Amazon Linux 2023

Section 1

System Prep

Amazon Linux 2023 is dnf-based and close to RHEL 9. The main differences come from the AWS-tuned defaults: no firewalld by default (relying on EC2 security groups), no subscription-manager, and pre-applied kernel parameters for cloud workloads.

1.1 Update the system

sudo dnf update -y
sudo reboot

1.2 Install required utilities

EPEL is not enabled by default on AL2023 and is not necessary: most utilities the installer needs are in the standard Amazon Linux repos.

sudo dnf install -y unzip wget curl jq net-tools vim bash-completion tar lsof telnet

1.3 Firewall: use Security Groups, not firewalld

AWS recommends managing inbound traffic at the EC2 Security Group level rather than on the host. In your VPC console, open the following inbound ports on the IDP instance’s security group:

Port	Source	Purpose
8080	Your office / VPN CIDR	miniOrange UI
8070	localhost only	Eureka (internal)
8071	localhost only	Configserver (internal)
8072	localhost only	Gatekeeper (internal)
6379	localhost only	Redis (bundled)
5672	localhost only	RabbitMQ AMQP
15672	Your office CIDR	RabbitMQ mgmt UI

If you prefer host-level firewalling on top of Security Groups, you can install firewalld:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-port={8080,8070,8071,8072,6379,5672,15672}/tcp
sudo firewall-cmd --reload

1.4 SELinux

AL2023 ships SELinux but defaults to permissive mode, so no change is needed.

getenforce

Expected output: Permissive.

Section 2

Database

PostgreSQL 16 on Amazon Linux 2023. The PGDG EL-9 repository is binary-compatible.

2.1 Add the PGDG repository

sudo dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm

2.2 Disable the bundled PostgreSQL module

sudo dnf -qy module disable postgresql 2>/dev/null || true

Note. AL2023 does not always have the postgresql dnf module enabled by default. The 2>/dev/null || true makes this step idempotent.

2.3 Install PostgreSQL 16

sudo dnf install -y postgresql16-server postgresql16 postgresql16-contrib

2.4 Initialise and start

sudo /usr/pgsql-16/bin/postgresql-16-setup initdb
sudo systemctl enable --now postgresql-16

2.5 Create the miniOrange database and user

sudo -u postgres psql <<'SQL'
CREATE USER moadmin WITH PASSWORD 'Password123';
CREATE DATABASE miniorangedb OWNER moadmin;
ALTER USER moadmin WITH SUPERUSER;
SQL

2.6 Switch authentication to md5

sudo sed -i -E 's/^(host\s+all\s+all\s+(127\.0\.0\.1\/32|::1\/128)\s+)ident/\1md5/' \
  /var/lib/pgsql/16/data/pg_hba.conf
sudo systemctl restart postgresql-16

2.7 Verify

PGPASSWORD=Password123 psql -h 127.0.0.1 -U moadmin -d miniorangedb -c '\l'

Values for the `/initialize` wizard

Field	Value
Database Type	PostgreSQL
Host	`127.0.0.1`
Port	`5432`
Database name	`miniorangedb`
Username	`moadmin`
Password	`Password123`

⚠ Derived, needs review. These steps are derived from the MySQL vendor's official install docs combined with the miniOrange PostgreSQL and Oracle source flow. They should work, but each command should be sanity-checked on this exact OS before production use.

MySQL 8.4 LTS as the IDP backend. These steps are derived from the MySQL community repo install path combined with the JDBC driver placement convention from the Oracle source flow; review before production use.

2.1 Disable the built-in MySQL module

sudo dnf -qy module disable mysql

2.2 Add the MySQL community repository

sudo dnf install -y https://dev.mysql.com/get/mysql84-community-release-el9-1.noarch.rpm
sudo dnf clean all && sudo dnf makecache

2.3 Install MySQL 8.4

sudo dnf install -y mysql-community-server mysql-community-client
sudo systemctl enable --now mysqld

2.4 Retrieve the temporary root password

MySQL 8.x generates a one-time root password on first start.

sudo grep 'temporary password' /var/log/mysqld.log

2.5 Secure the installation

sudo mysql_secure_installation

Set a permanent root password when prompted. Answer yes to removing anonymous users, disallowing remote root login, removing the test database, and reloading privileges.

