OpenL Tablets

Prerequisites

• An Azure subscription and permission to create virtual machines
• A VM size of at least Standard_B2ms (2 vCPU / 8 GiB). The Java heap is capped at 3 GiB, which leaves headroom for rule compilation on that size
• An SSH key pair, to read the credentials file your VM generates
• Inbound TCP 443 (and 22 for SSH) allowed to the VM in its network security group

Launching the VM

In the Azure portal, search the Marketplace for OpenL Tablets on Ubuntu 24.04 LTS by SecureAnyCloud. Choose Standard_B2ms or larger, select your SSH key, and allow ports 22 and 443.

The Azure CLI equivalent is below. Replace the resource group, VM name and key path with your own values.

az group create --name openl-rg --location eastus
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openl-tablets-ubuntu-24-04:default:latest
az vm create \
  --resource-group openl-rg \
  --name openl-tablets \
  --image sac1647283583153:openl-tablets-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard
az vm open-port --resource-group openl-rg --name openl-tablets --port 443 --priority 1001

First boot generates this VM's credentials and certificate, then starts the application. Allow about two minutes before the site answers, because the Java application server deploys two sizeable web applications on that first start.

Retrieving your credentials

Every secret on this VM is unique to it. All of them are written to /root/openl-tablets-credentials.txt, which only root can read. SSH in as azureuser and read the file:

ssh azureuser@YOUR_VM_IP
sudo cat /root/openl-tablets-credentials.txt

To print the file with the passwords redacted, run the command below. Apart from the redacted passwords, the output matches the file.

sudo sed -E 's/^(OPENL_[A-Z_]*PASSWORD)=.*/\1=<redacted>/' /root/openl-tablets-credentials.txt

The file records two separate credentials. They are deliberately different:

• OPENL_ADMIN_USER and OPENL_ADMIN_PASSWORD open OpenL Studio, the browser IDE, at /webstudio
• OPENL_RULESERVICE_USER and OPENL_RULESERVICE_PASSWORD open the Rule Services REST and SOAP endpoints at /webservice

Confirm the file is root-only:

sudo stat -c '%n mode=%a owner=%U:%G' /root/openl-tablets-credentials.txt

Checking the service

The appliance runs one Java application server behind nginx. Confirm that the services are active:

systemctl is-active openl-tablets nginx nftables

The only TCP ports reachable from outside the VM are 22, 80 and 443. Everything else, including the application server itself, is on loopback. List the listening sockets:

ss -H -lnt | awk '{print $4}' | sort -u

The image ships a self-test that checks the security posture end to end. It confirms that the upstream default credentials are refused, that your per-VM credential is accepted through the real TLS front door, and that the rule endpoints require authentication. Run it with:

sudo /usr/local/sbin/openl-tablets-selftest.sh

First sign-in to OpenL Studio

Open https://YOUR_VM_IP/ in a browser. The image redirects you to /webstudio/ and shows a sign-in page. Sign in with OPENL_ADMIN_USER and OPENL_ADMIN_PASSWORD from your credentials file.

Your browser warns about the certificate. The image generates a self-signed certificate for your VM's address at first boot, so the site is never served in the clear. Replacing it with your own certificate is covered below.

Studio opens on an empty workspace. This is intentional: no sample projects and no demo accounts ship in the image. The user administration page shows exactly one account, the administrator generated on your VM.

Upstream's own examples and tutorials remain available as templates to create projects from. They are not pre-installed.

Creating a rule project

In Projects, choose New Project, then From template. You can start from any of these:

• A blank template
• One of the built-in examples or tutorials
• An existing .zip archive
• Your own .xlsx rule files
• An OpenAPI specification

Give the project a name, select the Design repository and choose Create. The project appears in the repository on the master branch, under Git version control.

Editing a decision table

Switch to the Editor tab. The tree on the left mirrors the structure of the Excel workbook: each worksheet is a folder, and each rule table inside it is a leaf. Select a table to open it.

