On-Premises Edition Server Preparation Guide

About this guide

This guide is for readers who have looked at section 1 of the On-Premises Edition Setup Guide and are not sure how to obtain the things it asks for.

Audience: readers with no Linux or server-building experience. Follow the steps in order and you will end up ready to start the setup guide.

To see where this server fits in the overall picture — how it relates to user PCs, the group policy file and eCTD Storage, and which network paths are needed — see the diagrams in System Layout & Where Things Live.

Assumption: this guide assumes you are provisioning one new server and installing Ubuntu Server 24.04 LTS on it. Other distributions work too, but this guide deliberately covers only one so there are no decisions to make. If you already have a Linux server, start at “5. Check time synchronisation and disk space”.

Estimated time: about half a day of hands-on work — but the internal requests described below can take several days to come back.

Raise the internal requests first: DNS registration, TLS certificate issuance and firewall changes usually require another team in your organisation and have the longest lead time. Send the templates in Appendix A straight away, then build the server while you wait.

The preparation at a glance

1. Provision the server

The on-premises edition runs on one Linux server that you control. Choose one of the following.

Specification to request:

Dedicate this server to Power Viewer. Sharing it with other systems leads to conflicts over ports 80 / 443 and makes backup and reboot scheduling much harder.

Decide these now (ask your network team):

• The IP address for the server (e.g. 192.168.10.50)
• The subnet mask (e.g. 255.255.255.0, written as /24)
• The default gateway (e.g. 192.168.10.1)
• The DNS server address (e.g. 192.168.10.10)
• Whether an HTTP proxy is required for internet access, and its URL

2. Install Ubuntu Server 24.04 LTS

Skip this section if the server was handed to you with an OS already installed.

2.1 Create the installation media

1. Download the Ubuntu Server 24.04 LTS ISO (about 3 GB) from https://ubuntu.com/download/server
2. Physical server: write the ISO to a USB stick with a tool such as Rufus (8 GB or larger; its contents are erased)
3. Virtual machine: attach the ISO to the VM’s virtual CD/DVD drive

2.2 Working through the installer

Booting from the media starts a blue-and-white text installer. Use the arrow keys to select and Enter to confirm — the mouse does not work.

Note on disk size: with LVM the installer may allocate only part of the disk. If ubuntu-lv on the confirmation screen is noticeably smaller than the physical disk, select that row, choose Edit and set Size to the maximum. If you miss this, §5.2 shows how to expand it later.

When installation finishes, choose Reboot Now and remove the USB stick before pressing Enter.

3. Give the server a static IP address

After the reboot you see a black screen ending in servername login:. Log in with the username and password from §2.2. The password is not echoed to the screen — just type it and press Enter.

Check the current address and the name of the network configuration file:

ip -4 addr
ls /etc/netplan/

In the ip -4 addr output, the entry that is not lo (something like ens160 or eth0) is your network interface name. Note it down.

Edit the file shown by ls /etc/netplan/ (often 50-cloud-init.yaml). Editor basics are in Appendix B.

sudo nano /etc/netplan/50-cloud-init.yaml

Replace the entire contents with the following, substituting the interface name, IP address, gateway and DNS server from §1. Indentation must use spaces and must match exactly.

network:
  version: 2
  ethernets:
    ens160:
      dhcp4: false
      addresses:
        - 192.168.10.50/24
      routes:
        - to: default
          via: 192.168.10.1
      nameservers:
        addresses:
          - 192.168.10.10

Save with Ctrl+O then Enter, exit with Ctrl+X, and apply:

sudo netplan apply

Stop the configuration being overwritten on reboot:

echo 'network: {config: disabled}' | sudo tee /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg

Verify:

ip -4 addr
ping -c3 192.168.10.1
ping -c3 8.8.8.8

Success means the address you configured is shown and the gateway replies. Outbound ping is often blocked by site policy, so a failure there is not necessarily a problem.

