Discrete Services Deployment
By default, PowerAuth Cloud is deployed as a single Docker image (see the Installation chapter) that bundles the PowerAuth Cloud Connector, PowerAuth Server, PowerAuth Push Server, and Enrollment Server together.
In some deployments, only the component that is meant to be called from the public internet (Enrollment Server, accessed by mobile applications) should be exposed in a separate network zone, such as a DMZ, while PAC (PowerAuth Cloud Connector, PowerAuth Server, and PowerAuth Push Server) stays in the internal network. This chapter describes how to deploy PAC and Enrollment Server as two separate components.
Deploy PAC
Deploy PAC the same way as described in the Installation chapter.
Enrollment Server needs to call the PowerAuth Server and PowerAuth Push Server REST APIs, which by default are only reachable from inside the PAC container. To make them reachable from the standalone Enrollment Server, publish the internal Tomcat port 8080 in addition to the standard port 8000:
docker run --env-file env.list -d -it \
-p 8000:8000 \
-p 8080:8080 \
--name=powerauth-cloud wultra.jfrog.io/wultra-docker/powerauth-cloud:${VERSION}
Port 8080 Exposes All Internal Components
PowerAuth Server, PowerAuth Push Server, and the PowerAuth Cloud Connector are all deployed to the same Tomcat instance and are all reachable through port 8080 (nginx, listening on port 8000, only forwards selected paths, but this does not restrict what is reachable when the Tomcat port itself is published). The Connector remains protected by its own authentication (POWERAUTH_CLOUD_SECURITY_AUTH_TYPE), but port 8080 must still not be published to the public internet - only allow access to it from the network segment where Enrollment Server is deployed (e.g. using firewall rules or a private network).
Deploy Enrollment Server
Enrollment Server is deployed as its own Docker image.
Pull the Docker Image
docker pull powerauth/enrollment-server:${VERSION}
The Enrollment Server version must match the version of Enrollment Server bundled inside the PAC container, not necessarily the PAC version itself - the bundled Enrollment Server can be a lower version than PAC. Check the bundled version by calling the /enrollment-server endpoint of the running PAC container. See the PowerAuth Cloud documentation and the Enrollment Server documentation (use the version dropdown to pick a release) for details.
Configure the Docker Image
Prepare the env.list file for the Enrollment Server container.
Point Enrollment Server to the PowerAuth Server and PowerAuth Push Server REST APIs published by PAC in the previous step:
ENROLLMENT_SERVER_POWERAUTH_SERVICE_URL=http://<pac-host>:8080/powerauth-java-server/rest
ENROLLMENT_SERVER_PUSH_SERVICE_URL=http://<pac-host>:8080/powerauth-push-server
Replace <pac-host> with the host name or IP address where the PAC container is reachable from Enrollment Server.
If Powerauth Server has restricted access enabled (POWERAUTH_SERVER_RESTRICT_ACCESS=true), also configure the credentials:
ENROLLMENT_SERVER_POWERAUTH_SERVICE_SECURITY_CLIENT_TOKEN=
ENROLLMENT_SERVER_POWERAUTH_SERVICE_SECURITY_CLIENT_SECRET=
Enrollment Server must use the same database as PAC. The database schema for Enrollment Server is already created by PAC (or by the init container), so no additional Liquibase setup is required.
ENROLLMENT_SERVER_DATASOURCE_URL=jdbc:postgresql://<db-host>:5432/powerauth
ENROLLMENT_SERVER_DATASOURCE_USERNAME=$USERNAME$
ENROLLMENT_SERVER_DATASOURCE_PASSWORD=$PASSWORD$
See the Enrollment Server section in Configuration Properties for the full list of ENROLLMENT_SERVER_* environment variables.
Start the Docker Container
docker run --env-file env.list -d -it -p 8080:8080 \
--name=enrollment-server powerauth/enrollment-server:${VERSION}
Publish only the Enrollment Server container to the public internet. PAC (the PowerAuth Cloud Connector, PowerAuth Server, and PowerAuth Push Server) must stay in the internal network.
You can now open http://localhost:8080/enrollment-server/ to verify that Enrollment Server is running.