Skip to content

Commit e6934e7

Browse files
VRamakrishnaVRamakrishna
authored
Merge pull request #187 from VRamakrishna/main
Documentation for TLS Enablement in Relays and Drivers Involved in Testnets
2 parents d4cef34 + e88d0db commit e6934e7

File tree

81 files changed

+2363
-275
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

81 files changed

+2363
-275
lines changed

‎common/protos/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@
33
44
SPDX-License-Identifier: CC-BY-4.0
55
-->
6-
## protos
6+
## Weaver Protos
77

8-
This repository contains the grpc service and protocol buffer definitions for the relay, drivers and other interop modules. protos
8+
This repository contains the gRPC service and protocol buffer definitions for the relay, drivers, other interoperation modules, and common structures used by several Weaver components.

‎core/drivers/corda-driver/.env.docker.template‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,10 @@ DOCKER_IMAGE_NAME=ghcr.io/hyperledger-labs/weaver-corda-driver
77
DOCKER_TAG=1.2.3
88
COMPOSE_PROJECT_NAME=<docker-compose-project-name>
99
COMPOSE_PROJECT_NETWORK=<docker-compose-project-network>
10+
RELAY_TLS=<true|false>
11+
RELAY_TLSCA_TRUST_STORE=<truststore-jks-file-path>
12+
RELAY_TLSCA_TRUST_STORE_PASSWORD=<truststore-jks-file-password>
13+
RELAY_TLSCA_CERT_PATHS=<colon-separated-CA-cert-paths>
14+
DRIVER_TLS=<true|false>
15+
DRIVER_TLS_CERT_PATH=<cert-path>
16+
DRIVER_TLS_KEY_PATH=<private-key-path>

‎core/drivers/corda-driver/Dockerfile.local‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Local build
2+
FROM gradle:4.10.3-jdk8 AS builder-local
3+
4+
WORKDIR /corda-driver
5+
ADD build /corda-driver/build
6+
7+
FROM builder-local as builder
8+
9+
# Deployment Image
10+
FROM openjdk:8-jre
11+
12+
COPY --from=builder /corda-driver/build/install/corda-driver /corda-driver/
13+
14+
WORKDIR /corda-driver
15+
16+
ARG GIT_URL
17+
LABEL org.opencontainers.image.source ${GIT_URL}

‎core/drivers/corda-driver/Dockerfile‎ renamed to ‎core/drivers/corda-driver/Dockerfile.remote‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,3 @@
1-
ARG BUILD_TAG
2-
3-
# Local build
4-
FROM gradle:4.10.3-jdk8 AS builder-local
5-
6-
WORKDIR /corda-driver
7-
ADD build /corda-driver/build
8-
91
# Remote build
102
FROM gradle:4.10.3-jdk8 AS builder-remote
113

@@ -14,18 +6,16 @@ RUN apt-get update && apt-get install -y maven
146

157
WORKDIR /corda-driver
168
ADD . .
17-
# RUN ./gradlew build --refresh-dependencies
189
RUN ./gradlew clean installDist
1910

20-
FROM builder-${BUILD_TAG} as builder
21-
RUN echo "Builder ${BUILD_TAG}"
11+
FROM builder-remote as builder
2212

2313
# Deployment Image
24-
FROM openjdk:8-jre-alpine
14+
FROM openjdk:8-jre
2515

2616
COPY --from=builder /corda-driver/build/install/corda-driver /corda-driver/
2717

2818
WORKDIR /corda-driver
2919

3020
ARG GIT_URL
31-
LABEL org.opencontainers.image.source ${GIT_URL}
21+
LABEL org.opencontainers.image.source ${GIT_URL}

‎core/drivers/corda-driver/README.md‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,17 +69,21 @@ If the relay expects a TLS connection over gRPC, you need to specify the followi
6969
- `RELAY_TLSCA_CERT_PATHS`: colon-separated list of CA certificate file paths
7070
If you wish to run the driver service with TLS enabled, you need to specify the following environment variables in the `corda-driver` command:
7171
- `DRIVER_TLS`: should be set to `true`
72-
- `DRIVER_CERT_PATH`: driver's TLS certificate file path
73-
- `DRIVER_KEY_PATH`: driver's TLS private key file path
72+
- `DRIVER_TLS_CERT_PATH`: driver's TLS certificate file path
73+
- `DRIVER_TLS_KEY_PATH`: driver's TLS private key file path
7474
- Example: both relay and driver are TLS-enabled, and a trust store is used as a certificate repository:
7575
```bash
76-
RELAY_TLS=true RELAY_TLSCA_TRUST_STORE_PASSWORD=password RELAY_TLSCA_TRUST_STORE=trust_store.jks DRIVER_TLS=true DRIVER_CERT_PATH=cert.pem DRIVER_KEY_PATH=key.pem ./build/install/corda-driver/bin/corda-driver
76+
RELAY_TLS=true RELAY_TLSCA_TRUST_STORE_PASSWORD=password RELAY_TLSCA_TRUST_STORE=trust_store.jks DRIVER_TLS=true DRIVER_TLS_CERT_PATH=cert.pem DRIVER_TLS_KEY_PATH=key.pem ./build/install/corda-driver/bin/corda-driver
7777
```
7878
- Example: only relay is TLS-enabled, and the driver's trusted certificates are in separate files in the filesystem:
7979
```bash
8080
RELAY_TLS=true RELAY_TLSCA_CERT_PATHS=ca_cert1.pem:ca_cert2.pem ./build/install/corda-driver/bin/corda-driver
8181
```
8282

