DAT CMS

DAT CMS creates certificates, stores them in a database, and delivers the appropriate certificates to issuing and verifying services. Protocol behavior is described in the DAT CMS specification.

Create a runtime configuration

Run with Docker

Run the container as a non-root user. When using SQLite, mount a writable data directory. Pass tokens and database passwords through a secret-injection mechanism rather than command history.

docker run --rm --name dat-cms -p 8088:8088 \
  --user 10001:10001 \
  -v "$PWD/dat-cms-data:/data" \
  -e PORT=8088 \
  -e DB_URI='sqlite:/data/data.db' \
  -e TOKEN_MASTER='replace-with-a-secret' \
  -e TOKEN_CERT_FULL='replace-with-a-secret' \
  -e TOKEN_CERT_VERIFY='replace-with-a-secret' \
  sarolab/dat-cms

Database

Use DB_URI to configure a SQLite, PostgreSQL, or MySQL connection. MariaDB connects through the MySQL protocol. CMS caches certificate query results as a snapshot and continues serving the last successful snapshot when a storage refresh fails temporarily.

DB_CACHE_SECS sets the snapshot refresh interval, while DB_QUERY_TIMEOUT_SECS limits refresh queries. If no successful snapshot exists and storage cannot be read, the service returns DAT_STORE_UNAVAILABLE.

Access roles

Each variable accepts comma-separated alphanumeric tokens. If a role's token list is empty, that role's endpoints are opened and a warning is logged.

Certificate generation

The master role registers a certificate by specifying the signature algorithm, encryption algorithm, propagation delay, issuance period, and TTL. During the propagation delay, services synchronize the new certificate before it becomes issuable.

Client integration

1. Use the full token and full-certificate endpoint for issuing services.
2. Use the verify token and verify-only option for verifying services.
3. Check the result of the first synchronization; if startup must fail, call the immediate synchronization API.
4. When automatic synchronization is enabled, close the manager during application shutdown.

See the library guides for each language's builder and shutdown behavior.

Operational checks

• /health and /version/api report status without authentication.
• /version requires the master token when that role is configured.
• Collect logs from standard output and standard error.
• Forward shutdown signals and allow time for the database and scheduler to close.

Kubernetes

Match the container port and probes to the service port, and mount the data directory with write access for the non-root user. Inject tokens and database connection details through Secrets.

securityContext:
  runAsNonRoot: true
  runAsUser: 10001
  runAsGroup: 10001
containers:
  - name: dat-cms
    image: sarolab/dat-cms
    ports: [{ containerPort: 8088 }]
    readinessProbe: { httpGet: { path: /health, port: 8088 } }
    livenessProbe: { httpGet: { path: /health, port: 8088 } }