Apache Fineract

Apache Fineract is an open-source core banking platform providing a flexible, extensible foundation for a wide range of financial services. By making robust banking technology openly available, it lowers barriers for institutions and innovators to reach underserved and unbanked populations.

Have a look at the documentation, the wiki or at the FAQ, if this README does not answer what you are looking for.

COMMUNITY

If you are interested in contributing to this project, but perhaps don't quite know how and where to get started, please join our developer mailing list, listen into our conversations, chime into threads, or just send us a "Hello!" introduction email; we're a friendly bunch, and look forward to hearing from you. A more informal alternative is the Fineract Slack channel (thank you, Mifos, for supporting the Slack channel!).

For the developer wiki, see Contributor's Zone. Maybe these how-to articles help you to get started.

In any case visit our JIRA Dashboard to find issues to work on, see what others are doing, or open new issues.

In the moment you get started writing code, please consult our CONTRIBUTING guidelines, where you will find more information on subjects like coding style, testing and pull requests.

REQUIREMENTS

• min. 16GB RAM and 8 core CPU
• MariaDB >= 11.5.2 or PostgreSQL >= 17.0
• Java >= 21 (Azul Zulu JVM is tested by our CI on GitHub Actions)

Tomcat (min. v10) is only required, if you wish to deploy the Fineract WAR to a separate external servlet container. You do not need to install Tomcat to run Fineract. We recommend the use of the self-contained JAR, which transparently embeds a servlet container using Spring Boot.

SECURITY

For a list of known vulnerabilities, see Apache Fineract Security Reports.

If you believe you have found a new vulnerability, let us know privately.

For details about security during development and deployment, see the documentation here.

INSTRUCTIONS

The following how-to's assume you have Java installed, you cloned the repository (or downloaded and extracted a specific version) and you have a database server (MariaDB or PostgreSQL) running.

How to run for local development

Run the following commands in this order:

./gradlew createDB -PdbName=fineract_tenants
./gradlew createDB -PdbName=fineract_default
./gradlew devRun

This creates two databases and builds and runs Fineract, which will be listening for API requests on port 8443 (by default) now.

Confirm Fineract is ready with, for example:

curl --insecure https://localhost:8443/fineract-provider/actuator/health

To test authenticated endpoints, include credentials in your request:

curl --location \
  https://localhost:8443/fineract-provider/api/v1/clients \
  --header 'Content-Type: application/json' \
  --header 'Fineract-Platform-TenantId: default' \
  --header 'Authorization: Basic bWlmb3M6cGFzc3dvcmQ='

How to run for production

Running Fineract to try it out is relatively easy. If you intend to use it in a production environment, be aware that a proper deployment can be complex, costly, and time-consuming. Considerations include: Security, privacy, compliance, performance, service availability, backups, and more. The Fineract project does not provide a comprehensive guide for deploying Fineract in production. You might need skills in enterprise Java applications and more. Alternatively, you could pay a vendor for Fineract deployment and maintenance. You will find tips and tricks for deploying and securing Fineract in our official documentation and in the community-maintained wiki.

How to build the JAR file

Build a modern, cloud native, fully self contained JAR file:

./gradlew clean bootJar

The JAR will be created in the fineract-provider/build/libs directory. As we are not allowed to include a JDBC driver in the built JAR, download a JDBC driver of your choice. For example:

wget https://dlm.mariadb.com/4174416/Connectors/java/connector-java-3.5.2/mariadb-java-client-3.5.2.jar

Start the JAR and specify the directory containing the JDBC driver using the loader.path option, for example:

java -Dloader.path=. -jar fineract-provider/build/libs/fineract-provider.jar

This does not require an external Tomcat.

The tenants database connection details are configured via environment variables (as with Docker container), e.g. like this:

export FINERACT_HIKARI_PASSWORD=verysecret
...
java -jar fineract-provider.jar

How to build the WAR file

Build a traditional WAR file:

./gradlew :fineract-war:clean :fineract-war:war

The WAR will be created in the fineract-war/build/libs directory. Afterwards deploy the WAR to your Tomcat Servlet Container.

We recommend using the JAR instead of the WAR file deployment, because it's much easier.

How to run using Docker or Podman

It is possible to do a 'one-touch' installation of Fineract using containers (AKA "Docker"). This includes the database running in the container.

As prerequisites, you must have docker and docker-compose installed on your machine; see Docker Install and Docker Compose Install.

Alternatively, you can also use Podman (e.g. via dnf install podman-docker), and Podman Compose (e.g. via pip3 install podman-compose) instead of Docker.

To run a new Fineract instance on Linux you can simply:

git clone https://github.com/apache/fineract.git
cd fineract
./gradlew :fineract-provider:jibDockerBuild -x test

On Windows, do this instead:

git clone https://github.com/apache/fineract.git --config core.autocrlf=input
cd fineract
gradlew :fineract-provider:jibDockerBuild -x test

Install the Loki log driver and start:

docker plugin install grafana/loki-docker-driver:latest \
  --alias loki --grant-all-permissions
docker compose -f docker-compose-development.yml up -d

The Fineract (back-end) should be running at https://localhost:8443/fineract-provider/ now. Wait for https://localhost:8443/fineract-provider/actuator/health to return {"status":"UP"}. You must go to https://localhost:8443 and remember to accept the self-signed SSL certificate of the API once in your browser.

