Edit ar.oddc.server.config.json in the executable directory. Back up the file before changing it, validate the JSON syntax, and restart the service after changes.
The source tree currently contains these defaults:
json:
{
"ConnectionStrings": {
"OddcDbConnection": "Server=localhost;Database=ODDC51PROD;Trusted_Connection=True;MultipleActiveResultSets=true;Encrypt=True;TrustServerCertificate=True"
},
"Ssl": {
"CertificateThumbprint": ""
},
"Server": {
"EnableHttp": true,
"EnableHttps": true,
"HttpPort": 58080,
"HttpsPort": 58443
},
"Authentication": {
"Type": "Windows"
}
}
Database connection #
ConnectionStrings:OddcDbConnection is mandatory. The default uses Windows integrated security and database ODDC51PROD on the local SQL Server.
On startup, the application first tests connectivity to the SQL Server master database. If that test fails, it prints a masked connection string and a list of discoverable local SQL Server instances, then exits with code 1. After a successful server connection, ODDC Server applies pending database migrations and seeds an empty initial database.
For integrated security, SQL Server sees the identity of the Windows service account. Test the connection as that account, not only as the interactive installer account.
HTTP and HTTPS listeners #
|
Setting |
Current default |
Meaning |
|---|---|---|
|
Server:EnableHttp |
true |
Listen on plain HTTP |
|
Server:EnableHttps |
true |
Listen on HTTPS |
|
Server:HttpPort |
58080 |
HTTP port on all interfaces |
|
Server:HttpsPort |
58433 |
HTTPS port on all interfaces |
At least one protocol must be enabled. If both are disabled, the process exits. When HTTPS is enabled, HTTP requests are redirected permanently to the configured HTTPS port. Production mode also enables HSTS.
Allow only the required inbound ports in Windows Firewall. For a production deployment, prefer HTTPS-only operation unless the HTTP listener is needed solely for redirecting trusted internal clients.
HTTPS certificate #
Set Ssl:CertificateThumbprint to the certificate SHA-1 thumbprint without relying on embedded spaces. The server searches these stores in order:
1. LocalMachine\My
2. LocalMachine\Root
3. CurrentUser\My
4. CurrentUser\Root
If the thumbprint is empty or no match is found, Kestrel web server falls back to its default certificate. That fallback is suitable for development only. TLS is restricted to TLS 1.2 and TLS 1.3.
For a Windows service, install the production certificate in LocalMachine\My, include its private key, and grant the service account access to that private key. Restart the service after certificate replacement or renewal.
Authentication mode #
Set Authentication:Type to one of the following values:
• Windows — The browser uses Windows Negotiate authentication. The external API may use Negotiate or HTTP Basic
• Basic — The browser shows a login page and creates a cookie-based session. The external API uses HTTP Basic
Authentication mode is selected at application startup, so changing it requires a restart.