83+
If the driver is deployed within a Docker container, set the same variables as above in the appropriate `.env` file. The following sample files in [./docker-testnet-envs/](./docker-testnet-envs) can be used and tweaked for Fabric drivers associated with particular testnets:
84+
- Corda `Corda_Network`: `.env.corda` (non-TLS) and `.env.corda.tls` (TLS)
85+
- Corda `Corda_Network2`: `.env.corda2` (non-TLS) and `.env.corda2.tls` (TLS)
86+
8387
## Driver configuration
8488

8589
By default, the driver gRPC server listens on port `9099`. To change the port, set
@@ -119,6 +123,13 @@ To push image to github container registry:
119123
- `DOCKER_TAG`: Refer here for the image tags available: [weaver-corda-driver](https://github.com/hyperledger-labs/weaver-dlt-interoperability/pkgs/container/weaver-corda-driver)
120124
- `COMPOSE_PROJECT_NAME`: Docker project name for the Corda network to which this driver is supposed to attach. By default, the folder name of the Corda network's `docker-compose.yml`, is the project name.
121125
- `COMPOSE_PROJECT_NETWORK`: Docker project network name for the Corda network to which this driver is supposed to attach. By default, `default` is the project network name.
126+
- `RELAY_TLS`: Boolean flag indicating whether or not the local relay requires TLS connections
127+
- `RELAY_TLSCA_TRUST_STORE`: Path to JKS file (truststore) containing TLS CA certificates
128+
- `RELAY_TLSCA_TRUST_STORE_PASSWORD`: Password used to create the above JKS file
129+
- `RELAY_TLSCA_CERT_PATHS`: Colon-separated TLS certificate paths for local relay
130+
- `DRIVER_TLS`: Boolean flag indicating whether or not the driver requires TLS connections
131+
- `DRIVER_TLS_CERT_PATH`: Driver's TLS certificate path
132+
- `DRIVER_TLS_KEY_PATH`: Driver's TLS private key path
122133
* Create a Personal Access Token with read packages access in github. Refer [Creating a Personal Access Token](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) for help.
123134
* Run `docker login ghcr.io` and use your github username and personal access token as password.
124135
* Run: `make deploy`.

‎core/drivers/corda-driver/docker-compose.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,17 @@ services:
1313
- DRIVER_PORT=${DRIVER_PORT}
1414
- DRIVER_RPC_USERNAME=${DRIVER_RPC_USERNAME}
1515
- DRIVER_RPC_PASSWORD=${DRIVER_RPC_PASSWORD}
16+
- RELAY_TLS=${RELAY_TLS}
17+
- RELAY_TLSCA_TRUST_STORE=${RELAY_TLSCA_TRUST_STORE}
18+
- RELAY_TLSCA_TRUST_STORE_PASSWORD=${RELAY_TLSCA_TRUST_STORE_PASSWORD}
19+
- RELAY_TLSCA_CERT_PATHS=${RELAY_TLSCA_CERT_PATHS}
20+
- DRIVER_TLS=${DRIVER_TLS}
21+
- DRIVER_TLS_CERT_PATH=${DRIVER_TLS_CERT_PATH}
22+
- DRIVER_TLS_KEY_PATH=${DRIVER_TLS_KEY_PATH}
1623
ports:
1724
- "${DRIVER_PORT}:${DRIVER_PORT}"
25+
volumes:
26+
- ../../relay/credentials:/corda-driver/credentials
1827
command: sh -c "./bin/corda-driver"
1928

2029
networks:

