Configuration

Prerequisites

• Windows: MSVC compiler with toolset v142
• Linux: Clang 10 compiler and GCC libstdc++
• MacOS: Apple-Clang compiler and toolset

Download

Prebuild Binaries

To download TimeBase C++ client (C++ dxapi) prebuild binaries, use one of the following Deltix Nexus repositories:

• Windows (nuget repository)
• Linux
• MacOS

To work with the Decimal format:

• Download the prebuilt DFP library.

Conan Package

The C++ dxapi is also available in the EPAM Conan repository for all supported operating systems.

The DFP library is available in the Conan central repository.

Feature-Server Compatibility

The following features require the specific dxapi and TimeBase server versions denoted below:

Feature	Dxapi version	TimeBase server version
Stream spaces API	5.4.0	5.4.25
SSL	5.4.4	5.4.55
32-bit entity ID	5.4.10	5.5.26
Stream locks API	5.4.20	5.5.65
Change application name, Ranged locks, JSON stream schema	5.4.28	5.5.67, 5.6.18
Entities (symbols) as strings API	5.4.31	5.5.78, 5.6.24
Select from stream spaces API	5.5.0	5.5.83, 5.6.25
TimeBase web port	5.5.18	5.5.102, 5.6.71, 5.7.3
Delete stream data API, Select from multiple stream spaces	5.5.31	5.6.109

Environment Variables

Name	Description
DXAPI_LOG_ENABLE *	Enable/disable logging, default: true.
DXAPI_LOG_PATH	The path to dxapi logs. To switch off logging, set DXAPI_LOG_PATH to a directory that does not exist or to /dev/null.
DXAPI_LOG_LEVEL *	Global logging level, values: NONE/ERROR/WARNING/INFO/DEBUG/TRACE; default: INFO
SSL_CERT_FILE	The path to a file with trusted certificates** (for example, /etc/ssl/cert.pem). Default value is $OPENSSLDIR/cert.pem. $OPENSSLDIR: - Windows: %CommonProgramFiles%\SSL - Linux: /usr/local/ssl - MacOS: /ect/ssl
SSL_CERT_DIR	Points to a directory containing CA certificates in PEM format (for example, /etc/ssl/certs). Default value is $OPENSSLDIR/certs. The files each contain one CA certificate. The files are looked up by the CA subject name hash value, which must be available. If more than one CA certificate with the same name hash value exists, the extension must be different (for example, 9d66eef0.0, 9d66eef0.1, etc.)
DXAPI_SSL_TRUST_ALL	When set to true, switches off certificate verification.
DXAPI_SSL_TERMINATION	When set to true, uses SSL termination (for example, for setups with NLB).
DXAPI_LOADER_MIN_CHUNK_SIZE	Data is not written by loader until this amount is stored in the buffer.
DXAPI_LOADER_MAX_CHUNK_SIZE	Data loader chunks are never written bigger than this size.
DXAPI_LOADER_CLOSE_TIMEOUT_MS	Loader await time if server drops connection gracelessly. Default value is 30000.

More granular logging control env variables (all of them has possible values: NONE/ERROR/WARNING/INFO/DEBUG/TRACE; default: INFO):

Name	Description
DXAPI_TICKDB_LOG_LEVEL *	TickDB and TickStream log level.
DXAPI_CURSOR_LOG_LEVEL *	Cursors log level.
DXAPI_CURSOR_FILTERS_LOG_LEVEL *	Cursor subscriptions module log level.
DXAPI_LOADER_LOG_LEVEL *	Loaders log level.
DXAPI_LOADER_MANAGER_LOG_LEVEL *	Loaders manager log level.
DXAPI_SESSION_HANDLER_LOG_LEVEL *	SessionHandler module log level.
DXAPI_SOCKETS_LOG_LEVEL *	Sockets log level.
DXAPI_AERON_LOG_LEVEL *	Aeron log level.

* This log environment variables are available since 5.5.33 version.

** The file can contain several CA certificates identified as follows:

-----BEGIN CERTIFICATE-----
... (CA certificate in base64 encoding) ...
-----END CERTIFICATE-----

Connection URIs

• dxtick://: Direct connection to a server
• dstick://: Direct connection to a server with required SSL
• dxctick://: Connection to a random endpoint of a cluster
• dsctick://: Connection to a random endpoint of a cluster with required SSL

URIs may contain a user's credentials like dxctick://user:Pa$$w0rd@host1:9000|1.2.3.4:9000. Endpoints may contain IPv4 addresses. IPv6 addresses are not supported. For example:

"localhost:8011"          # connection to dxtick://localhost:8011 with default scheme
"dstick://localhost:9011" # SSL connection to localhost:9011
"dxctick://host1:8010|host2:8011|host2:8012" # connection to a random endpoint in cluster
"dsctick://host1:9010|host2:9011|host2:9012" # connection to a random endpoint in cluster with required SSL

SSL Configuration

Common SSL Flow

The TimeBase server can be configured to use SSL. To connect to the server securely, dxapi must verify the server's certificate unless DXAPI_SSL_TRUST_ALL is set to true.

The C++ dxapi utilizes the OpenSSL library to handle SSL connections and follows the OpenSSL flow for loading certificates. By default, OpenSSL relies on predefined directories that store trusted CA certificates. On many systems, these directories include:

• Linux: /etc/ssl/certs, /usr/share/ca-certificates, /etc/pki/tls/certs
• macOS: /System/Library/OpenSSL, /private/etc/ssl
• Windows: $OPENSSLDIR/certs

note

For MacOS, install arm64 SSL with brew install openssl@1.1.

OpenSSL can use the following environment variables to specify custom locations for certificate files and directories:

• SSL_CERT_FILE: specifies the path to the file containing trusted certificates;
• SSL_CERT_DIR: specifies the path to the directory containing trusted certificates.

For Windows, if SSL_CERT_DIR does not exist, is empty, or SSL_CERT_FILE is not set, dxapi attempts to load certificates from the Windows Certificate Manager (ROOT, CA, and MY stores).

Certificate Pinning

To pin a self-signed certificate from a file in DER format:

• Specify the file path using the DXAPI_SSL_CERT_FILE environment variable.

SSL Termination Flow

In this case, the TimeBase server is configured without SSL, but the load balancer between dxapi and the TB server is configured with SSL termination.

The environment variable DXAPI_SSL_TERMINATION must be set to true.

tip

Refer to TimeBase SSL Termination for more information.