DependencyTrack / DependencyTrack/dependency-track

Offer a mechanism to bootstrap / provision a new Dependency-Track instance

Open
#6,193 2 comments 3 reactions 0 assignees View on GitHub
enhancement help wanted p2 size/L
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently, the majority of settings in Dependency-Track is managed via `ConfigProperty` records in the database. Available options and their defaults are listed in [`ConfigPropertyConstants`](https://github.com/DependencyTrack/hyades-apiserver/blob/main/src/main/java/org/dependencytrack/model/ConfigPropertyConstants.java).

The database is populated with default values upon startup, via `DefaultObjectGenerator`:

https://github.com/DependencyTrack/hyades-apiserver/blob/794e9eaa2991f961223653b293c46ce64bc7e0ce/src/main/java/org/dependencytrack/persistence/DefaultObjectGenerator.java#L225-L235

Properties can be updated at runtime via the [`POST /api/v1/configProperty`](https://github.com/DependencyTrack/hyades-apiserver/blob/794e9eaa2991f961223653b293c46ce64bc7e0ce/src/main/java/org/dependencytrack/resources/v1/ConfigPropertyResource.java#L80-L103) endpoint, or via UI (which calls the same endpoint behind the scenes).

A major downside of this behavior is that configuration of new instances requires manual or heavily automated steps. Even though automation is possible, it is not straightforward, and there is no ready-made solution that users can adopt.

### Proposed Behavior

Offer a mechanism that allows users to bootstrap new instances with custom configuration, for example by passing a YAML file that contains the desired values.

The mechanism could be further extended to include:

* Initial user credentials
* Users, teams, and potentially API keys
* Notification configurations
* Repository configurations
* Policies

For reference, Grafana has a [provisioning feature](https://grafana.com/docs/grafana/latest/administration/provisioning/) with which datasources, dashboard, and alerts can be pre-configured.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/hyades/blob/main/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/hyades/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.