You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: OPERATING.md
+42-35Lines changed: 42 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,35 +1,37 @@
1
1
# Operating
2
2
3
-
This document contains requirements and tips for operation the adaptor in a production environment.
3
+
This document contains requirements and tips for operating the adaptor in a production environment.
4
4
5
5
# AMQP Message Broker Requirements
6
6
7
7
* The broker must be configured with a limited number of retries and deadletter queues
8
-
* It is the responsibility of the GP supplier to configure adequate monitoring against the deadletter queues that allows ALL undeliverable messages to be investigated fully.
8
+
* It is the responsibility of the GP supplier to configure adequate monitoring against the deadletter queues
9
+
that allows ALL undeliverable messages to be investigated fully
9
10
* The broker must use persistent queues to avoid loss of data
10
-
* The GP System must persist the relevant transaction data before acknowledging the message from the queue to avoid loss of data
11
+
* The GP System must persist the relevant transaction data before acknowledging the message from the queue to avoid
12
+
loss of data
11
13
12
14
**Using AmazonMQ**
13
15
14
16
* A persistent broker (not in-memory) must be used to avoid data loss.
15
17
* A configuration profile that includes settings for [retry and deadlettering](https://activemq.apache.org/message-redelivery-and-dlq-handling.html) must be applied.
16
-
* AmazonMQ uses the scheme `amqp+ssl://` but this **MUST** be changed the to `amqps://` when configuring the adaptor.
18
+
* AmazonMQ uses the scheme `amqp+ssl://` but this **MUST** be changed to `amqps://` when configuring this adaptor.
17
19
18
20
**Using Azure Service Bus**
19
21
20
22
* The ASB must use [MaxDeliveryCount and dead-lettering](https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-dead-letter-queues#exceeding-maxdeliverycount)
21
23
* Azure Service Bus may require some parameters as part of the URL configuration. For example: `NHAIS_AMQP_BROKERS=amqps://<NAME>.servicebus.windows.net/;SharedAccessKeyName=<KEY NAME>;SharedAccessKey=<KEY VALUE>`
22
24
23
-
# Mongodb Database Requirements
25
+
# MongoDB Database Requirements
24
26
25
-
*The NHAIS Adaptor and NHAIS system communications synchronise through a sequence number mechanism
26
-
* The Mongodb database preserves this synchronisation
27
-
* Deleting the mongodb database and/or its collections will break the link with the NHAIS system
28
-
* The database should be used to monitor for any missing transactions. See [REPORTING.md](./REPORTING.md) for details.
27
+
*This GP Links Adaptor and the PCRM/NHAIS system communications are synchronised through a sequence number mechanism
28
+
* The MongoDB database preserves this synchronisation
29
+
* Deleting the MongoDB database and/or its collections will break the link with the PCRM/NHAIS system
30
+
* The database should be used to monitor for any missing transactions. See [REPORTING.md](./REPORTING.md) for details
29
31
30
-
**Amazon Document DB Tips**
32
+
**Amazon DocumentDB Tips**
31
33
32
-
In the "Connectivity & security" tab of the cluster a URI is provided to "Connect to this cluster with an application".
34
+
In the "Connectivity & Security" tab of the cluster a URI is provided to "Connect to this cluster with an application".
33
35
Replace <username>:<insertYourPasswordHere> with the actual mongo username and password to be used by the application.
34
36
The value of `NHAIS_MONGO_URI` should be set to this value. Since the URI string contains credentials we recommend
35
37
managing the entire value as a secured secret.
@@ -38,15 +40,15 @@ The user must have the `readWrite` role or a custom role with specific privilege
38
40
39
41
**Azure Cosmos DB Tips**
40
42
41
-
Follow Azure documentation on Cosmos DB's API for MongoDB
43
+
Follow Azure documentation on Cosmos DB's API for MongoDB.
42
44
43
45
## Database Collections
44
46
45
47
The default database name is `nhais` but this can be changed through an environment variable. Each deployment of the
46
-
adaptor MUST have its own database, but multiple database could be hosted by a single cluster. The collection names
48
+
adaptor MUST have its own database, but multiple databases could be hosted on a single cluster. The collection names
47
49
used by the adaptor cannot be changed.
48
50
49
-
### Outbound Sequence Ids
51
+
### Outbound Sequence IDs
50
52
51
53
Tracks the sequence numbers used to "link" a GP and to HA using EDIFACT messaging.
52
54
See [Linking a GP Practice to an NHAIS system](#linking-a-gp-practice-to-an-nhais-system) section for more information.
@@ -120,7 +122,7 @@ Example:
120
122
121
123
### Inbound State
122
124
123
-
Records the metadata of inbound transactions received by the adaptor.
125
+
Records the metadata of inbound transactions received by this adaptor.
