톰캣 11의 설정 파일에 대한 설명들

톰캣 11은 구조상으로 여러개의 설정 파일에 설정을 지정하게 되어있습니다. 톰캣이 설치된 디렉토리를 $CATALINA_BASE로 기술하면, $CATALINA_BASE/conf/server.xml 과 같은 경로에 설정 파일이 저장됩니다. 대표적인 설정 파일의 경로는요.

$CATALINA_BASE/conf/server.xml
$CATALINA_BASE/webapps/프로젝트-디렉토리/WEB-INF/web.xml
$CATALINA_BASE/webapps/프로젝트-디렉토리/META-INF/context.xml

등이 있습니다.

각각의 설정 파일은 XML로 정의된 파일이구요. DTD가 정의되어 있습니다. 각각의 설정 파일은 올 수 있는 엘리먼트가 정해져 있습니다.

$CATALINA_BASE/conf/context.xml 의 기본값을 보면요.


<Context>
<!--  Default set of monitored resources. If one of these changes, the     -->
<!--  web application will be reloaded.                                    -->
<WatchedResource>WEB-INF/web.xml</WatchedResource>
<WatchedResource>WEB-INF/tomcat-web.xml</WatchedResource>
<WatchedResource>${catalina.base}/conf/web.xml</WatchedResource>
<!--  Uncomment this to enable session persistence across Tomcat restarts  -->
<!-- 
    <Manager pathname="SESSIONS.ser" />
-->
</Context>

<WatchedResource>WEB-INF/tomcat-web.xml</WatchedResource>

<WatchedResource>${catalina.base}/conf/web.xml</WatchedResource>

<!--

-->

</Context>

처럼 정의되어 있습니다. 이 경우 엘리먼트는 각각의 태그인 <Context>, <WatchedResource>, <Manager>이구요. 각각의 태그 꺽쇠 안에 있는 문자열은 속성과 속성값입니다. <Manager> 엘리먼트는 속성으로 pathname을 가지고 있고 SESSIONS.ser를 속성값으로 정했습니다. 올 수 있는 속성과 속성값, 엘리먼트의 종류는 설정 파일마다 같을 수도 있고 다를 수도 있습니다. 추가로, <WatchedResource>와 </WatchedResource> 사이에 들어간 문자열은 컨텐츠라고 하네요.

각각의 설정 파일은 대충 이름을 보면 톰캣의 어떤 컴포넌트에 해당하는지 알 수 있는 경우가 있습니다. 톰캣의 컴포넌트 구조는 Server→Service→Engine→Host→Context로 이어지는데요. server.xml 파일은 Server 레벨의 설정을 하고, Context는 context.xml을 설정하고, 등등등으로 이어지네요. 여기에 추가로 Connector, Valve, 그리고 각각의 하위 엘리먼트가 옵니다.


<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<!-- Note:  A "Server" is not itself a "Container", so you may not
     define subcomponents such as "Valves" at this level.
     Documentation at /docs/config/server.html
 -->
<Server port="8005" shutdown="SHUTDOWN">
  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
  <!-- Security listener. Documentation at /docs/config/listeners.html
  <Listener className="org.apache.catalina.security.SecurityListener" />
  -->
  <!-- OpenSSL support using Tomcat Native -->
  <Listener className="org.apache.catalina.core.AprLifecycleListener" />
  <!-- OpenSSL support using FFM API from Java 22 -->
  <!-- <Listener className="org.apache.catalina.core.OpenSSLLifecycleListener" /> -->
  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />

  <!-- Global JNDI resources
       Documentation at /docs/jndi-resources-howto.html
  -->
  <GlobalNamingResources>
    <!-- Editable user database that can also be used by
         UserDatabaseRealm to authenticate users
    -->
    <Resource name="UserDatabase" auth="Container"
              type="org.apache.catalina.UserDatabase"
              description="User database that can be updated and saved"
              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
              pathname="conf/tomcat-users.xml" />
  </GlobalNamingResources>

  <!-- A "Service" is a collection of one or more "Connectors" that share
       a single "Container" Note:  A "Service" is not itself a "Container",
       so you may not define subcomponents such as "Valves" at this level.
       Documentation at /docs/config/service.html
   -->
  <Service name="Catalina">

    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
    <!--
    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
        maxThreads="150" minSpareThreads="4"/>
    -->


