Requirements
Before installing Riversoft® STCP DirectLink, make sure the environment meets the software, operating system, database and network requirements.
Software requirements
| Item | Required | Notes |
|---|---|---|
| Riversoft STCP DirectLink license | Yes | File set in applLicense. |
| STCP platform configuration database | Yes | Reachable from the application server. |
| Log database | No | Required when logDbEnable is true. |
| API service TLS certificate | Yes, in production | The portal and the API must be published over HTTPS; the session cookie requires Secure. |
| Secrets provider (KMS) | No | AWS Secrets Manager, Azure Key Vault, GCP Secret Manager or OCI Vault. See KMS and secrets. |
| OpenTelemetry collector | No | Required when telemetry is enabled. |
Compatibility matrix
The operating systems and databases below apply to both Riversoft STCP Gemini and Riversoft STCP DirectLink.
Supported operating systems
| Operating system | Supported versions |
|---|---|
| Red Hat Enterprise Linux (RHEL) | 8.x, 9.x and 10.x |
| Oracle Linux | 8.x, 9.x and 10.x |
| Rocky Linux | 8.x, 9.x and 10.x |
| AlmaLinux | 8.x, 9.x and 10.x |
| Amazon Linux | Amazon Linux 2023 |
| Other Linux distributions | Subject to compatibility validation |
Tip
Use the latest release of each supported major version and keep the system up to date with the vendor’s security fixes.
Supported databases
| DBMS | Supported version |
|---|---|
| Microsoft SQL Server | 2019 or later |
| Oracle Database | 19c or later |
| MySQL | 8.4 LTS or later |
| MariaDB | 10.11 or later |
Note
With Riversoft STCP Enterprise Server (Windows), the Enterprise Server operating system requirements apply.
TLS connection (MySQL and MariaDB)
With MySQL and MariaDB, communication with the configuration database and the log database can be protected with TLS through options included in the connection string itself (cfgDbName), in the format:
database-name?parameter1=value1¶meter2=value2The options are interpreted by the STCP platform configuration layer and also apply to the log database when it uses the same connection format.
| Parameter | Description | Values |
|---|---|---|
tls | Enables TLS and sets the verification level. | true, skip-verify, verify-ca, verify-identity |
tls-ca | File with the CA certificate. | File path |
tls-capath | Directory with the CA certificates (Riversoft STCP Gemini Server only). | Directory path |
tls-cert | Local certificate for mTLS authentication. | File path |
tls-key | Local key for mTLS authentication. | File path |
tls-cipher | Allowed ciphers, using OpenSSL names, separated by :. | See the list below |
tls-min-version | Minimum TLS version. | TLSv1.2, TLSv1.3 |
tls-max-version | Maximum TLS version. | TLSv1.2, TLSv1.3 |
tls-server-name | Server name used to validate the certificate. | Hostname |
tls value | Verification |
|---|---|
true | CA and server hostname. |
verify-identity | CA and server hostname. |
verify-ca | CA only. |
skip-verify | None. Use only in a lab. |
Ciphers accepted in tls-cipher, separated by : (for example, tls-cipher=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384): AES128-SHA, AES256-SHA, AES128-SHA256, AES128-GCM-SHA256, AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA, ECDHE-RSA-AES256-SHA, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-RSA-CHACHA20-POLY1305 and ECDHE-ECDSA-CHACHA20-POLY1305.
"cfgProvider": "stcpgeminidb",
"cfgInstanceName": "MyInstance",
"cfgDbName": "stcpcfg?tls=verify-identity&tls-ca=/path/ca.pem&tls-server-name=db.example.com"Warning
tls=skip-verify validates neither the CA nor the server identity. In production, use verify-identity with a trusted CA and the hostname matching the certificate.
Network requirements
| Source | Destination | Protocol | Purpose |
|---|---|---|---|
| Users and systems | Riversoft STCP DirectLink API service | HTTPS | Riversoft STCP DirectLink Portal and REST API. The host used must be exactly the one configured for the API. |
| Partners | Riversoft STCP DirectLink SFTP, AS2 and Webhook services | SSH/SFTP, HTTPS | Receiving files, when the services are enabled. |
| Riversoft STCP Gemini API | Riversoft STCP DirectLink, Supervision (directlink) service (default port 33060) | TCP, optional TLS | Supervision through the Riversoft Console Portal. See Supervision services. |
| Application server | Configuration database and log database | MySQL/MariaDB, TLS recommended | Configuration and logs. |
| Application server | SMTP server and SMS/WhatsApp providers | SMTP, HTTPS | Notifications and PIN delivery. |
| Application server | challenges.cloudflare.com | HTTPS | Cloudflare Turnstile validation, when enabled. |
| Application server | Identity providers (SSO) and KMS | HTTPS | SSO and secret resolution, when configured. |
| Application server | Partners and cloud storage | Depends on the connector | Sending files over SFTP, FTP/FTPS, AS2, Webhook, Amazon S3, Azure Blob Storage, Google Cloud Storage and Oracle Cloud Object Storage. |
| Application server | OpenTelemetry collector | HTTP/HTTPS | Telemetry, when enabled. |
The service ports are defined in the instance network services, in the Riversoft Console Portal. Open them on the firewall before starting the installation.
Pre-installation checklist
- Riversoft STCP Gemini Server or Riversoft STCP Enterprise Server instance available.
- Configuration database reachable from the application server, with TLS configured.
- License file available.
- API service TLS certificate available.
- Service ports open and required outbound connections allowed.
- Secrets available in the secrets provider adopted by the environment.