2.6 Create the miniOrange database and user

mysql -u root -p <<'SQL'
CREATE DATABASE miniorangedb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'moadmin'@'localhost' IDENTIFIED BY 'Password123';
CREATE USER 'moadmin'@'%'         IDENTIFIED BY 'Password123';
GRANT ALL PRIVILEGES ON miniorangedb.* TO 'moadmin'@'localhost';
GRANT ALL PRIVILEGES ON miniorangedb.* TO 'moadmin'@'%';
FLUSH PRIVILEGES;
SQL

Note. MySQL 8.4 defaults the authentication plugin to caching_sha2_password. The mysql-connector-j 8.x driver supports this; older drivers do not.

2.7 Place the MySQL JDBC driver (derived assumption)

The miniOrange v5.0.0 source documentation requires manual driver placement only for Oracle. By analogy with that flow, MySQL on a non-Postgres deployment likely needs mysql-connector-j placed in the same directory. Confirm with miniOrange support before relying on this step.

sudo mkdir -p /opt/miniorange/drivers
cd /tmp
sudo wget https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-8.4.0-1.el9.noarch.rpm
sudo dnf install -y ./mysql-connector-j-8.4.0-1.el9.noarch.rpm
sudo cp /usr/share/java/mysql-connector-j-8.4.0.jar /opt/miniorange/drivers/
sudo chmod 644 /opt/miniorange/drivers/mysql-connector-j-8.4.0.jar

2.8 Open the MySQL port (only if remote access is needed)

sudo firewall-cmd --permanent --add-port=3306/tcp
sudo firewall-cmd --reload

2.9 Verify

mysql -u moadmin -pPassword123 -h 127.0.0.1 -e 'SHOW DATABASES;'

miniorangedb should appear in the output.

Values for the `/initialize` wizard

Field	Value
Database Type	MySQL
Host	`127.0.0.1`
Port	`3306`
Database name	`miniorangedb`
Username	`moadmin`
Password	`Password123`

◐ Partial support. Not officially supported by Microsoft on AL2023

Microsoft SQL Server 2022 on RHEL 9. Microsoft does not list Amazon Linux 2023 in its supported matrix. The RHEL 9 packages work in practice because AL2023 is dnf-compatible. Treat this combination as partial.

2.1 Verify system requirements

MSSQL on Linux requires at least 2 GB of RAM. Verify before installing.

free -h

2.2 Add the Microsoft repository

sudo curl -o /etc/yum.repos.d/mssql-server.repo \
  https://packages.microsoft.com/config/rhel/9/mssql-server-2022.repo
sudo curl -o /etc/yum.repos.d/msprod.repo \
  https://packages.microsoft.com/config/rhel/9/prod.repo

2.3 Install MSSQL 2022 and tools

sudo dnf install -y mssql-server
sudo ACCEPT_EULA=Y dnf install -y mssql-tools18 unixODBC-devel

2.4 Run the initial setup

Pick the Developer edition for non-production; pick Standard or Enterprise for production. Set a strong sa password (uppercase, lowercase, digit, symbol, 8+ characters).

sudo /opt/mssql/bin/mssql-conf setup
sudo systemctl enable --now mssql-server
sudo systemctl status mssql-server

2.5 Add the tools to PATH

echo 'export PATH="$PATH:/opt/mssql-tools18/bin"' | sudo tee /etc/profile.d/mssql.sh
source /etc/profile.d/mssql.sh

Replace <SA_PASSWORD> with the password you set in step 2.4.

sqlcmd -S localhost -U SA -P '<SA_PASSWORD>' -C -Q "
CREATE DATABASE miniorangedb;
GO
CREATE LOGIN moadmin WITH PASSWORD = 'Password123!';
GO
USE miniorangedb;
CREATE USER moadmin FOR LOGIN moadmin;
ALTER ROLE db_owner ADD MEMBER moadmin;
GO
"

Note. MSSQL enforces password complexity by default. Password123 will be rejected; Password123! works.

