.
-Djava.awt.headless=true # Fix: Could not initialize class sun.awt.X11.XToolkit
-Djdk.tls.client.protocols=TLSv1.2 # workaround for jdk8, jdk11 with sqlserver

----------------------------------------------------------------------------------------
