diff --git a/notary-server/README-short.txt b/notary-server/README-short.txt new file mode 100644 index 0000000000000..dc2f30bf63c4d --- /dev/null +++ b/notary-server/README-short.txt @@ -0,0 +1 @@ +The Notary server is a front line metadata server for the Notary client. diff --git a/notary-server/content.md b/notary-server/content.md new file mode 100644 index 0000000000000..749fa2997276c --- /dev/null +++ b/notary-server/content.md @@ -0,0 +1,43 @@ +# What is Notary server + +The Notary server manages JSON formatted TUF (The Update Framework) metadata for Notary clients and the docker command line tool's Docker Content Trust features. It requires a companion Notary signer instance and a MySQL (or MariaDB) database. + +%%LOGO%% + +# How to use this image + +The following sample configuration is included in the image: + + { + "server": { + "http_addr": ":4443", + "tls_key_file": "/certs/notary-server.key", + "tls_cert_file": "/certs/notary-server.crt" + }, + "trust_service": { + "type": "remote", + "hostname": "notarysigner", + "port": "7899", + "tls_ca_file": "/certs/root-ca.crt", + "key_algorithm": "ecdsa", + "tls_client_cert": "/certs/notary-server.crt", + "tls_client_key": "/certs/notary-server.key" + }, + "logging": { + "level": "info" + }, + "storage": { + "backend": "mysql", + "db_url": "server@tcp(mysql:3306)/notaryserver?parseTime=True" + } + } + +The components you *must* provide are the certificates and keys, and the links for the `notarysigner` and `mysql` hostnames. The `root-ca.crt` file enables the Notary server to identify valid signers, which it communicates with over mutual TLS using a GRPC interface. The `notary-server.crt` and`notary-server.key` are used to identify this service to both external clients, and signer instances. + +If you require a different configuration, you should wrap this image with your own Dockerfile. + +For more details on how to configure your Notary server, please read the[docs](https://github.com/docker/notary/blob/master/docs/notary-server-config.md). + +# Database Migrations + +Notary server uses the [migrate tool](https://github.com/mattes/migrate) to manage database updates. The migration files can be found [here](https://github.com/docker/notary/tree/master/migrations/server/mysql) and are an ordered list of plain SQL files. The migrate tool manages schema versions to ensure that migrations start and end at the correct point. You will need to create the `notaryserver` database and the `server` user. diff --git a/notary-server/license.md b/notary-server/license.md new file mode 100644 index 0000000000000..393d3ac8a2ad6 --- /dev/null +++ b/notary-server/license.md @@ -0,0 +1 @@ +View [license information](https://github.com/docker/notary/blob/master/LICENSE) for the software contained in this image. diff --git a/notary-signer/README-short.txt b/notary-signer/README-short.txt new file mode 100644 index 0000000000000..0cabae0049446 --- /dev/null +++ b/notary-signer/README-short.txt @@ -0,0 +1 @@ +The Notary signer is a back end signing service that supports Notary Server. diff --git a/notary-signer/content.md b/notary-signer/content.md new file mode 100644 index 0000000000000..7cae4fd5e079c --- /dev/null +++ b/notary-signer/content.md @@ -0,0 +1,36 @@ +# What is Notary signer + +The Notary signer is a support service for the Notary server. It manages private keys and performs all signing operations. It requires a MySQL (or MariaDB) database. + +%%LOGO%% + +# How to use this image + +The following sample configuration is included in the image: + + { + "server": { + "http_addr": ":4444", + "grpc_addr": ":7899", + "tls_cert_file": "/certs/notary-signer.crt", + "tls_key_file": "/certs/notary-signer.key", + "client_ca_file": "/certs/notary-server.crt" + }, + "logging": { + "level": "info" + }, + "storage": { + "backend": "mysql", + "db_url": "signer@tcp(mysql:3306)/notarysigner?parseTime=True" + } + } + +The components you *must* provide are the certificates and keys, and the link for the `mysql` hostname. The `notary-server.crt` file enables the Notary signer to identify valid servers, which it communicates with over mutual TLS using a GRPC interface. The `notary-server.crt` and`notary-server.key` are used to identify this service to both external clients, and signer instances. + +If you require a different configuration, you should wrap this image with your own Dockerfile. + +For more details on how to configure your Notary signer, please read the [docs](https://github.com/docker/notary/blob/master/docs/notary-signer-config.md). + +# Database Migrations + +Notary signer uses the [migrate tool](https://github.com/mattes/migrate) to manage database updates. The migration files can be found [here](https://github.com/docker/notary/tree/master/migrations/signer/mysql) and are an ordered list of plain SQL files. The migrate tool manages schema versions to ensure that migrations start and end at the correct point. You will need to create the `notarysigner` database and the `signer` user. diff --git a/notary-signer/license.md b/notary-signer/license.md new file mode 100644 index 0000000000000..393d3ac8a2ad6 --- /dev/null +++ b/notary-signer/license.md @@ -0,0 +1 @@ +View [license information](https://github.com/docker/notary/blob/master/LICENSE) for the software contained in this image.