Configure

TL;DR

• The Signing Agent Docker image references a configuration file, config.yaml.
• You can download a template for it from GitHub: config-template.yaml.

Configuration options

The following settings are configurable via the YAML file:

• Base
• Auto approval
• Qredo WebSocket
• HTTP
• Logging
• Load balancing
• Store

• Learn more about setting up cloud storage of secrets.

Configuration properties

Customize the properties of config.yaml to suit your needs.

The following table presents each property.

Example configuration values

Cloud secret storage

An alternative to storing the Signing Agent configuration on-premises in a file is to use secure cloud-based storage. The following cloud-based solutions are supported.

Oracle Cloud Vault Storage

In order to use Oracle Cloud Vault storage, update your configuration storage setting, i.e. set the store type to oci in the YAML configuration file.

For example, your YAML config should look something like the following:

store:
  oci:
    vault: ocid1.vault....
    secretEncryptionKey: ocid1.key....
    compartment: ocid1.tenancy....
    configSecret: signing_agent_config
  ...
 Copy

• Set up an API key on Oracle Cloud
• Download the config file for the API key, fill in the correct private key path
• Either put the file in its default location of ~/.oci/config or put it in a custom location and set env var OCI_CONFIG_FILE to the full path including the filename
• Create a vault and copy the OCID to the config file for the vault setting
• Create an encryption key (AES or RSA) in the vault, copy it's OCID to the config secretEncryptionKey setting
• Copy the compartment OCID from the compartment where the vault was created
• Set a secret name where the Signing Agent will store its configuration and keys
• Start the Signing Agent and register an agent using the API

AWS Cloud Secrets Manager Storage

In order to use AWS for configuration storage, update your configuration storage setting, i.e. set the storage_type to aws and provide the AWS Region and the name of the Secrets Manager secret in the YAML configuration file.

For example, your YAML config should look something like the following:

store:
  aws:
    region: eu-west-2
    configSecret: signingAgentConfig
  ...
 Copy

The Secrets Manager secret (i.e. signAgentConfig in this example) needs to be set up in advance. To do this, on the AWS console:

1. Create a KMS customer-managed key to be used to encrypt the Secrets Manager secret
2. Create the Secrets Manager secret, naming it and including the KMS key from step 1
   • Select Other type of secret
   • Select Plaintext and enter initialise me
   • From the Encryption key drop-down, select the key created in step 1
   • Name the secret and optionally add a description
3. Update the Signing Agent's configuration file with the AWS region and secret name

Start the Signing Agent and register the agent using the API.

• Starting the Agent converts the secret's type from plaintext to binary.

Note: the Signing Agent needs access to AWS credentials in order to use AWS' Secrets Manager. How you do this is dependent on your requirements (for instance, the use of AWS access keys or an AWS credentials file, etc.) but, importantly, if running the Signing Agent in a Docker container, the AWS credentials need to be available to the Agent running in the container. This requires passing the AWS credential data to Docker at startup. As an example, AWS access keys can be passed as environment variables:

> docker run -e AWS_ACCESS_KEY=$AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY ...
 Copy

or, if using an AWS credential data contained in a local directory, something like this:

> docker run -v $HOME/.aws:/root/.aws ...
 Copy

Specifics are best discussed with your cloud services admin department.

Config Gottchas

HTTP/TLS

If you wish to configure the TLS settings, you must supply the certFile and keyFile to setup HTTPS.