Apache Tomcat Operations

A production-oriented framework for safely discovering, validating, securing, and upgrading Apache Tomcat on Linux.

This project demonstrates operational planning, read-only discovery, security controls, upgrade preparation, rollback design, and automated validation.

This repository uses fictional examples and contains no employer, customer, credential, or production infrastructure data.

Project Objectives

• Discover Tomcat installations without changing the host
• Identify the active Tomcat process, Java runtime, and listening ports
• Establish a reusable operational and security baseline
• Document safe upgrade and rollback procedures
• Separate configuration, documentation, automation, and sample output
• Validate Bash, YAML, and Ansible syntax automatically

Repository Structure

.
├── .github/
│   └── workflows/
│       └── tomcat-validation.yml
├── ansible/
│   └── tomcat-precheck.yml
├── config/
│   └── tomcat-baseline.yml
├── docs/
│   ├── security-controls.md
│   └── upgrade-runbook.md
├── sample-output/
│   └── README.md
├── scripts/
│   └── tomcat-precheck.sh
├── .gitattributes
├── .gitignore
├── LICENSE
└── README.md

Operational Precheck

The Bash script performs read-only discovery of:

• Tomcat installation paths
• Running Tomcat processes
• Java executable and version
• Java listening ports
• Tomcat version details when version.sh is available

Run it on an authorized Linux test system:

bash scripts/tomcat-precheck.sh

Optionally provide a Tomcat installation path:

bash scripts/tomcat-precheck.sh /opt/tomcat

Ansible Precheck

The Ansible playbook performs read-only checks against the tomcat_servers inventory group:

ansible-playbook -i inventory.ini ansible/tomcat-precheck.yml

The playbook does not install software, modify configuration, restart services, or use privilege escalation.

Security Controls

The project documents controls for:

• Dedicated service identities
• Restricted file permissions
• Connector and management-interface exposure
• TLS certificate and keystore protection
• Administrative application restrictions
• Version-disclosure reduction
• Patch and lifecycle management
• Secure logging and monitoring
• Change approval and rollback readiness

See Tomcat security controls.

Upgrade Safety

The upgrade runbook follows a side-by-side installation model:

1. Perform read-only discovery.
2. Confirm compatibility and approvals.
3. Back up required configuration and applications.
4. Verify the downloaded Tomcat release.
5. Install into a new versioned directory.
6. Migrate only approved configuration.
7. Validate before changing the active service path.
8. Perform application and service health checks.
9. Roll back if defined acceptance criteria fail.

See the Apache Tomcat upgrade runbook.

Automated Validation

GitHub Actions validates:

• Bash scripts with ShellCheck
• YAML formatting with yamllint
• Ansible playbook syntax

The workflow performs validation only and does not connect to external infrastructure.

Data Protection

The repository excludes:

• Credentials and environment files
• Private inventories and variables
• TLS private keys and keystores
• Application packages
• Runtime logs and generated reports
• Backups and deployment archives

All published output must be sanitized before it is committed.

Technologies

• Apache Tomcat
• Linux
• Bash
• Ansible
• YAML
• ShellCheck
• GitHub Actions
• Java runtime discovery

Project Status

Active portfolio project focused on safe and repeatable Apache Tomcat operations.

License

This project is licensed under the MIT License.