-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: David Lawrence <[email protected]> (github: endophage)
- Loading branch information
David Lawrence
committed
Feb 9, 2016
1 parent
b7b6b86
commit 50249ea
Showing
6 changed files
with
83 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
The Notary server is a front line metadata server for the Notary client. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,43 @@ | ||
# What is Notary server | ||
|
||
The Notary server manages JSON formatted TUF (The Update Framework) metadata for Notary clients and the docker command line tool's Docker Content Trust features. It requires a companion Notary signer instance and a MySQL (or MariaDB) database. | ||
|
||
%%LOGO%% | ||
|
||
# How to use this image | ||
|
||
The following sample configuration is included in the image: | ||
|
||
{ | ||
"server": { | ||
"http_addr": ":4443", | ||
"tls_key_file": "/certs/notary-server.key", | ||
"tls_cert_file": "/certs/notary-server.crt" | ||
}, | ||
"trust_service": { | ||
"type": "remote", | ||
"hostname": "notarysigner", | ||
"port": "7899", | ||
"tls_ca_file": "/certs/root-ca.crt", | ||
"key_algorithm": "ecdsa", | ||
"tls_client_cert": "/certs/notary-server.crt", | ||
"tls_client_key": "/certs/notary-server.key" | ||
}, | ||
"logging": { | ||
"level": "info" | ||
}, | ||
"storage": { | ||
"backend": "mysql", | ||
"db_url": "server@tcp(mysql:3306)/notaryserver?parseTime=True" | ||
} | ||
} | ||
|
||
The components you *must* provide are the certificates and keys, and the links for the `notarysigner` and `mysql` hostnames. The `root-ca.crt` file enables the Notary server to identify valid signers, which it communicates with over mutual TLS using a GRPC interface. The `notary-server.crt` and`notary-server.key` are used to identify this service to both external clients, and signer instances. | ||
|
||
If you require a different configuration, you should wrap this image with your own Dockerfile. | ||
|
||
For more details on how to configure your Notary server, please read the[docs](https://github.com/docker/notary/blob/master/docs/notary-server-config.md). | ||
|
||
# Database Migrations | ||
|
||
Notary server uses the [migrate tool](https://github.com/mattes/migrate) to manage database updates. The migration files can be found [here](https://github.com/docker/notary/tree/master/migrations/server/mysql) and are an ordered list of plain SQL files. The migrate tool manages schema versions to ensure that migrations start and end at the correct point. You will need to create the `notaryserver` database and the `server` user. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
View [license information](https://github.com/docker/notary/blob/master/LICENSE) for the software contained in this image. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
The Notary signer is a back end signing service that supports Notary Server. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,36 @@ | ||
# What is Notary signer | ||
|
||
The Notary signer is a support service for the Notary server. It manages private keys and performs all signing operations. It requires a MySQL (or MariaDB) database. | ||
|
||
%%LOGO%% | ||
|
||
# How to use this image | ||
|
||
The following sample configuration is included in the image: | ||
|
||
{ | ||
"server": { | ||
"http_addr": ":4444", | ||
"grpc_addr": ":7899", | ||
"tls_cert_file": "/certs/notary-signer.crt", | ||
"tls_key_file": "/certs/notary-signer.key", | ||
"client_ca_file": "/certs/notary-server.crt" | ||
}, | ||
"logging": { | ||
"level": "info" | ||
}, | ||
"storage": { | ||
"backend": "mysql", | ||
"db_url": "signer@tcp(mysql:3306)/notarysigner?parseTime=True" | ||
} | ||
} | ||
|
||
The components you *must* provide are the certificates and keys, and the link for the `mysql` hostname. The `notary-server.crt` file enables the Notary signer to identify valid servers, which it communicates with over mutual TLS using a GRPC interface. The `notary-server.crt` and`notary-server.key` are used to identify this service to both external clients, and signer instances. | ||
|
||
If you require a different configuration, you should wrap this image with your own Dockerfile. | ||
|
||
For more details on how to configure your Notary signer, please read the [docs](https://github.com/docker/notary/blob/master/docs/notary-signer-config.md). | ||
|
||
# Database Migrations | ||
|
||
Notary signer uses the [migrate tool](https://github.com/mattes/migrate) to manage database updates. The migration files can be found [here](https://github.com/docker/notary/tree/master/migrations/signer/mysql) and are an ordered list of plain SQL files. The migrate tool manages schema versions to ensure that migrations start and end at the correct point. You will need to create the `notarysigner` database and the `signer` user. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
View [license information](https://github.com/docker/notary/blob/master/LICENSE) for the software contained in this image. |