Warning: a mistake here cuts off network access to the server. Recover from the server’s console (a directly attached monitor and keyboard, or the console in your hypervisor’s management UI) and correct the same file.

4. Connect from your own PC

Everything from here can be done from your Windows PC rather than at the server.

4.1 Connect over SSH

Open PowerShell from the Start menu and run (using the username and IP from §2 and §3):

ssh username@192.168.10.50

The first time you are asked Are you sure you want to continue connecting (yes/no/[fingerprint])? — type yes and press Enter, then enter the password (nothing is displayed as you type).

When the prompt changes to username@servername:~$ you are connected. All remaining server work happens in this window.

Copying and pasting commands: copy any command from this guide and right-click in the PowerShell window to paste it (Ctrl+V also works). There is no need to retype anything. Paste one command at a time and press Enter.

4.2 Transfer files

Later you need to copy the distribution archive and certificate files to the server. Run this in PowerShell on your own PC (not in the SSH session):

scp C:\Users\you\Downloads\filename username@192.168.10.50:~/

~/ is your home directory on the server. WinSCP is a graphical alternative.

5. Check time synchronisation and disk space

5.1 Time synchronisation

Licence expiry checks and audit-log timestamps depend on the clock being correct.

timedatectl

You want to see both System clock synchronized: yes and NTP service: active. If not, point the server at your internal NTP server (ask your network team for the address):

sudo nano /etc/systemd/timesyncd.conf

Under [Time], remove the # from the #NTP= line and set it:

NTP=ntp.example.com

Save, then apply and re-check:

sudo systemctl restart systemd-timesyncd
timedatectl

Optionally set the timezone:

sudo timedatectl set-timezone Asia/Tokyo

5.2 Disk space

df -h /

Avail must be at least 40 GB. If it is short and the installer did not use the whole disk (see the note in §2.2), claim the remainder:

sudo vgs
sudo lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
sudo resize2fs /dev/ubuntu-vg/ubuntu-lv
df -h /

If VFree in sudo vgs is 0 there is nothing left to claim and the disk itself must be enlarged.

6. Install Docker

The on-premises edition runs on Docker.

If your site requires a proxy, set it first (using the URL from §1):

export http_proxy=http://proxy.example.com:8080
export https_proxy=http://proxy.example.com:8080

Run the official installation script (this takes a few minutes):

curl -fsSL https://get.docker.com | sudo sh

Check the result:

sudo docker --version
sudo docker compose version

You need Docker version 24. or newer and Docker Compose version v2.17 or newer.

Allow your user to run Docker without sudo:

sudo usermod -aG docker $USER

This only takes effect after you log out and back in.

exit

Reconnect as in §4.1 and confirm:

docker run --rm hello-world

Hello from Docker! means you are done.

If the server has no internet access the script above will not work. Offline Docker installation is a substantially different procedure — please consult your IT department or Power Office support.

7. Choose a hostname (FQDN) and register it in DNS

Users must reach the server by name (pv-albumdb.example.com) rather than by IP address, and the TLS certificate is issued against that name.

1. Choose a name, e.g. pv-albumdb.<your domain>
2. Ask your DNS administrator to create an A record pointing that name at the server’s IP address (use the template in A-1)
3. Once created, verify from PowerShell on your own PC:

nslookup pv-albumdb.example.com

Success means Address: shows the server’s IP.

If DNS registration is impossible, entries in each user’s hosts file are a workaround — but they must be maintained on every user PC and are easily forgotten when a PC is replaced. This is not suitable for long-term operation; DNS registration is strongly recommended.

8. Open the ports

Traffic must reach the server on port 80 (HTTP) and port 443 (HTTPS).

8.1 Network equipment

If a firewall or security appliance sits between your users and the server, request the change using the template in A-2.

Never expose the database port (3306). The product connects to its database entirely inside the server. Exposing it externally puts your data at risk.