    <!-- A "Connector" represents an endpoint by which requests are received
         and responses are returned. Documentation at :
         HTTP Connector: /docs/config/http.html
         AJP  Connector: /docs/config/ajp.html
         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
    -->
    <Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />
    <!-- A "Connector" using the shared thread pool-->
    <!--
    <Connector executor="tomcatThreadPool"
               port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />
    -->
    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
         This connector uses the NIO implementation. The default
         SSLImplementation will depend on the presence of the APR/native
         library and the useOpenSSL attribute of the AprLifecycleListener.
         Either JSSE or OpenSSL style configuration may be used regardless of
         the SSLImplementation selected. JSSE style configuration is used below.
    -->
    <!--
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true">
        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
        <SSLHostConfig>
            <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
                         certificateKeystorePassword="changeit" type="RSA" />
        </SSLHostConfig>
    </Connector>
    -->

    <!-- Define an AJP 1.3 Connector on port 8009 -->
    <!--
    <Connector protocol="AJP/1.3"
               address="::1"
               port="8009"
               redirectPort="8443" />
    -->

    <!-- An Engine represents the entry point (within Catalina) that processes
         every request.  The Engine implementation for Tomcat stand alone
         analyzes the HTTP headers included with the request, and passes them
         on to the appropriate Host (virtual host).
         Documentation at /docs/config/engine.html -->

    <!-- You should set jvmRoute to support load-balancing via AJP ie :
    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
    -->
    <Engine name="Catalina" defaultHost="localhost">

      <!--For clustering, please take a look at documentation at:
          /docs/cluster-howto.html  (simple how to)
          /docs/config/cluster.html (reference documentation) -->
      <!--
      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
      -->

      <!-- Use the LockOutRealm to prevent attempts to guess user passwords
           via a brute-force attack -->
      <Realm className="org.apache.catalina.realm.LockOutRealm">
        <!-- This Realm uses the UserDatabase configured in the global JNDI
             resources under the key "UserDatabase".  Any edits
             that are performed against this UserDatabase are immediately
             available for use by the Realm.  -->
        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
               resourceName="UserDatabase"/>
      </Realm>

      <Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="true">

        <!-- SingleSignOn valve, share authentication between web applications
             Documentation at: /docs/config/valve.html -->
        <!--
        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
        -->

        <!-- Access log processes all example.
             Documentation at: /docs/config/valve.html
             Note: The pattern used is equivalent to using pattern="common" -->
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
               prefix="localhost_access_log" suffix=".txt"
               pattern="%h %l %u %t &quot;%r&quot; %s %b" />

      </Host>
    </Engine>
  </Service>
</Server>

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

<?xml version="1.0" encoding="UTF-8"?>

<!--

Licensed to the Apache Software Foundation (ASF) under one or more

contributor license agreements. See the NOTICE file distributed with

this work for additional information regarding copyright ownership.

The ASF licenses this file to You under the Apache License, Version 2.0

(the "License"); you may not use this file except in compliance with

the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software

distributed under the License is distributed on an "AS IS" BASIS,

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

See the License for the specific language governing permissions and

limitations under the License.

-->

<!-- Note: A "Server" is not itself a "Container", so you may not

define subcomponents such as "Valves" at this level.

Documentation at /docs/config/server.html

-->

<!-- Security listener. Documentation at /docs/config/listeners.html

-->

<!-- Global JNDI resources

Documentation at /docs/jndi-resources-howto.html

-->

<!-- Editable user database that can also be used by

UserDatabaseRealm to authenticate users

-->

<Resource name="UserDatabase" auth="Container"

type="org.apache.catalina.UserDatabase"

description="User database that can be updated and saved"

factory="org.apache.catalina.users.MemoryUserDatabaseFactory"

pathname="conf/tomcat-users.xml" />

</GlobalNamingResources>

<!-- A "Service" is a collection of one or more "Connectors" that share

a single "Container" Note: A "Service" is not itself a "Container",

so you may not define subcomponents such as "Valves" at this level.

Documentation at /docs/config/service.html

-->

<!--

<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"

maxThreads="150" minSpareThreads="4"/>

-->

<!-- A "Connector" represents an endpoint by which requests are received

and responses are returned. Documentation at :

HTTP Connector: /docs/config/http.html

AJP Connector: /docs/config/ajp.html

Define a non-SSL/TLS HTTP/1.1 Connector on port 8080

-->

<Connector port="8080" protocol="HTTP/1.1"

connectionTimeout="20000"

redirectPort="8443" />

<!--

<Connector executor="tomcatThreadPool"

port="8080" protocol="HTTP/1.1"

connectionTimeout="20000"

redirectPort="8443" />

-->

<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2

This connector uses the NIO implementation. The default

SSLImplementation will depend on the presence of the APR/native

library and the useOpenSSL attribute of the AprLifecycleListener.

Either JSSE or OpenSSL style configuration may be used regardless of

the SSLImplementation selected. JSSE style configuration is used below.

