DAT CMS

DAT CMS creates certificates, stores them in a database, and delivers the appropriate certificates to issuing and verifying services. Protocol behavior is described in the DAT CMS specification.

Create a runtime configuration

Run with Docker

Docker and Podman always use port 80 inside the container; publish a host port with -p 8088:80. PORT applies only to standalone binaries (default 8088). Run the container as a non-root user. When using SQLite, mount a writable data directory. Pass tokens and database passwords through a secret-injection mechanism rather than command history.

docker run --rm --name dat-cms -p 8088:80 \
  --user 10001:10001 \
  -v "$PWD/dat-cms-data:/data" \
  -e DB_URI='sqlite:/data/data.db' \
  -e TOKEN_MASTER='replace-with-a-secret' \
  -e TOKEN_CERT_FULL='replace-with-a-secret' \
  -e TOKEN_CERT_VERIFY='replace-with-a-secret' \
  sarolab/dat-cms:4.7.1

Database

Use DB_URI to configure a SQLite, PostgreSQL, or MySQL connection. MariaDB connects through the MySQL protocol. CMS caches certificate query results as a snapshot and continues serving the last successful snapshot when a storage refresh fails temporarily.

DB_CACHE_SECS sets the snapshot refresh interval, while DB_QUERY_TIMEOUT_SECS limits refresh queries. If no successful snapshot exists and storage cannot be read, the service returns DAT_STORE_UNAVAILABLE.

Access roles

Each variable accepts comma-separated alphanumeric tokens. If a role's token list is empty, that role's endpoints are opened and a warning is logged.

Certificate generation

The master role registers a certificate by specifying the signature algorithm, encryption algorithm, propagation delay, issuance period, and TTL. During the propagation delay, services synchronize the new certificate before it becomes issuable.

Client integration

1. Use the full token and full-certificate endpoint for issuing services.
2. Use the verify token and verify-only option for verifying services.
3. Check the result of the first synchronization; if startup must fail, call the immediate synchronization API.
4. When automatic synchronization is enabled, close the manager during application shutdown.

See the library guides for each language's builder and shutdown behavior.

Operational checks

• /health and /version/api report status without authentication.
• /version requires the master token when that role is configured.
• Collect logs from standard output and standard error.
• Forward shutdown signals and allow time for the database and scheduler to close.

Kubernetes

Keep the container port, probes, and Service targetPort at 80. Change the client-facing port through Service port. Grant NET_BIND_SERVICE for non-root binding to port 80. Mount a data directory writable by the non-root user and inject tokens and database credentials through Secrets.

securityContext:
  runAsNonRoot: true
  runAsUser: 10001
  runAsGroup: 10001
containers:
  - name: dat-cms
    image: sarolab/dat-cms:4.7.1
    securityContext:
      capabilities:
        drop: ["ALL"]
        add: ["NET_BIND_SERVICE"]
    ports: [{ containerPort: 80 }]
    readinessProbe: { httpGet: { path: /health, port: 80 } }
    livenessProbe: { httpGet: { path: /health, port: 80 } }