8.2 The server’s own firewall

Ubuntu ships with its own firewall (ufw) disabled. Check:

sudo ufw status

If it reports Status: inactive, leave it alone — the ports are already reachable.

If it reports Status: active, open what is needed. Always allow SSH as well, or you will lock yourself out.

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw status

8.3 Confirm the ports are free

Before setup, nothing else may be listening on 80 or 443:

ss -lntp | grep -E ':(80|443)'

No output means you are fine. If something is listed, stop that software or use a different server.

9. Obtain a TLS server certificate

The admin console handles login credentials, so HTTPS is mandatory. That requires two files: a server certificate and a private key.

There are three ways to get them.

For ① and ② go to §9.1; for ③ go to §9.2.

9.1 Request a certificate

First create a CSR (certificate signing request) on the server:

mkdir -p ~/certs && cd ~/certs
openssl req -new -newkey rsa:2048 -nodes \
  -keyout tls.key -out tls.csr \
  -subj "/C=JP/O=Example Corporation/CN=pv-albumdb.example.com" \
  -addext "subjectAltName=DNS:pv-albumdb.example.com"

Replace the organisation name and use the FQDN you chose in §7. This produces tls.key (the private key) and tls.csr (the request).

Never send tls.key to anyone. Only tls.csr is submitted. Display it with:

cat tls.csr

Copy everything from -----BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST----- into the template in A-3.

When the certificate arrives (as .crt, .pem or .cer), place it on the server as ~/certs/tls.crt (transfer it with scp, §4.2).

• If an intermediate certificate came as a separate file, concatenate them — server certificate first:

  cat server.crt intermediate.crt > tls.crt

• If you received a .pfx / .p12 file, convert it (you will be prompted for its password):

  openssl pkcs12 -in received.pfx -clcerts -nokeys -out tls.crt
  openssl pkcs12 -in received.pfx -nocerts -nodes -out tls.key

Continue to §9.3.

9.2 Create a self-signed certificate (interim)

If no proper certificate is available you can create one yourself and start operating — but browsers will show a warning (see below).

mkdir -p ~/certs && cd ~/certs
openssl req -x509 -newkey rsa:2048 -nodes -days 825 \
  -keyout tls.key -out tls.crt \
  -subj "/C=JP/O=Example Corporation/CN=pv-albumdb.example.com" \
  -addext "subjectAltName=DNS:pv-albumdb.example.com"

Substitute your FQDN in both places.

What users will see: a warning page such as “Your connection is not private”. They can continue via “Advanced” → “Proceed”, but it appears every time.

The traffic is still encrypted, so this is workable on a closed internal network — but training users to click through certificate warnings is a genuine operational risk. Remove it by either:

• installing tls.crt into the “Trusted Root Certification Authorities” store on user PCs (distributable via Active Directory group policy), or
• replacing it with a proper certificate later (§9.4)

9.3 Verify the certificate

cd ~/certs
openssl x509 -in tls.crt -noout -subject -dates

Check that subject= contains the FQDN from §7 and that notAfter= is in the future.

Then confirm the certificate and key are a matching pair — the two lines must be identical:

openssl x509 -in tls.crt -noout -modulus | openssl md5
openssl rsa  -in tls.key -noout -modulus | openssl md5

Restrict access to the private key:

chmod 600 tls.key

You now have ~/certs/tls.crt and ~/certs/tls.key, which section 5 of the setup guide uses.

9.4 Replacing the certificate later

Once a proper certificate arrives, swap it in on the installed server:

cd /opt/rad-onprem
sudo cp new-certificate certs/tls.crt
sudo cp new-private-key certs/tls.key
sudo chmod 600 certs/tls.key
docker compose --env-file onprem.env restart web

Data and accounts are unaffected.