A decision table shows its condition columns and its result column, with one row per rule. In the example below, the table reads a capital adequacy percentage and returns a score. Each row is a band, and the engine returns the score for the first band that matches.

The toolbar above the table is the working loop of the product:

• Edit changes the rule in place, in the browser, and writes back to the Excel workbook
• Run executes the rule against values you supply
• Trace shows which row fired and why
• Test runs the test cases stored alongside the table, so a change that breaks an expected outcome is caught before you deploy it

Because the project is a Git repository, every save is a commit with an author and a message. Use Revisions to compare versions or roll back.

Deploying a ruleset and calling it as an API

Deploying a project publishes its rules to Rule Services, which exposes each one as a REST and a SOAP endpoint. In the project view, open Deploy Configuration, add the project and deploy it.

Rule Services is protected by HTTP Basic authentication at the front door. An unauthenticated request is refused:

curl -sk -o /dev/null -w 'unauthenticated: HTTP %{http_code}\n' https://127.0.0.1/webservice/admin/services

With the rule service credential from your credentials file, the same request succeeds and lists the deployed services. The command reads the password straight from the root-only file and passes it to curl in a temporary config file, so it never appears in your shell history or the process list:

sudo bash -c 'P=$(grep "^OPENL_RULESERVICE_PASSWORD=" /root/openl-tablets-credentials.txt | cut -d= -f2-); C=$(mktemp); chmod 600 "$C"; printf "user = \"ruleservice:%s\"\n" "$P" > "$C"; curl -sk -m 20 -K "$C" -w "\nHTTP %{http_code}\n" https://127.0.0.1/webservice/admin/services; rm -f "$C"'

An empty list [] is the correct answer before you deploy anything. Once a ruleset is deployed, each service appears here with the URLs to call it. From outside the VM, call it the same way:

curl -u ruleservice:YOUR_RULESERVICE_PASSWORD \
  -H 'Content-Type: application/json' \
  -d '{"bankRating": 7}' \
  https://YOUR_VM_IP/webservice/BankRating/RatingGroup

Each deployed service also publishes an OpenAPI description and a WSDL, so you can generate clients against it.

If you run your own identity provider

Rule Services can validate JWT bearer tokens against your own issuer instead. Add the three settings below to /var/lib/openl-tablets/home/webservice.properties and restart the service. Enable this only if you have an issuer to point it at. JWT validation without a reachable JWK set refuses every request.

ruleservice.authentication.enabled = true ruleservice.authentication.iss = https://your-issuer.example.com/ ruleservice.authentication.jwks = https://your-issuer.example.com/.well-known/jwks.json

The nginx Basic authentication in front of /webservice is independent of this setting. If you move to JWT and want to remove Basic authentication, delete the auth_basic lines from the /webservice location in /etc/nginx/sites-available/openl-tablets. Do not remove them while ruleservice.authentication.enabled is false, or your rule endpoints become publicly callable.

Where your rules live

Everything stateful is under /var/lib/openl-tablets/home. It is owned by the non-login openl service account and preserved across reboots:

• repositories/design: the Git design repository holding your rule projects
• repositories/deployment: deployed rulesets, as served by Rule Services
• user-workspace: per-user working copies
• users-db: the embedded user database
• webstudio.properties and webservice.properties: this image's configuration

That single directory is all you need to back up. Stop the service first, so that the Git repository and the user database are quiesced:

sudo systemctl stop openl-tablets
sudo tar czf /var/backups/openl-home-$(date +%F).tar.gz -C /var/lib/openl-tablets home
sudo systemctl start openl-tablets

Store the archive off the VM. It contains your rules and your user database, so treat it as sensitive.