124
126
125
127
Collection Name: `inboundState`
126
128
@@ -134,7 +136,8 @@ Properties:
134
136
*`sndr`: The sender's HA Trading Partner code
135
137
*`recip`: The recipient's GP Trading Partner code
136
138
*`tn`: The EDIFACT transaction number used for this transaction
137
-
*`translationTimestamp`: The timestamp, as reported in the inbound EDIFACT interchange, when the NHAIS system produced the interchange
139
+
*`translationTimestamp`: The timestamp, as reported in the inbound EDIFACT interchange, when the PCRM/NHAIS system
140
+
produced the interchange
138
141
*`transactionType`: Three-letter abbreviation identifying the type of transaction
139
142
*`processedTimestamp`: The timestamp when the adaptor processed the transaction
140
143
*`conversationId`: The conversation id of the request that initiated this transaction
@@ -184,14 +187,15 @@ Example:
184
187
## Time-to-live Indexes
185
188
186
189
The adaptor creates TTL (time to live) indexes on the `outboundState` and `inboundState` collections to automatically
187
-
remove old documents. The variable `NHAIS_MONGO_TTL` described above controls the duration. There are differences between
188
-
how TTL indexes work between MongoDb and Azure Cosmos DB. When using Cosmos the `NHAIS_COSMOS_DB_ENABLED` flag must be true.
190
+
remove old documents. The variable `NHAIS_MONGO_TTL` described above controls the duration. There are differences
191
+
between how TTL indexes work between MongoDb and Azure Cosmos DB. When using Cosmos the `NHAIS_COSMOS_DB_ENABLED` flag
192
+
must be true.
189
193
190
-
**TTL Indexes in MongoDB / AWS Document DB**
194
+
**TTL Indexes in MongoDB / AWS DocumentDB**
191
195
192
196
The property `translationTimestamp` is indexed. For outbound, this is the timestamp when the adaptor translates FHIR
193
-
into EDIFACT and is the timestamp enclosed in the EDIFACT interchange sent to NHAIS. For inbound, this is the
194
-
timestamp enclosed within the EDIFACT interchange received from NHAIS.
197
+
into EDIFACT and is the timestamp enclosed in the EDIFACT interchange sent to PCRM/NHAIS. For inbound, this is the
198
+
timestamp enclosed within the EDIFACT interchange received from PCRM/NHAIS.
195
199
196
200
**TTL Indexes in Azure Cosmos DB**
197
201
@@ -202,19 +206,22 @@ last updated timestamp of the resource". ([Reference](https://docs.microsoft.com
202
206
For outbound, each document is "last updated" when the adaptor processes the inbound RECEP for that transaction. For
203
207
inbound each document is "last updated" after publishing the FHIR message to the inbound GP System message queue.
204
208
205
-
The impact is that documents in Cosmos may live slightly longer than those stored in Mongo.
209
+
The impact is that documents in Cosmos may live slightly longer than those stored in MongoDB.
206
210
207
211
## AWS DocumentDB TLS configuration
208
212
209
-
AWS DocumentDB uses a private CA certificate and therefore requires a custom keystore to manage the CA certificates effectively.
213
+
AWS DocumentDB uses a private CA certificate and therefore requires a custom keystore to manage the CA certificates
214
+
effectively.
210
215
211
216
To use TLS, it has to be enabled in the DocumentDB instance with the Mongo connection string containing the `tls=true`.
212
217
For more information on TLS configuration in MongoDB see [TLS options for Mongo connection string](https://docs.mongodb.com/manual/reference/connection-string/#tls-options).
213
218
214
-
SSH tunneling might require adding the connection string option: `tlsAllowInvalidHostnames=true` (as CA would try to resolve localhost as hostname).
219
+
SSH tunneling might require adding the connection string option: `tlsAllowInvalidHostnames=true` (as CA would try to
220
+
resolve localhost as hostname).
215
221
This option should only be used for local tests as this might create a vulnerability.
216
222
217
-
Use of DocumentDB TLS requires java trust store to be provided manually. Instructions on how to create trust store can be found here:
223
+
Use of DocumentDB TLS requires java trust store to be provided manually. Instructions on how to create trust store can
224
+
be found here:
218
225
[Connect to Document DB programmatically](https://docs.aws.amazon.com/documentdb/latest/developerguide/connect_programmatically.html#connect_programmatically-tls_enabled)
219
226
220
227
To configure custom trust store with AWS CA certificates set the `NHAIS_SSL_TRUST_STORE_URL`
@@ -225,23 +232,23 @@ Additionally, set the `NHAIS_SSL_TRUST_STORE_PASSWORD` to trust store password
225
232
226
233
# MESH Requirements
227
234
228
-
**Note**: The "Development" section of the README refers to a fake-mesh component. fake-mesh is **not** part of the
229
-
adaptor solution and should only be used to assist local development.
235
+
**Note**: The "Development" section of the README refers to a fake-mesh component. fake-mesh is **not** part of this
236
+
adaptor API and should only be used to assist local development.
230
237
231
-
NHSD manage access to MESH, allocate mailboxes, and provide connection details / credentials.
238
+
[NHS England manage access to MESH](mailto:[email protected]), allocate mailboxes, and provide connection
0 commit comments