UNIFY requirements

Heidler UNIFY is the browser-based logistics platform that brings your shipping data together in one place, across all locations. The data is transferred from your existing HVS32 installations to UNIFY by the Sync Manager. UNIFY itself is installed on a server you provide and is accessed from the workstations exclusively through a browser.

This page is addressed to your IT department. It describes what has to be in place before the installation: software versions, server, ports, firewall rules and the certificate.

 

Required software versions

The list below is a general guideline and is intended to let you recognise in advance whether any updates are required on your side. If one of your components is below the version stated, please request the update from our support team in good time before the installation appointment.

Component	Minimum version	Note
HVS32	7.118.1	shipping system at every location that supplies data to UNIFY
Firebird	5	database engine of HVS32
Sync Manager	1.0.0	transfers the shipping data from HVS32 to UNIFY
UNIFY	1.0.0	the web interface itself
DataGatewayServer (DGS)	3.9.8	only required if actions on a parcel are triggered from within UNIFY (e.g. reprint label, cancel, online tracking)
Database archiving	4.8.0	only if archiving is in use

 

Server for UNIFY

UNIFY is installed with one setup on one Windows server. The setup registers five Windows services:

Service	Role
HSC-UNIFY-Web	web server (nginx) – serves the interface and is the only entry point from outside
HSC-UNIFY-Service	application service (administration screen, management)
HSC-UNIFY-Import	receives the data from the Sync Manager
HSC-UNIFY-Auth	sign-in and tokens
HSC-UNIFY-Postgres	database

Everything needed is included in the setup – Java runtime, database, sign-in service and web server are part of the installation medium. No software is installed afterwards, and no internet connection is needed during the installation.

Operating system and permissions

We support Windows Server versions that are still under support from Microsoft. Operating systems whose support period has expired no longer receive security updates and are neither tested nor supported by us. At present this means Windows Server 2019 and newer.

Item	Requirement
Operating system	Microsoft Windows Server, 64-bit, version 2019 or newer – see the note above
Permissions	The setup has to be run as administrator – it registers services and creates a scheduled task
Virus scanner	Exclude the installation directory from real-time scanning. If the virus scanner locks database files, services fail without any apparent connection

Running UNIFY on a virtual machine is possible and common. Please make sure the VM can easily be scaled later and is not placed on a host whose disk performance is already saturated by other VMs.

Sizing

The following values are guidelines. The requirement depends on the amount of data, not on the number of users.

Item	Minimum	Recommended
Processor	4 cores	4 cores
Memory	8 GB	16 GB
Free disk space	20 GB (SSD)	50 GB and more, depending on the retention period
Network connection	100 Mbit/s	1,000 Mbit/s

Together the services occupy around 6 GB of memory (database cache, the two application services, the sign-in service and Windows itself). With less memory the server falls back on the paging file, which is clearly noticeable in the interface.

For disk space, apart from the installation itself (around 2 GB), what counts is the growth of the database and of the Backup\ folder: every backup is stored there in full, and the last ten are kept.

These values apply to UNIFY alone. If further applications run on the same server – the DataGatewayServer, for example – their requirements have to be added. The guideline values for the other HSC applications are listed on the page System requirements.

Further prerequisites

• Port 443 should be free. UNIFY is delivered on port 443 by default. If an IIS or another web server is already running on that port, please let us know before the installation so that our support team can configure a different port. What to keep in mind is described under Non-standard web port.
• The system time has to be correct. Signing in works with tokens whose validity is checked to the second. A server whose clock is off by minutes will sign users out again. We recommend time synchronisation against a domain controller or an NTP server.
• The server name has to be resolvable on the network – and it has to be the same name under which users will later call up UNIFY. It goes into the certificate and into the issuer field of the tokens. Changing it afterwards means: new certificate and a restart of the services.

 

Default ports

The values listed are defaults and can be changed during the installation. Before installing, the setup checks whether the ports are free on the server and reports anything already in use or configured twice.

UNIFY

Service	Port	Protocol	Bound to	Reachable from outside
Web (nginx)	443	HTTPS	all addresses	yes – the only entry point
Application service	9080	HTTP	127.0.0.1	no
Application service, management	9090	HTTP	127.0.0.1	no
Import service	9081	HTTP	127.0.0.1	no
Import service, management	9091	HTTP	127.0.0.1	no
Sign-in service	9082	HTTP	127.0.0.1	no
Database (PostgreSQL)	9432	TCP	localhost	no

The six internal ports listen on the loopback address only. They cannot be addressed from the network, even without a firewall rule. Everything coming from outside goes through the web server on port 443.

Non-standard web port

If port 443 is already in use on the server, UNIFY is configured on a different port during the installation. Please report this to support in advance so the value can be set right away. Changing it later is possible, but it entails the same adjustments.