2.7 Place the MSSQL JDBC driver (derived assumption)

By analogy with the Oracle source flow, MSSQL likely needs the JDBC driver in /opt/miniorange/drivers/. Confirm with miniOrange support.

sudo mkdir -p /opt/miniorange/drivers
cd /tmp
sudo curl -L -o mssql-jdbc.zip \
  https://download.microsoft.com/download/8/c/d/8cdfd87a-1684-4731-91a9-2ba182c8b0ad/sqljdbc_12.6.4.0_enu.tar.gz
sudo tar -xzf mssql-jdbc.zip
sudo cp sqljdbc_12.6/enu/jars/mssql-jdbc-12.6.4.jre11.jar /opt/miniorange/drivers/
sudo chmod 644 /opt/miniorange/drivers/mssql-jdbc-12.6.4.jre11.jar

2.8 Open the MSSQL port

sudo firewall-cmd --permanent --add-port=1433/tcp
sudo firewall-cmd --reload

2.9 Verify

sqlcmd -S localhost -U moadmin -P 'Password123!' -C -Q "SELECT name FROM sys.databases;"

miniorangedb should appear.

Values for the `/initialize` wizard

Field	Value
Database Type	MSSQL
Host	`127.0.0.1`
Port	`1433`
Database name	`miniorangedb`
Username	`moadmin`
Password	`Password123!`

◐ Partial support. Not officially supported by Oracle on Amazon Linux

Oracle Database 19c on Amazon Linux 2023. Oracle does not list AL2023 in its supported matrix. The OL8 preinstall RPM approach used on RHEL 9 works in practice, but treat this as partial.

2.1 Install the Oracle Database preinstall package

sudo dnf install -y \
  https://yum.oracle.com/repo/OracleLinux/OL8/appstream/x86_64/getPackage/oracle-database-preinstall-19c-1.0-1.el8.x86_64.rpm \
  --nogpgcheck --skip-broken

This creates the oracle user, sets kernel parameters, and configures shell limits. On RHEL 9, this is the closest viable path to the OL8 reference flow.

2.2 Install Oracle 19c

Download oracle-database-ee-19c-1.0-1.x86_64.rpm from Oracle’s site (login required) to the server, then:

cd /opt
sudo dnf localinstall -y oracle-database-ee-19c-1.0-1.x86_64.rpm

2.3 Create the database

sudo /etc/init.d/oracledb_ORCLCDB-19c configure

This creates the structure:

Item	Value
CDB	ORCLCDB
PDB	ORCLPDB1
Listener	1521

2.4 Configure Oracle environment variables

sudo -i -u oracle bash <<'BASH'
cat >> ~/.bash_profile <<'PROFILE'
export ORACLE_BASE=/u01/app/oracle
export ORACLE_HOME=/u01/app/oracle/product/19.0.0/dbhome_1
export ORACLE_SID=ORCLCDB
export PATH=$ORACLE_HOME/bin:$PATH
PROFILE
source ~/.bash_profile
echo $ORACLE_HOME
BASH

2.5 Open the PDB and save state

sudo -i -u oracle bash -c "sqlplus -S / as sysdba" <<'SQL'
STARTUP;
ALTER PLUGGABLE DATABASE ALL OPEN;
ALTER PLUGGABLE DATABASE ALL SAVE STATE;
SHOW PDBS;
SQL

ORCLPDB1 should be in READ WRITE state.

2.6 Start and verify the listener

sudo -i -u oracle bash -c "lsnrctl start || lsnrctl status"
sudo ss -tulnp | grep 1521

2.7 Create the miniOrange Oracle user

sudo -i -u oracle bash -c "sqlplus -S / as sysdba" <<'SQL'
ALTER SESSION SET CONTAINER=ORCLPDB1;
CREATE USER moadmin IDENTIFIED BY Password123;
GRANT CONNECT, RESOURCE TO moadmin;
GRANT DBA TO moadmin;
SQL

Verify connectivity over the service name:

sudo -i -u oracle bash -c "sqlplus moadmin/Password123@//127.0.0.1:1521/ORCLPDB1 <<< 'SELECT 1 FROM dual;'"

2.8 Place the Oracle JDBC driver

This step is required: Oracle’s JDBC driver isn’t bundled in mo-installer because of Oracle’s licensing.

sudo mkdir -p /opt/miniorange/drivers
sudo find /u01/app/oracle -name 'ojdbc8.jar' -print 2>/dev/null | head -1
sudo cp /u01/app/oracle/product/19.0.0/dbhome_1/jdbc/lib/ojdbc8.jar \
        /opt/miniorange/drivers/
sudo chmod 644 /opt/miniorange/drivers/ojdbc8.jar

2.9 Open the Oracle port

sudo firewall-cmd --permanent --add-port=1521/tcp
sudo firewall-cmd --reload

Values for the `/initialize` wizard

Important. Use Service Name, not SID. The IDP schema lives in the PDB (ORCLPDB1), not the CDB (ORCLCDB).

