WSO2 API Manager - Hardened Full-Lifecycle API Management

What is WSO2 API Manager

WSO2 API Manager is an open-source platform for the full API lifecycle. It combines a Publisher (design, version and document REST, SOAP, GraphQL, WebSocket and streaming APIs), a Developer Portal (discover, subscribe, obtain keys and try APIs), a high-performance API Gateway that enforces security, rate limiting and mediation, and a built-in Key Manager that issues and validates OAuth2 access tokens, API keys and JWTs. It supports OpenID Connect, OAuth 2.0 scopes, mutual TLS, subscription-tier throttling and pluggable external identity providers. This image runs the all-in-one profile (gateway, three portals and Key Manager in one JVM) on Eclipse Temurin 21. Apache-2.0 license - the community binary is the production binary, with no open-core feature gating.

Why self-host WSO2 API Manager

Running API management on a VM you control keeps your API definitions, tokens, subscriber data and gateway traffic inside your own tenant rather than a managed API service - fitting data residency requirements and GDPR, HIPAA or ISO 27001 obligations, with no per-call fees. Apache-2.0, fully auditable, no vendor lock-in.

What this VM image adds

Security hardening:

• Production datastore on a bundled local PostgreSQL (shared_db + apim_db) - not the embedded H2 dev database
• Keystore regenerated at first boot - the shipped wso2carbon.jks carries a publicly known private key; this image replaces it with a fresh self-signed certificate and a random store password
• Random super-admin password generated uniquely per instance at first boot - written to /root/wso2am-credentials.txt (mode 0600); the default admin/admin is never shipped live
• PostgreSQL (5432) bound to 127.0.0.1 only - never exposed off-box; database passwords rotated at first boot
• AI and analytics phone-home disabled - the Marketplace Assistant / API-Chat and analytics features ship off; nothing calls a hosted endpoint on boot
• JVM heap (-Xms/-Xmx) auto-sized to the instance RAM at first boot
• WSO2 serves its own TLS on console port 9443 and HTTPS gateway port 8243 - no plaintext admin surface
• UFW firewall - TCP 22 for SSH plus the WSO2 ports (9443, 8243, optionally 9763/8280) opened by the buyer in the NSG; all other inbound dropped
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control
• CVE scan - every image is scanned with Trivy before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd for system call auditing of critical paths
• SSH hardening - key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, IPv6 off
• /tmp as tmpfs with nosuid, nodev, noexec

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json with WSO2 API Manager pinned by version, PURL, license and hash
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Operator credentials file at /root/wso2am-credentials.txt (mode 0600) with the super-admin password, the console URLs and the gateway endpoints

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D4s_v3 recommended - 16 GB RAM for the all-in-one profile plus bundled PostgreSQL)
2. Open NSG: TCP 9443 and 8243 from your trusted sources, TCP 22 from your management IPs only
3. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/wso2am-credentials.txt for the super-admin password
4. Open https://<PUBLIC_IP>:9443/publisher in your browser and accept the self-signed certificate warning, then log in as admin with the password from the credentials file
5. Create your own admin user in the Admin Portal and disable this account before production

First boot takes 2-4 minutes (PostgreSQL rotation, keystore regeneration and JVM cold start); the consoles return a connection error until WSO2 has started, then load normally. Consoles on HTTPS 9443: /publisher, /devportal, /admin, /carbon. Published APIs are invoked through the gateway at https://<PUBLIC_IP>:8243/<context>/<version>. For production, replace the self-signed keystore and the IP hostname with your own domain and certificate in deployment.toml.