‎core/drivers/corda-driver/docker-testnet-envs/.env.corda‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,14 @@ DRIVER_PORT=9099
33
DRIVER_RPC_USERNAME=driverUser1
44
DRIVER_RPC_PASSWORD=test
55
DOCKER_IMAGE_NAME=ghcr.io/hyperledger-labs/weaver-corda-driver
6-
DOCKER_TAG=1.2.3
6+
DOCKER_TAG=1.2.4-alpha.6
77
EXTERNAL_NETWORK=corda_default
88
COMPOSE_PROJECT_NAME=corda
9-
COMPOSE_PROJECT_NETWORK=default
9+
COMPOSE_PROJECT_NETWORK=default
10+
RELAY_TLS=false
11+
RELAY_TLSCA_TRUST_STORE=
12+
RELAY_TLSCA_TRUST_STORE_PASSWORD=
13+
RELAY_TLSCA_CERT_PATHS=
14+
DRIVER_TLS=false
15+
DRIVER_TLS_CERT_PATH=
16+
DRIVER_TLS_KEY_PATH=

‎core/drivers/corda-driver/docker-testnet-envs/.env.corda.tls‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
NETWORK_NAME=Corda_Network
2+
DRIVER_PORT=9099
3+
DRIVER_RPC_USERNAME=driverUser1
4+
DRIVER_RPC_PASSWORD=test
5+
DOCKER_IMAGE_NAME=ghcr.io/hyperledger-labs/weaver-corda-driver
6+
DOCKER_TAG=1.2.4-alpha.6
7+
EXTERNAL_NETWORK=corda_default
8+
COMPOSE_PROJECT_NAME=corda
9+
COMPOSE_PROJECT_NETWORK=default
10+
RELAY_TLS=true
11+
RELAY_TLSCA_TRUST_STORE=/corda-driver/credentials/docker/relay_drivers_trust_store.jks
12+
RELAY_TLSCA_TRUST_STORE_PASSWORD=trelay
13+
RELAY_TLSCA_CERT_PATHS=/corda-driver/credentials/docker/ca-cert.pem
14+
DRIVER_TLS=true
15+
DRIVER_TLS_CERT_PATH=/corda-driver/credentials/docker/corda-driver-cert.pem
16+
DRIVER_TLS_KEY_PATH=/corda-driver/credentials/docker/corda-driver-key.pem

‎core/drivers/corda-driver/docker-testnet-envs/.env.corda2‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,14 @@ DRIVER_PORT=9098
33
DRIVER_RPC_USERNAME=driverUser1
44
DRIVER_RPC_PASSWORD=test
55
DOCKER_IMAGE_NAME=ghcr.io/hyperledger-labs/weaver-corda-driver
6-
DOCKER_TAG=1.2.3
6+
DOCKER_TAG=1.2.4-alpha.6
77
EXTERNAL_NETWORK=corda_network2_default
88
COMPOSE_PROJECT_NAME=corda_network2
9-
COMPOSE_PROJECT_NETWORK=default
9+
COMPOSE_PROJECT_NETWORK=default
10+
RELAY_TLS=false
11+
RELAY_TLSCA_TRUST_STORE=
12+
RELAY_TLSCA_TRUST_STORE_PASSWORD=
13+
RELAY_TLSCA_CERT_PATHS=
14+
DRIVER_TLS=false
15+
DRIVER_TLS_CERT_PATH=
16+
DRIVER_TLS_KEY_PATH=

‎core/drivers/corda-driver/docker-testnet-envs/.env.corda2.tls‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
NETWORK_NAME=Corda_Network2
2+
DRIVER_PORT=9098
3+
DRIVER_RPC_USERNAME=driverUser1
4+
DRIVER_RPC_PASSWORD=test
5+
DOCKER_IMAGE_NAME=ghcr.io/hyperledger-labs/weaver-corda-driver
6+
DOCKER_TAG=1.2.4-alpha.6
7+
EXTERNAL_NETWORK=corda_network2_default
8+
COMPOSE_PROJECT_NAME=corda_network2
9+
COMPOSE_PROJECT_NETWORK=default
10+
RELAY_TLS=true
11+
RELAY_TLSCA_TRUST_STORE=/corda-driver/credentials/docker/relay_drivers_trust_store.jks
12+
RELAY_TLSCA_TRUST_STORE_PASSWORD=trelay
13+
RELAY_TLSCA_CERT_PATHS=/corda-driver/credentials/docker/ca-cert.pem
14+
DRIVER_TLS=true
15+
DRIVER_TLS_CERT_PATH=/corda-driver/credentials/docker/corda2-driver-cert.pem
16+
DRIVER_TLS_KEY_PATH=/corda-driver/credentials/docker/corda2-driver-key.pem

0 commit comments

Comments
 (0)