IQ Server System Requirements

The IQ Server should be deployed on dedicated hardware where the specific requirements depend on the deployment architecture, the primary usage patterns, and the scale of deployment. The following guidelines may differ from your requirements.

Development, test, or evaluation deployments can be scaled smaller than these recommendations and will continue to function, though performance degradation may be observed.

Sonatype offers a managed cloud option. Visit our sales page for details.

Installation Requirements

Admin Port Security (Port 8071)

Port 8071 provides access to administrative and operational endpoints used for monitoring, diagnostics, and system health checks. These endpoints are intended for controlled environments because they expose internal server status and configuration details.

Default Secure Binding

The admin connector binds to 127.0.0.1 by default. This ensures that:

• Administrative endpoints are not reachable from external hosts.

• Only local tools and services can interact with the administrative interface.

• The risk of unauthorized access is significantly reduced without additional configuration.

Access Patterns

Local Access

• Works with no additional setup.

• Suitable for environments where monitoring or operational tooling runs on the same host.

Remote Access

Remote access may be required for centralized observability systems, operational dashboards, or third-party monitoring tools. Supported approaches:

1. SSH Tunneling (recommended)

• Provides a secure, temporary, encrypted channel.

  • Example:

    ssh -L 8071:localhost:8071 user@iqserver-host
    

2. Firewall Rules

   • If binding to an external interface, restrict inbound traffic to trusted IP ranges:

     ufw allow from 192.0.2.0/24 to any port 8071 proto tcp
     

3. Reverse Proxy

   • Terminate TLS and enforce authentication at a proxy layer (for example, NGINX or an AWS ALB).
   • Limit access to administrative paths.

Environment Variable Override

To allow remote hosts to connect directly:

export SERVER_ADMIN_CONNECTOR_BIND_HOST=0.0.0.0

Caution Use this setting only with strict network controls in place.

Migration Guidance for Existing Remote Monitoring Tools

If existing tools previously accessed port 8071 remotely:

• Reconfigure them to use SSH tunneling or a secured reverse proxy.

• If direct access is required, apply Firewall restrictions before enabling the external bind host.

• Validate that tools continue to function as expected after switching to secure access methods.

Docker and Kubernetes Guidance

Docker

• Avoid publishing port 8071 directly (-p 8071:8071) unless restricted by firewall rules.

• Prefer Docker’s built-in network isolation and run monitoring sidecars on the same Docker network.

• Use environment variable overrides only when the container is firewalled from public networks.

Kubernetes

• Do not expose port 8071 via a LoadBalancer or Ingress.

• Access patterns:

• Port-forwarding for administrative tasks:

    kubectl port-forward deployment/iq-server 8071:8071
    ```

- **Sidecar monitoring agents** running within the same pod or namespace.

- If you must expose the admin port cluster-internally:

- Use a ClusterIP service scoped to internal namespaces.
  - Apply NetworkPolicies to limit which pods may connect.

## Cloud Installation Recommendations

### For Amazon EC2 - Secure Cloud Services

| Item | Description |
| --- | --- |
| EC2 Instance Type | m5d.2xlarge |
| JVM parameters | -Xms16G -Xmx16G -XX:MaxDirectMemorySize=8G -Djdk.nio.maxCachedBufferSize=262144 -XX:+UseG1GC |
| Database | Postgres dbms running on an AWS RDS instance (Postgres RDS instance is of the type db.m5.4xlarge, version 10.20, gp2 type) |

## Browser Requirements

IQ Server supports the latest version of your OS-supported browser at the time of the release date.

| Browser | Version |
| --- | --- |
| Edge | "Release" |
| Firefox | ESR (extended support release)<br>“Stable” |
| Chrome | "Stable" |
| Safari (on OSX) | 5.1.9 corresponding to OS X 10.6<br>6.0.4 corresponding to OS X 10.7 and 10.8<br>7.1 corresponding to OS 10.9 |

### For the best experience:

1. Enable JavaScript for all web browsers.

2. Configure your browser settings to allow notifications from Sonatype sites. You will receive browser notifications when your authenticated session is about to expire and prevent unintended logouts. To learn more about configuring session timeout values, refer to [Configuration REST API.](https://help.sonatype.com/en/configuration-rest-api.html "Configuration REST API")

## REST API Requirements

The REST APIs are versioned. We recommend using the latest version of the IQ Server. This ensures your system will take advantage of the latest features and improvements.