Skip to content

Commit

Permalink
adding notary docs
Browse files Browse the repository at this point in the history
Signed-off-by: David Lawrence <[email protected]> (github: endophage)
  • Loading branch information
David Lawrence committed Feb 9, 2016
1 parent b7b6b86 commit 50249ea
Show file tree
Hide file tree
Showing 6 changed files with 83 additions and 0 deletions.
1 change: 1 addition & 0 deletions notary-server/README-short.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
The Notary server is a front line metadata server for the Notary client.
43 changes: 43 additions & 0 deletions notary-server/content.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
# What is Notary server

The Notary server manages JSON formatted TUF (The Update Framework) metadata for Notary clients and the docker command line tool's Docker Content Trust features. It requires a companion Notary signer instance and a MySQL (or MariaDB) database.

%%LOGO%%

# How to use this image

The following sample configuration is included in the image:

{
"server": {
"http_addr": ":4443",
"tls_key_file": "/certs/notary-server.key",
"tls_cert_file": "/certs/notary-server.crt"
},
"trust_service": {
"type": "remote",
"hostname": "notarysigner",
"port": "7899",
"tls_ca_file": "/certs/root-ca.crt",
"key_algorithm": "ecdsa",
"tls_client_cert": "/certs/notary-server.crt",
"tls_client_key": "/certs/notary-server.key"
},
"logging": {
"level": "info"
},
"storage": {
"backend": "mysql",
"db_url": "server@tcp(mysql:3306)/notaryserver?parseTime=True"
}
}

The components you *must* provide are the certificates and keys, and the links for the `notarysigner` and `mysql` hostnames. The `root-ca.crt` file enables the Notary server to identify valid signers, which it communicates with over mutual TLS using a GRPC interface. The `notary-server.crt` and`notary-server.key` are used to identify this service to both external clients, and signer instances.

If you require a different configuration, you should wrap this image with your own Dockerfile.

For more details on how to configure your Notary server, please read the[docs](https://github.com/docker/notary/blob/master/docs/notary-server-config.md).

# Database Migrations

Notary server uses the [migrate tool](https://github.com/mattes/migrate) to manage database updates. The migration files can be found [here](https://github.com/docker/notary/tree/master/migrations/server/mysql) and are an ordered list of plain SQL files. The migrate tool manages schema versions to ensure that migrations start and end at the correct point. You will need to create the `notaryserver` database and the `server` user.
1 change: 1 addition & 0 deletions notary-server/license.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
View [license information](https://github.com/docker/notary/blob/master/LICENSE) for the software contained in this image.
1 change: 1 addition & 0 deletions notary-signer/README-short.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
The Notary signer is a back end signing service that supports Notary Server.
36 changes: 36 additions & 0 deletions notary-signer/content.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# What is Notary signer

The Notary signer is a support service for the Notary server. It manages private keys and performs all signing operations. It requires a MySQL (or MariaDB) database.

%%LOGO%%

# How to use this image

The following sample configuration is included in the image:

{
"server": {
"http_addr": ":4444",
"grpc_addr": ":7899",
"tls_cert_file": "/certs/notary-signer.crt",
"tls_key_file": "/certs/notary-signer.key",
"client_ca_file": "/certs/notary-server.crt"
},
"logging": {
"level": "info"
},
"storage": {
"backend": "mysql",
"db_url": "signer@tcp(mysql:3306)/notarysigner?parseTime=True"
}
}

The components you *must* provide are the certificates and keys, and the link for the `mysql` hostname. The `notary-server.crt` file enables the Notary signer to identify valid servers, which it communicates with over mutual TLS using a GRPC interface. The `notary-server.crt` and`notary-server.key` are used to identify this service to both external clients, and signer instances.

If you require a different configuration, you should wrap this image with your own Dockerfile.

For more details on how to configure your Notary signer, please read the [docs](https://github.com/docker/notary/blob/master/docs/notary-signer-config.md).

# Database Migrations

Notary signer uses the [migrate tool](https://github.com/mattes/migrate) to manage database updates. The migration files can be found [here](https://github.com/docker/notary/tree/master/migrations/signer/mysql) and are an ordered list of plain SQL files. The migrate tool manages schema versions to ensure that migrations start and end at the correct point. You will need to create the `notarysigner` database and the `signer` user.
1 change: 1 addition & 0 deletions notary-signer/license.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
View [license information](https://github.com/docker/notary/blob/master/LICENSE) for the software contained in this image.

0 comments on commit 50249ea

Please sign in to comment.