With a non-standard web port, please note:

• The port belongs in the address. The interface is then called up at https://<servername>:<port>/sm/ui/. Shortcuts, bookmarks and links from other applications have to include the port.
• The firewall rule applies to that port, not to 443.

The remaining ports (9080, 9081, 9082, 9090, 9091, 9432) can be changed as well, should they already be in use on the server. Please report that in advance too.

DataGatewayServer (DGS)

The DataGatewayServer is required if actions on a parcel are triggered from within UNIFY (print label, cancel, lock, online tracking). It can run on the HVS32 server – or on the same server as UNIFY.

Component	Port	Scope	Purpose
DGS – REST server	9035	internal (LAN)	interface through which UNIFY triggers actions
DGS – HVS client	9034	internal (LAN)	connection to HVS32

 

Firewall rules

The setup does not create any firewall rules. You set these up yourself. Until that is done, UNIFY can only be called up on the server itself; from the workstations the browser runs into a timeout without any error message.

To be set up

Direction	Port	Source	Purpose
inbound	TCP 443 (or the chosen web port)	workstation networks	access to the web interface
inbound	TCP 443	machines running the Sync Manager	data transfer to UNIFY
outbound (HVS32 server)	TCP 443	Sync Manager → UNIFY server	the same connection in the opposite direction

No further rules are required:

• No rule for 9080, 9081, 9082, 9090, 9091 and 9432. These ports are only reachable through the loopback address and do not belong on the network.
• No outbound rule for the UNIFY server to the internet. UNIFY does not call any service on the internet by itself.

What is commonly overlooked

• The server has to be able to reach itself under its own name. The application and import services validate every token against their own sign-in service and fetch its keys via https://<servername>/…, that is, through the regular path via the web server. If the name does not resolve on the server itself, or if the local firewall blocks the server's connection to itself, every request is answered with HTTP 401 even though the credentials are correct.

 

Certificate / HTTPS

UNIFY is accessed over HTTPS only. There are two options for the certificate. The decision should be made before the installation, because the server name goes into the certificate.

Option 1: UNIFY creates its own certificate

The setup creates a self-signed certificate (valid for 10 years, RSA 2048) carrying the server name, the computer name, the FQDN, localhost and the local IPv4 addresses as Subject Alternative Name.

For test operation and purely internal use this is sufficient. The users' browsers do not know the issuer, however, and will show a warning on every visit. For permanent operation we recommend option 2.

Option 2: You provide your own certificate

Two files in PEM format are required:

File	Content
server.crt	the certificate – your own first, followed by the intermediate certificates of the CA
server.key	the matching private key, without a passphrase

Requirements for the certificate:

• The name under which users call up UNIFY has to be entered as a Subject Alternative Name (SAN). A name in the CN field alone is not sufficient, as browsers and Java no longer evaluate that field. If both the short name and the FQDN are used, both belong in the SAN.
• Issued by a CA the workstations trust. With an internal CA this means: its root certificate has been distributed to the clients, usually by group policy.
• RSA with 2048 bits or more, or ECDSA.
• The private key has to be exportable. A certificate that resides in the Windows certificate store and cannot be extracted from there is not usable; in that case a new certificate is requested on the server.
• The key must not carry a passphrase. Otherwise the web server waits for an entry on startup and does not come up.

The private key does not leave your server. You place both files yourself and then run the supplied script setup\zertifikat-uebernehmen.cmd as administrator. HSC needs neither the key nor a password.

Renewal

Renewing the certificate is up to you. After every replacement, setup\zertifikat-uebernehmen.cmd has to be run again: the script adds the new certificate to the trust stores of the internal services and restarts them. If this step is forgotten, the application answers with HTTP 401 without the browser showing a certificate error.

 

Workstations

No software is installed on the workstations. UNIFY runs entirely in the browser.

• A current browser in a maintained version: Google Chrome, Microsoft Edge or Mozilla Firefox.
• The server name has to be resolvable from the workstation and the web port has to be reachable.
• With a certificate from an internal CA: its root certificate has to be in the workstations' trust store so that no certificate warning appears.
• Recommended screen resolution: 1920 × 1080 or higher. The interface works with wide tables.

 

Backup

The backup is your responsibility. The setup does not create a backup schedule or a scheduled backup task. Only one backup is created automatically: the installer creates one before every update.

What has to be backed up is the entire installation directory, not just the database. It also holds the encrypted credentials and the certificates. A database dump on its own cannot be put back into operation without them.

 

Test and production system

A test system does not require a second UNIFY installation. The test and the production system can share the same UNIFY. The test system is set up as a location of its own with its own TenantId and supplies its data like any other location. In the interface you use the location selector in the header to choose which data is shown.

The two data sets stay separate without a further server having to be provided, maintained and backed up.