Docker Hub has a pre-built container image of this project, built continuously.

You must specify the MySQL tenants database JDBC URL by passing it to the fineract container via environment variables; please consult the docker-compose.yml for exact details how to specify those.

The logfiles and the Java Flight Recorder output are available in PROJECT_ROOT/build/fineract/logs. If you use IntelliJ then you can double-click on the .jfr file and open it with the IDE. You can also download Azul Mission Control to analyze the Java Flight Recorder file.

NOTE: If you have issues with the file permissions and Docker Compose then you might need to change the variable values for FINERACT_USER and FINERACT_GROUP in PROJECT_ROOT/config/docker/env/fineract-common.env. You can find out what values you need to put there with the following commands:

id -u ${USER}
id -g ${GROUP}

Please make sure that you are not checking in your changed values. The defaults should work for most people.

How to run on Kubernetes

General Clusters

You can also run Fineract using containers on a Kubernetes cluster. Make sure you set up and connect to your Kubernetes cluster. You can follow this guide to set up a Kubernetes cluster on GKE. Make sure to replace apache-fineract-cn with apache-fineract

Now e.g. from your Google Cloud shell, run the following commands:

git clone https://github.com/apache/fineract.git
cd fineract/kubernetes
./kubectl-startup.sh

To shutdown and reset your Cluster, run:

./kubectl-shutdown.sh

Using Minikube

Alternatively, you can run fineract on a local kubernetes cluster using minikube. As prerequisite you must have minikube and kubectl installed on your machine; see Minikube & Kubectl install.

To run a new Fineract instance on Minikube you can simply:

git clone https://github.com/apache/fineract.git
cd fineract/kubernetes
minikube start
./kubectl-startup.sh
minikube service fineract-server --url --https

Fineract is now running at the printed URL, which you can check e.g. using:

http --verify=no --timeout 240 --check-status get $(minikube service fineract-server --url --https)/fineract-provider/actuator/health

To check the status of your containers on your local minikube Kubernetes cluster, run:

minikube dashboard

You can check Fineract logs using:

kubectl logs deployment/fineract-server

To shutdown and reset your cluster, run:

./kubectl-shutdown.sh

How to enable External Message Broker (ActiveMQ or Apache Kafka)

There are two use-cases where external message broker is needed: - External Business Events / Reliable Event Framework - Executing Partitioned Spring Batch Jobs

External Events are business events, e.g.: ClientCreated, which might be important for third party systems. Apache Fineract supports ActiveMQ (or other JMS compliant brokers) and Apache Kafka endpoints for sending out Business Events. By default, they are not emitted.

In case of a large deployment with millions of accounts, the Close of Business Day Spring Batch job may run several hours. In order to speed up this task, remote partitioning of the job is supported. The Manager node partitions breaks up the COB job into smaller pieces (sub tasks), which then can be executed on multiple Worker nodes in parallel. The worker nodes are notified either by ActiveMQ or Kafka regarding their new sub tasks.

ActiveMQ

JMS based messaging is disabled by default. In docker-compose-postgresql-activemq.yml an example is shown, where ActiveMQ is enabled. In that configuration one Spring Batch Manager instance and two Spring Batch Worker instances are created. Spring based events should be disabled and jms based event handling should be enabled. Furthermore, proper broker JMS URL should be configured.

      FINERACT_REMOTE_JOB_MESSAGE_HANDLER_JMS_ENABLED=true
      FINERACT_REMOTE_JOB_MESSAGE_HANDLER_SPRING_EVENTS_ENABLED=false
      FINERACT_REMOTE_JOB_MESSAGE_HANDLER_JMS_BROKER_URL=tcp://activemq:61616

For additional ActiveMQ related configuration please take a look to the application.properties where the supported configuration parameters are listed with their default values.

Kafka

Kafka support is also disabled by default. In docker-compose-postgresql-kafka.yml an example is shown, where self-hosted Kafka is enabled for both External Events and Spring Batch Remote Job execution.

During the development Fineract was tested with PLAINTEXT Kafka brokers without authentication and with AWS MSK using IAM authentication. The extra JAR file required for IAM authentication is already added to the classpath. An example MSK setup can be found in docker-compose-postgresql-kafka-msk.yml.

The full list of supported Kafka related properties is documented in the Fineract Platform documentation.

DATABASE AND TABLES

You can run the required version of the database server in a container, instead of having to install it, like this:

docker run --name mariadb-11.5 -p 3306:3306 -e MARIADB_ROOT_PASSWORD=mysql -d mariadb:11.5.2

and stop and destroy it like this:

docker rm -f mariadb-11.5

Beware that this container database keeps its state inside the container and not on the host filesys