MergeBack automatically generates self-signed certificates during the installation step and places them in the installation folder (/opt/mergeback/certs).

In order to eliminate security warnings when opening the product in browsers administrators need to either install these self-signed certificates on end-users machines or replace them.

Your options for replacing the existing certificates are:

• Let's Encrypt
• ACME Certificate Provider
• Upload custom certificate

Let's Encrypt

If the product can be accessed via the public internet it is possible to use Let's Encrypt to generate and install signed certificates automatically.

This feature only works if Let's Encrypt's servers are able to connect to the host running MergeBack (indicated by the value you place in the 'Domains' field). Let's Encrypt will need to access port 80 on the host in order to verify the request made by MergeBack.

MergeBack will also periodically request replacement certificates on its own should the current ones reach their expiration date.

ACME Certificates

This option functions the same way as Let's Encrypt except it is up to the user to provide the information on how to connect to the certificate provider. This is primarily intended for organizations that may be running their own certificate provider.

Upload Certificates

This option allows users to upload their own certificates and their associated private key.

Note: The product expects PEM encoded certificate and key files. The key file should not be password protected.

MergeBack includes basic functionality around managing users and groups, including

• User and group permissions
• Group roles
• Fake users
• User invites
• Password resets

Adding Users and Groups

Adding users and groups is performed via the system management interface accessible by the 'admin' user via the 'Manage' shortcut in the top navbar. All other users will not have access to this screen.

A user can be added manually by clicking the 'Add' button and filling out the necessary information

Additionally a user invite can be generated and sent to the user and allow them to finalize the user creation process themselves

The username for the user invite can either be set by the administrator or auto-generated and set by the user when they finish setting up their account. Additionally the administrator can attach metadata to the invite/user in case the account is associated with some external application.

Unclaimed user invites will eventually be expired and removed by the system automatically

'Fake' users can be created to facilitate processes. For example an 'unassigned' user can be created and the ticket workflow can be configured to assign all newly opened tickets to the 'unassigned' user by default. 'Fake' users cannot log into the system but can be otherwise treated like normal users.

Groups provide an easy way to manage permissions across a large number of users at once.

Groups can also be given a role to indicate if the members are developers or QA. This role is used by the system to automatically assign the user as the developer or QA owner of the ticket when they are assigned to it.

User and group permissions

Creating a user will give them the ability to log into the system but until they are granted permissions they will be unable to access anything.

Most access is granted on a per-project basis via the project management interface found in the project dropdown in the navigation bar. Project management is available only to the 'admin' user.

Granting permissions to a group and then adding a user to the group is the most efficient way of managing permissions in the long-term. Users can be granted individual permissions for one-off cases. The user's access is the union of the permissions granted to them directly and via any groups they are assigned to.

MergeBack stores most of its data in the PostgreSQL database. The exception to this is file attachments.

This exception is made due to the inefficiencies of storing arbitrary files in the database as well as to facilitate easier access and recovery of these files during data recovery scenarios.

As a result at least one storage volume must be added to the product to store these files, though multiple volumes may be used to organize these files or keep them on separate storage devices.

Storage volume management is performed via the system management interface as the 'admin' user.

A storage volume is fundamentally a folder somewhere in the filesystem. The folder must exist on the machine before the storage volume can be created. It will also need to have the correct permissions and ownership settings so MergeBack can read and write files to it.

Storage volumes will be monitored for their disk usage and the admin user will be alerted when the remaining free space drops below recommended levels.

Disclaimer: While MergeBack is capable of using a remote PostgreSQL database the built in database backup and restore functionality works only with locally installed databases.

Database Backups

MergeBack provides built in automatic database backups, allowing the administrator to choose when the backup should happen and how many backups should be retained.

The administrator also has the ability to manually trigger a backup as well as lock backups to prevent them from being deleted

Clicking the square icon to the right of the backup will allow the administrator to restore from that backup:

Please note that if the 'Delete existing database' is not checked the old database will be renamed and remain on the PostgreSQL server until manually cleaned up. If space is not a concern then leaving this unchecked is best practice should something go wrong during the restore.

Replication

Users seeking a more comprehensive backup and restore solution can take this one step further by enabling the replication feature. This feature allows you to have a hot-spare instance of the product running on a secondary machine. It also covers backing up files from storage volumes (including database backups).

This feature requires a separate install of the product on another machine configured in 'Replication Mode'. In this mode it will listen for replication requests on the specified hostname and port. Enabling this mode is done through the initial 'Product Setup' screen:

Once your replication server is ready you can configure your production server to send backup data to it every time a backup is made:

When enabled the production server will connect to the replication server and upload database backups and files to the replication server. It will then trigger a restore of the database on the replication server to the latest backup

Please note that since the replication server is listening on a non-standard port that it is more vulnerable to having connectivity issues caused by routers and firewalls.

The replication server runs in read-only unlicensed mode. Promoting it to a normal install can be done by changing the selected mode in the drop-down at the top of the product setup screen.

MergeBack includes a built-in notification system to alert users and administrators to ticket updates or runtime errors. The indicator for them can be found in the right side of the top navigation bar next to the user's profile.

In the case of a large number of notifications or situations where the user wants to view acknowledged notifications they can click the 'Manage' button in the notification screen to navigate to a full page view of all notifications. The checkbox at the top will make acknowledged notifications visible, though they will get cleaned up automatically by the system after being acknowledged for 24 hours.

Users can also configure a forwarder that is capable of sending notification details as a HTTP request to another service. These settings can be found in the user's profile. Please note that notifications may contain sensistive information such as ticket titles and should only be sent to trusted destinations.

HTTP or HTTPS is supported. The server certificate is not required unless it is signed by a non-official certificate authority. Skipping certificate verification can be used but is not recommended if there are concerns about sensitive data. The 'Load Example' button can be used to populate a basic JSON request body that will auto-populate with the details of the notification.

MergeBack includes support for sending mail via SMTP in order deliver user invites, ticket updates or notifications to the system administrator

• Sender Address: The address that will appear in the 'From' section of the email. Ex: "noreply@mergeback.dev"
• Server Name: Used for validating the certificate of the SMTP server. This is typically the same as the SMTP Server Address
• CA (PEM): PEM encoded copy of the SMTP server's public certificate for validation.

At this point SMTP settings are considered an advanced feature intended for intranets hosting their own SMTP server. This is due largely to the complexity of setting it up as well as the difficulty of sending mail reliably without getting flagged as spam.

Note: Certificates, logs and other generated files will persist.