Cordite Network Map

Tutorials

“Fly me to the moon …”

Running the Cordite NMS using Docker

Starting up the Cordite NMS is very easy when using Docker:

$ docker run -e NMS_TLS=false -p 8080:8080 cordite/network-map

The service will run on http://localhost:8080. You can use this in your node.conf:

myLegalName="CN=cordite foundation, O=cordite.foundation, L=Antarctica, C=AQ"
p2pAddress="localhost:10005"
rpcSettings {
    address="localhost:10006"
    adminAddress="localhost:10046"
}
rpcUsers=[]
devMode : false
keyStorePassword : "cordacadevpass"
trustStorePassword : "trustpass"
compatibilityZoneURL : "http://localhost:8080"

The service will, by default, enable the doorman and certman protocols.

You can provide your own TLS certificate and key for the service using:

$ docker run 
-e NMS_TLS_CERT_PATH=<your-cert-path> 
-e NMS_TLS_KEY_PATH=<your-key-path> 
-p 8080:8080 cordite/network-map

Managing notaries and the whitelist

The Cordite NMS is designed to be simple to setup and maintain on commodity cloud hardware. One design choice is that its database is a simple filesystem. The location of the database is configurable (see Appendix A). Here’s the top level structure of the directory — note the inputs directory:

The inputs directory contains the whitelist.txt file required for zone constraints in Corda 3 and the validating and non-validating notary nodeInfo-* files. You alter these files directly at run-time. The NMS will watch the inputs directory for changes and will periodically publish changes to this directory as a network parameter update.

You can also use the Swagger API hosted on /swagger/.

Finally, most (but not all) of the API is exposed in the NMS user interface.

Working with CertMan

Let’s say, as a node operator, you have a certificate and private key stored in the files domain.crt and domain.key respectively. We can receive our node’s JKS files using the following command line:

openssl dgst -sha256 -sign domain.key domain.crt | 
base64 | 
cat domain.crt - | 
curl -k -X POST -d @- http://<network-map-host-and-port>/certman/api/generate -o keys.zip

Here we sign our public certificate with our private key and concatenate the certificate and signature as a payload to the API end-point /certman/api/generate. The returned zip file will contain the three jks files required by Corda. Unzip these into the Corda certificates directory and you’re good to go.

The certificate that’s presented to CertMan will be checked against the default set of root certificate authorities shipped with the JRE. If you’re not happy with this set, you can specify your own set of trusted authorities using NMS_CERTMAN_TRUSTSTORE and NMS_CERTMAN_TRUSTSTORE_PASSWORD. You can also control PKIX verification using NMS_CERTMAN_PKIX and whether strict EV certificates are required using NMS_CERTMAN_STRICT_EV.

What’s next?

We encourage the community to try it out and provide feedback! The source is Apache Licence v2 and we very much encourage contributions 🙂

Appendix A: Configuration parameters

Here’s the full list of system properties and environment variables you can use to control your instance.