Field	Value
Database Type	Oracle
Host	`127.0.0.1`
Port	`1521`
SID / Service	Service
Service Name	`ORCLPDB1`
Username	`moadmin`
Password	`Password123`

Section 3

Erlang + RabbitMQ

RabbitMQ is used by the IDP for internal messaging between microservices. It requires Erlang. Both are installed directly from the official RabbitMQ RPM releases on GitHub.

3.1 Install Erlang 26

sudo dnf install -y \
  https://github.com/rabbitmq/erlang-rpm/releases/download/v26.2.5.2/erlang-26.2.5.2-1.el8.x86_64.rpm \
  --nogpgcheck

Note. The published Erlang RPM is built for el8, but installs cleanly on RHEL 9 because of compatible runtime dependencies. There is no current el9-tagged build from upstream.

3.2 Install RabbitMQ 3.13.7

sudo dnf install -y \
  https://github.com/rabbitmq/rabbitmq-server/releases/download/v3.13.7/rabbitmq-server-3.13.7-1.el8.noarch.rpm \
  --nogpgcheck

3.3 Enable and start the service

sudo systemctl enable --now rabbitmq-server
sudo systemctl status rabbitmq-server

3.4 Enable the management plugin

sudo rabbitmq-plugins enable rabbitmq_management
sudo systemctl restart rabbitmq-server

3.5 Verify

sudo rabbitmqctl status
sudo ss -tulnp | grep 5672

You should see a listener on :5672 (AMQP) and :15672 (management UI).

Values for the `/initialize` wizard

Field	Value
RabbitMQ Host	`127.0.0.1`
AMQP Port	`5672`
Mgmt UI Port	`15672`
Default Login	`guest` / `guest`

Section 4

mo-installer

The miniOrange installer bundles Java 17 and Redis. You don’t install either manually. The installer auto-detects the OS and deploys the IDP services into /opt/tomcat/.

4.1 Download the installer

cd /opt
sudo wget https://miniorange.s3.us-east-1.amazonaws.com/public/installers/mo-installer-5.0.0.zip
sudo unzip mo-installer-5.0.0.zip -d mo-installer-5.0.0
cd /opt/mo-installer-5.0.0
ls -la

You should see:

.env.sh          Environment configuration (review before sourcing)
mo-installer.sh  Main installer script
moctl/           moctl CLI and bash completion

4.2 Review and source the environment file

less .env.sh
source .env.sh

Note. In v5.0.0, .env.sh does not contain database connection details. The DB connection is configured later through the browser UI at /initialize. Source the file as-is.

4.3 Set execute permissions

sudo chmod +x mo-installer.sh moctl/*.sh

4.4 Run the installer

sudo bash mo-installer.sh

Watch the output for failures. The installer covers:

Java 17 — installed automatically
Redis — installed and configured automatically
moctl — installed to /usr/bin/moctl with tab completion
IDP services — deployed to /opt/tomcat/

At the end of the run, the installer will print:

Next step: moctl service start

4.5 Start the four core services

moctl service start

The core services start in this order:

Service	Port	Purpose
configserver	8071	Configuration
eurekaserver	8070	Service registry
gatekeeper	8072	API gateway
miniorange	8080	Main IDP service

4.6 Check service status

moctl service status

Only the four core services should be active at this point. Secondary services start after initialisation.

Symbol	Meaning
`● running`	Active and registered in Eureka
`△ registering`	Active but not yet registered; wait and recheck
`△ stopped`	Inactive
`✗ failed`	Failed; check `moctl log <service>`

4.7 Open `/initialize` in a browser

https://<SERVER_IP>/initialize

You will see a self-signed certificate warning. Proceed past it.

Enter the values from the Database section above, plus the Redis and RabbitMQ values from Section 3 (Redis: 127.0.0.1:6379, no password by default).

After the wizard completes, the dashboard loads. Navigate to Settings → Base URL and set it to your final domain:

https://<your-domain>

4.8 Restart all services

This step starts the secondary services that depend on the completed schema.

moctl service restart

Wait 1–2 minutes for everything to register, then verify in the next section.

Section 5

Verify & Service Enablement

Confirm everything is running and registered. All commands here come from the source v5.0.0 guide.