Using your own domain and certificate

The image generates a self-signed certificate for your VM's address. To serve a trusted certificate, point a DNS A record at the VM, issue a certificate with certbot and reload nginx. The commands below show the procedure. Replace the domain and email address with your own.

sudo apt-get update && sudo apt-get install -y certbot
sudo certbot certonly --standalone -d rules.example.com --agree-tos -m you@example.com
sudo sed -i 's#/etc/ssl/openl-tablets/openl.crt#/etc/letsencrypt/live/rules.example.com/fullchain.pem#' /etc/nginx/sites-available/openl-tablets
sudo sed -i 's#/etc/ssl/openl-tablets/openl.key#/etc/letsencrypt/live/rules.example.com/privkey.pem#' /etc/nginx/sites-available/openl-tablets
sudo nginx -t && sudo systemctl reload nginx

Certbot's standalone mode needs port 80 to be free. nginx already answers there, so either stop nginx while the certificate is issued or use the webroot plugin instead.

Changing the administrator password

Change the password in Studio. Open the account menu, choose My Profile and set a new password. The credentials file records what was generated at first boot and is not rewritten, so update or remove it after you change the password.

To add colleagues instead of sharing one login, open Administration > Users. OpenL Tablets supports per-user accounts with group-based permissions. It can also use Active Directory, SAML or OAuth2 instead of its own user database.

Memory and sizing

The Java heap is capped at 3 GiB, chosen to fit Standard_B2ms with room to spare and no swap. Azure image certification does not permit a swap file in the image, and a rules engine that swaps is a rules engine that times out. With both applications deployed and idle, expect roughly 800 MiB resident:

free -m | awk '/^Mem:/{printf "total=%s MiB used=%s MiB available=%s MiB\n",$2,$3,$7}'; swapon --show || echo "no swap configured"

Large rule projects compile in memory. If you work with very large workbooks, move to a larger VM size and raise the heap ceiling in /etc/systemd/system/openl-tablets.service. Keep the heap comfortably below total RAM.

Applying updates

The image receives Ubuntu security updates automatically through unattended-upgrades. To move to a newer OpenL Tablets release, replace the two web application archives and restart. They are plain WAR files, and the configuration lives outside them:

cd /var/lib/openl-tablets/tomcat/webapps
sudo systemctl stop openl-tablets
sudo curl -fsSLo webstudio.war https://repo1.maven.org/maven2/org/openl/rules/org.openl.rules.webstudio/NEW_VERSION/org.openl.rules.webstudio-NEW_VERSION.war
sudo curl -fsSLo webservice.war https://repo1.maven.org/maven2/org/openl/rules/org.openl.rules.ruleservice.ws/NEW_VERSION/org.openl.rules.ruleservice.ws-NEW_VERSION.war
sudo rm -rf webstudio webservice
sudo chown openl:openl webstudio.war webservice.war
sudo systemctl start openl-tablets

Back up /var/lib/openl-tablets/home first and read the release notes, because a major version can migrate the project format.

Troubleshooting

The site does not answer. First boot takes a couple of minutes to deploy both applications. Check first-boot progress with journalctl -u openl-tablets-firstboot.service and the application itself with journalctl -u openl-tablets.service.

The sign-in page rejects your password. Use the OPENL_ADMIN_PASSWORD line from /root/openl-tablets-credentials.txt, which only root can read. This image deliberately refuses the upstream default admin/admin, and the self-test above confirms it.

Rule Services returns 401. The front door is asking for the rule service credential. It differs from your Studio login: use OPENL_RULESERVICE_USER and OPENL_RULESERVICE_PASSWORD.

A ruleset does not appear after deploying. Rule Services reloads the deployment repository on a timer. Check journalctl -u openl-tablets.service for compilation errors in the project. A rule table that fails to compile is skipped, not served.

Support

SecureAnyCloud maintains this image. For image-specific questions, contact support through the marketplace listing. For questions about OpenL Tablets itself, see the project's documentation, discussions and issue tracker, which are linked from the Studio help page.

Deploy on Azure

Launch OpenL Tablets on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com