-->

<!--

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"

maxThreads="150" SSLEnabled="true">

<Certificate certificateKeystoreFile="conf/localhost-rsa.jks"

certificateKeystorePassword="changeit" type="RSA" />

</SSLHostConfig>

</Connector>

-->

<!--

<Connector protocol="AJP/1.3"

address="::1"

port="8009"

redirectPort="8443" />

-->

<!-- An Engine represents the entry point (within Catalina) that processes

every request. The Engine implementation for Tomcat stand alone

analyzes the HTTP headers included with the request, and passes them

on to the appropriate Host (virtual host).

Documentation at /docs/config/engine.html -->

<!-- You should set jvmRoute to support load-balancing via AJP ie :

-->

<!--For clustering, please take a look at documentation at:

/docs/cluster-howto.html (simple how to)

/docs/config/cluster.html (reference documentation) -->

<!--

-->

<!-- Use the LockOutRealm to prevent attempts to guess user passwords

via a brute-force attack -->

<!-- This Realm uses the UserDatabase configured in the global JNDI

resources under the key "UserDatabase". Any edits

that are performed against this UserDatabase are immediately

available for use by the Realm. -->

<Realm className="org.apache.catalina.realm.UserDatabaseRealm"

resourceName="UserDatabase"/>

</Realm>

<Host name="localhost" appBase="webapps"

unpackWARs="true" autoDeploy="true">

<!-- SingleSignOn valve, share authentication between web applications

Documentation at: /docs/config/valve.html -->

<!--

-->

<!-- Access log processes all example.

Documentation at: /docs/config/valve.html

Note: The pattern used is equivalent to using pattern="common" -->

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"

prefix="localhost_access_log" suffix=".txt"

pattern="%h %l %u %t "%r" %s %b" />

</Host>

</Engine>

</Service>

</Server>

를 보면 엘리먼트 태그들이 Server→Service→Engine→Host 순으로 설정된 것을 보실 수 있으실 것입니다. 그리고 <Realm>이나 <Listener>와 같은 중첩된 엘리먼트들이 오죠. web.xml의 경우 제한적입니다. 이 경우 server.xml의 경우에는 그보다 더 넓은 범위를 커버하게 설계되서입니다.

특기할만한 것은 각각의 엘리먼트의 속성과 속성값을 보면 어떤 기능인지 이해가 된다는 것입니다. server.xml의 경우 서버 전체에 적용되는 설정이 되구요. <Server> 엘리먼트의 속성으로 port값과 shutdown 속성이 정의되어 있습니다. 그리고 <Connector>에 port 값과 protocol 등이 명시되어 있죠. 서버 작동에 필수적인 설정들이구요. 여기에 사용자가 필요한 엘리먼트를 더 추가하거나, 속성을 더 상세하게 지정하면 튜닝이 되어 바라는대로 작동하게 할 수 있습니다.

https://tomcat.apache.org/tomcat-11.0-doc/config/index.html

위 링크로 가셔서 좌측 메뉴 항목을 클릭해보면 해당되는 컴포넌트에 대한 설정에 도움되는 설명을 읽을 수 있습니다. 각각의 메뉴 항목은 설정 파일에 오는 엘리먼트의 이름과 같은 경우도 있으니, 설정파일에서 나온 엘리먼트 태그를 보고 의문이 있을때 해당 항목을 이해하기 쉬울 것입니다.

어떤 설정은 엘리먼트가 여러개가 한 설정파일에 기술될 수 있고 개별적으로 독립된 설정 단위로 간주됩니다. 여러 파일에 중복되어 독립된 설정이 되면 우선순위 규칙에 따라 덮어씌워지는 결과가 나네요.

그리고 한 설정 파일에 올 수 있는 엘리먼트들은 한 엘리먼트 내부에 중첩이 가능한 엘리먼트가 또 정해져 있습니다. 이 경우 문서를 참조해서 살펴봐야 하네요.

세부적인 엘리먼트의 기능과 속성값, 작동 효과는 생략합니다.

<GlobalNamingResources>와 같은 엘리먼트의 경우 Jakarta EE 서버를 에뮬레이션하는 작동을 하고, JNDI 리소스에 쿼리를 넣어 서비스를 하는데 쓰이는 등의 이해가 되면 됩니다. 타 엘리먼트도 고유의 기능이 있고, 톰캣 자체의 개념도 알아두어야 하고, SSL 등의 기능에 대해 알면 좋습니다. (HTTP/2 등의 설정이 연관)

우선 이렇게 정리해둡니다. 오리지널하게 써졌네요 ^^

답글 남기기 응답 취소