5.1 Full service status

moctl service status

Every service should show ● running or ● reachable. If anything shows △ registering, wait 30 seconds and re-run.

5.2 Full diagnostics

moctl diagnose

Expected output includes:

Database connectivity reachable
Redis reachable
RabbitMQ reachable

5.3 Individual service status

systemctl status mo-idp-miniorange.service
systemctl status redis
systemctl status rabbitmq-server

5.4 Check all bound ports

sudo ss -tulnp | egrep '8080|8070|8071|8072|6379|5672'

For your DB:

DB	Port
PostgreSQL	5432
MySQL	3306
MSSQL	1433
Oracle	1521

5.5 Preflight

moctl pre checks Java, the DB, Redis, and RabbitMQ reachability in one go.

moctl pre

Quick `moctl` reference

Command	Purpose
`moctl service start`	Start all services in order
`moctl service stop`	Stop all services in reverse order
`moctl service restart`	Full ordered restart
`moctl service restart miniorange`	Restart one named service
`moctl log <service> -f`	Live tail logs
`moctl log <service> --since 1h`	Logs from the past hour
`moctl system memory`	Per-service RSS memory
`moctl jvm <service>`	Heap, threads, open file descriptors
`moctl diagnose ports`	Check that core ports are bound

Common issues

Issue: △ registering after a minute.

The service started but hasn’t completed its handshake with Eureka. Check the gatekeeper log:

moctl log gatekeeper --since 5min

Issue: PostgreSQL peer authentication failed.

You modified pg_hba.conf but didn’t restart. Run sudo systemctl restart postgresql-16.

Issue: SELinux denials in audit.log.

You skipped section 1.5. Set setenforce 0 and re-check getenforce.

Issue: Tomcat stale PID after a crash.

sudo rm -f /opt/tomcat/latest/temp/*.pid
moctl service restart miniorange

System Prep

1.1 Update the system

1.2 Install required utilities

1.3 Firewall: use Security Groups, not firewalld

1.4 SELinux

Database

2.1 Add the PGDG repository

2.2 Disable the bundled PostgreSQL module

2.3 Install PostgreSQL 16

2.4 Initialise and start

2.5 Create the miniOrange database and user

2.6 Switch authentication to md5

2.7 Verify

Values for the /initialize wizard

2.1 Disable the built-in MySQL module

2.2 Add the MySQL community repository

2.3 Install MySQL 8.4

2.4 Retrieve the temporary root password

2.5 Secure the installation

2.6 Create the miniOrange database and user

2.7 Place the MySQL JDBC driver (derived assumption)

2.8 Open the MySQL port (only if remote access is needed)

2.9 Verify

Values for the /initialize wizard

2.1 Verify system requirements

2.2 Add the Microsoft repository

2.3 Install MSSQL 2022 and tools

2.4 Run the initial setup

2.5 Add the tools to PATH

2.6 Create the miniOrange database and login

2.7 Place the MSSQL JDBC driver (derived assumption)

2.8 Open the MSSQL port

2.9 Verify

Values for the /initialize wizard

2.1 Install the Oracle Database preinstall package

2.2 Install Oracle 19c

2.3 Create the database

2.4 Configure Oracle environment variables

2.5 Open the PDB and save state

2.6 Start and verify the listener

2.7 Create the miniOrange Oracle user

2.8 Place the Oracle JDBC driver

2.9 Open the Oracle port

Values for the /initialize wizard

Erlang + RabbitMQ

3.1 Install Erlang 26

3.2 Install RabbitMQ 3.13.7

3.3 Enable and start the service

3.4 Enable the management plugin

3.5 Verify

Values for the /initialize wizard

mo-installer

4.1 Download the installer

4.2 Review and source the environment file

4.3 Set execute permissions

4.4 Run the installer

4.5 Start the four core services

4.6 Check service status

4.7 Open /initialize in a browser

4.8 Restart all services

Verify & Service Enablement

5.1 Full service status

5.2 Full diagnostics

5.3 Individual service status

5.4 Check all bound ports

5.5 Preflight

Quick moctl reference

Common issues

Values for the `/initialize` wizard

Values for the `/initialize` wizard

Values for the `/initialize` wizard

Values for the `/initialize` wizard

Values for the `/initialize` wizard

4.7 Open `/initialize` in a browser

Quick `moctl` reference