Skip to content


Subversion checkout URL

You can clone with
Download ZIP
Development repository for tomcat Chef cookbook
Ruby HTML Shell
Failed to load latest commit information.
attributes Merge pull request #171 from jolcese/envvars
libraries Update copyright
providers Merge pull request #144 from sunggun-yu/master
recipes Use multipackage support in Chef 12.1
resources Use Ruby 1.9+ style hash format
spec Add basic no error converge rspec
tasks Add rakefile and maintainers
templates/default Adding attribute for user-defined environment variables
test/integration Added serverspec integration tests for users recipe
.foodcritic Add .foodcritic file
.gitignore Update ignore files Add fix for JAVA_HOME to
.kitchen.yml Added serverspec integration tests for users recipe
.rubocop.yml Use standard rubocop file
.travis.yml Dont install kitchen cloud gems in travis
Berksfile updated codebase to successfully run rake with all style/lint/integra… updating CHANGELOG and bumping metadata Link to the new contributing doc
Gemfile Update development dependencies
Guardfile Use Ruby 1.9+ style hash format
LICENSE Add copyright to the license file Add rakefile and maintainers
MAINTAINERS.toml Add rakefile and maintainers Merge pull request #171 from jolcese/envvars
Rakefile Update FC ignores Update the testing docs
chefignore Add more files to ignore
metadata.rb Improve description and use array for supports

tomcat Cookbook

Build Status Cookbook Version

Installs and configures Tomcat, Java servlet engine and webserver version 6 and 7 (8 not yet supported).



  • Debian / Ubuntu derivatives
  • RHEL derivatives
  • Fedora


  • Chef 12.1+


  • java
  • openssl
  • yum-epel


  • node["tomcat"]["base_version"] - The version of tomcat to install, default 6.
  • node["tomcat"]["port"] - The network port used by Tomcat's HTTP connector, default 8080.
  • node["tomcat"]["proxy_port"] - if set, the network port used by Tomcat's Proxy HTTP connector, default nil.
  • node["tomcat"]["ssl_port"] - The network port used by Tomcat's SSL HTTP connector, default 8443.
  • node["tomcat"]["ssl_proxy_port"] - if set, the network port used by Tomcat's Proxy SSL HTTP connector, default nil.
  • node["tomcat"]["ajp_port"] - The network port used by Tomcat's AJP connector, default 8009.
  • node["tomcat"]["shutdown_port"] - The network port used by Tomcat to listen for shutdown requests, default 8005.
  • node["tomcat"]["catalina_options"] - Extra options to pass to the JVM only during start and run commands, default "".
  • node["tomcat"]["java_options"] - Extra options to pass to the JVM, default -Xmx128M -Djava.awt.headless=true.
  • node["tomcat"]["use_security_manager"] - Run Tomcat under the Java Security Manager, default false.
  • node["tomcat"]["loglevel"] - Level for default Tomcat's logs, default INFO.
  • node["tomcat"]["deploy_manager_apps"] - whether to deploy manager apps, default true.
  • node["tomcat"]["authbind"] - whether to bind tomcat on lower port numbers, default no.
  • node["tomcat"]["max_threads"] - maximum number of threads in the connector pool.
  • node["tomcat"]["tomcat_auth"] -
  • node["tomcat"]["instances"] - A dictionary defining additional tomcat instances to run.
  • node["tomcat"]["run_base_instance"] - Whether or not to run the "base" tomcat instance, default true.
  • node["tomcat"]["environment"] - Environment variables to be setup when starting Tomcat
  • node["tomcat"]["user"] -
  • node["tomcat"]["group"] -
  • node["tomcat"]["home"] -
  • node["tomcat"]["base"] -
  • node["tomcat"]["config_dir"] -
  • node["tomcat"]["log_dir"] -
  • node["tomcat"]["tmp_dir"] -
  • node["tomcat"]["work_dir"] -
  • node["tomcat"]["context_dir"] -
  • node["tomcat"]["webapp_dir"] -
  • node["tomcat"]["lib_dir"] -
  • node["tomcat"]["endorsed_dir"] -