10. Receive the distribution archive and licences

1. Sign in to the Power Office member portal, open Products → Power Viewer RemoteAlbumDatabase (on-premises edition)
2. Download the distribution archive (zip) and the SHA-256 file
3. Obtain your server licence and Power Viewer licence key as described in the release notification email

Verify the download on your own PC (PowerShell):

certutil -hashfile power-viewer-remotealbumdb-onprem-1.1.1.zip SHA256

The value must match the SHA-256 in the Power Office release notification exactly. If it does not, do not use the file — contact us.

Transfer it to the server (from your own PC):

scp C:\Users\you\Downloads\power-viewer-remotealbumdb-onprem-1.1.1.zip username@192.168.10.50:~/

Then, in the SSH session, create the installation directory:

sudo mkdir -p /opt/rad-onprem
sudo chown $USER:$USER /opt/rad-onprem
sudo apt update && sudo apt install -y unzip
mv ~/power-viewer-remotealbumdb-onprem-1.1.1.zip /opt/rad-onprem/
cp ~/certs/tls.crt ~/certs/tls.key /opt/rad-onprem/ 2>/dev/null || true
cd /opt/rad-onprem

11. Confirm you are ready

Run these on the server (SSH session) — if every result matches, preparation is complete.

Now continue with the On-Premises Edition Setup Guide from section 3, “Extract and verify the distribution” — sections 1 and 2 are covered by this guide.

Appendix A: Templates for internal requests

Copy these and replace the <> placeholders.

A-1. DNS registration request

Subject: [Request] Internal DNS A record for the Power Viewer server

Hello,

Please create a DNS record for a new server we are commissioning.

  Hostname (FQDN): pv-albumdb.<internal domain>
  Record type    : A
  IP address     : <server IP address>
  Purpose        : Database server for Power Viewer, our regulatory
                   submission document management system
  Users          : <n> people in <department>, internal access only

Please let me know if you need anything further.

A-2. Firewall change request

Subject: [Request] Firewall rule for the Power Viewer server

Hello,

Please permit the following traffic to a new server.

  Destination : <server IP address> (pv-albumdb.<internal domain>)
  Source      : <user network segment / VPN pool>
  Ports       : TCP 80 (redirect to HTTPS), TCP 443 (application traffic)
  Direction   : source to destination, one way
  Purpose     : Browser admin console and client API traffic for
                Power Viewer, our regulatory submission document
                management system

Note: the database port (TCP 3306) does NOT need to be opened. It is
used only inside the server and must remain unreachable externally.

Thank you.

A-3. Server certificate request

Subject: [Request] TLS server certificate for the Power Viewer server

Hello,

Please issue a TLS server certificate for the server below.

  Common Name (CN): pv-albumdb.<internal domain>
  SAN             : DNS:pv-albumdb.<internal domain>
  Key             : RSA 2048 bit
  Validity wanted : <1 year>
  Purpose         : Server authentication for an internal web system (HTTPS)

The CSR is below.

-----BEGIN CERTIFICATE REQUEST-----
<paste the CSR here>
-----END CERTIFICATE REQUEST-----

Please return the certificate in PEM (text) format, together with any
intermediate certificates.

Thank you.

Appendix B: Linux basics

Only what this guide needs.

Reading the screen — text like username@servername:~$ is the “prompt”. When you see it, the server is waiting for a command. ~ is your current location (your home directory).

Pasting commands — copy a command from this guide and right-click in the PowerShell window to paste it. Multi-line commands can be pasted in one go.

sudo — runs a command with administrator rights. The first use asks for your password. Nothing appears as you type it — not even asterisks — but it is being entered. Type it and press Enter.

Commands used here

The text editor (nano) — open a file with sudo nano filename.

• Move with the arrow keys and type directly (the mouse does not work)
• Save: Ctrl+O then Enter
• Exit: Ctrl+X
• To abandon your changes: Ctrl+X then answer N

Common errors

Appendix C: Troubleshooting

If the admin console will not open in a browser, work down this list — the first failure identifies the cause.

ping is often blocked by site policy. If step 2 fails but step 3 succeeds, there is no problem.

If you cannot resolve it, contact Power Office support with the log output from step 5.