Attributes for SSL

  • node["tomcat"]["ssl_cert_file"] - SSL certificate file
  • node["tomcat"]["ssl_chain_files"] - SSL CAcert chain files used for generating the SSL certificates
  • node["tomcat"]["ssl_max_threads"] - maximum number of threads in the ssl connector pool, default 150.
  • node["tomcat"]["ssl_enabled_protocols"] - SSL enabled protocols. Please use 'TLSv1.2,TLSv1.1,TLSv1' or a smaller subset to mitigate poodle attack issues via SSL.
  • node["tomcat"]["keystore_file"] - Location of the file where the SSL keystore is located
  • node["tomcat"]["keystore_password"] - Generated by the secure_password method from the openssl cookbook; if you are using Chef Solo, set this attribute on the node
  • node["tomcat"]["truststore_password"] - Generated by the secure_password method from the openssl cookbook; if you are using Chef Solo, set this attribute on the node
  • node["tomcat"]["truststore_file"] - location of the file where the SSL truststore is located
  • node["tomcat"]["certificate_dn"] - DN for the certificate
  • node["tomcat"]["keytool"] - path to keytool, used for generating the certificate, location varies by platform


Due to the multitude of Java implementations you might want to use, this cookbook does not attempt to address the installation of a JRE/JDK. Please make sure that Java has been configured on the machine prior to the application any resources or recipes shipped in this cookbook.


Simply include the recipe where you want Tomcat installed.

Due to the ways that some system init scripts call the configuration, you may wish to set the java options to include JAVA_OPTS. As an example for a java app server role:

name "java-app-server"
  'tomcat' => {
    'java_options' => "${JAVA_OPTS} -Xmx128M -Djava.awt.headless=true"

Running Multiple Instances

To run multiple instances of Tomcat, populate the instances attribute, which is a dictionary of instance name => array of attributes. Most of the same attributes that can be used globally for the tomcat cookbook can also be set per-instance - see resources/instance.rb for details.

If they are not set for a particular instance, the base, home, config_dir, log_dir, work_dir, context_dir, and webapp_dir attributes are created by modifying the global values to use the instance name. For example, under Tomcat 7, with home /usr/share/tomcat7, home for instance "instance1" would be set to /usr/share/tomcat7-instance1. The port attributes - port, proxy_port, ssl_port, ssl_proxy_port, ajp_port, and shutdown_port - are not inherited and must be set per-instance. Other attributes that are not set are inherited unmodified from the global attributes. Each instance must define shutdown_port, and at least one of port, ssl_port or ajp_port.

If you only want to run specific instances and not the "base" tomcat instances, you can set run_base_instance to false.

Here is an example partial role:

"override_attributes": {
  "tomcat": {
    "run_base_instance": false,
    "instances": {
      "instance1": {
        "port": 8081,
        "shutdown_port": 8006
      "lookup": {
        "port": 8082,
        "shutdown_port": 8007,
        "java_options": "-Xms1G -Xmx2G"

Managing Tomcat Users

The recipe tomcat::users included in this cookbook is used for managing Tomcat users. The recipe adds users and roles to the tomcat-users.xml conf file.

Users are defined by creating a tomcat_users data bag and placing Encrypted Data Bag Items in that data bag. Each encrypted data bag item requires an 'id', 'password', and a 'roles' field. The data bag key is retrieved from the default location /etc/chef/encrypted_data_bag_secret.

  "id": "reset",
  "password": "supersecret",
  "roles": [

If you are a Chef Solo user the data bag items are not required to be encrypted and should not be.

Defining Environment Variables

If your Tomcat application requires the usage of environment variables, you can define those into the environment attribute.

This is a sample on how to set-up some environment variables:

"override_attributes": {
  "tomcat": {
    "environment": [
        "VariableName": "LOCAL_HOME",
        "VariableValue": "/usr/root"
        "VariableName": "CONFIG_URL",
        "VariableValue": ""

License & Authors

Copyright:: 2010-2015, Chef Software, Inc

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
See the License for the specific language governing permissions and
limitations under the License.
Something went wrong with that request. Please try again.