Configuration Properties
Secure Keystore uses the following public configuration properties. They are read from application.properties and can be overridden by environment variables.
Environment File
Copy .env.example to .env for local development (throw-away values only; .env is git-ignored). .env is used by Docker, the Liquibase CLI and the shell. The IntelliJ run configuration in .run/ reads local.env instead (also git-ignored), so put the same values there.
Database Configuration
| Property | Environment Variable | Default | Note |
|---|---|---|---|
spring.datasource.url |
SECURE_KEYSTORE_DATASOURCE_URL |
jdbc:postgresql://localhost:5432/secure_keystore |
Database JDBC URL |
spring.datasource.username |
SECURE_KEYSTORE_DATASOURCE_USERNAME |
secure_keystore |
Database user |
spring.datasource.password |
SECURE_KEYSTORE_DATASOURCE_PASSWORD |
_empty_ |
Database password; set it in every non-local environment |
spring.datasource.hikari.auto-commit |
false |
Connection pool auto-commit | |
spring.datasource.hikari.pool-name |
HikariPool-Secure-Keystore |
Connection pool name |
The password has no default on purpose. Set it in every environment.
Migrations are not applied automatically; the application never migrates the database. See Database Setup.
A local PostgreSQL for development, published on the loopback interface only. Use the password you chose in .env:
set -a; source .env; set +a
docker run --name secure-keystore-db -p 127.0.0.1:5432:5432 -e POSTGRES_USER=secure_keystore -e POSTGRES_PASSWORD="$SECURE_KEYSTORE_DATASOURCE_PASSWORD" -e POSTGRES_DB=secure_keystore -d postgres:16
Application Configuration
| Property | Default | Note |
|---|---|---|
spring.application.name |
secure-keystore |
Application name |
Actuator Configuration
| Property | Default | Note |
|---|---|---|
management.endpoints.web.exposure.include |
health,info |
Only health and info are exposed |
management.endpoint.health.show-details |
never |
Health details are hidden |
management.info.git.enabled |
false |
Git information is off |
See Monitoring.
HSM Variables
The SoftHSM2 variables (KEYSTORE_HSM_PIN, KEYSTORE_HSM_SHARED_PIN, KEYSTORE_HSM_SO_PIN, KEYSTORE_HSM_LIBRARY, SOFTHSM2_CONF, KEYSTORE_TEST_TRUST_ANCHOR, KEYSTORE_HSM_PROVIDER_CA_SHA256) are described in SoftHSM2 Development Setup.
Planned Keystore Configuration
Target design. These properties are referenced by the REST API and the HSM setup but are not implemented yet; the service does not read them. Names and defaults may change.
| Property | Default | Note |
|---|---|---|
keystore.hsm.enabled |
true |
Whether the service uses the HSM. The Docker image has no PKCS#11 library, so it runs with false. See Docker Deployment. |
keystore.hsm.environment |
dev |
The <env> part of the token names keystore-<env>-<purpose>, for example dev or prod; 1 to 8 lowercase letters and digits. See Tokens. |
keystore.api.allowed-hosts |
localhost,127.0.0.1 |
Accepted Host header values. Any other host is 400 invalid_request. |
keystore.api.allowed-origins |
http://localhost:8080,http://127.0.0.1:8080 |
Accepted Origin header values. Any other origin is 400 invalid_request. |
keystore.api.max-body-size |
96KB |
Maximum request body. On the encrypted endpoints it applies to the encrypted body. |
keystore.api.retry-after |
5s |
A duration, sent in Retry-After on 503 responses as whole seconds (at least 1). |
keystore.keys.max-count |
16 |
Maximum keyCount of one credential-keys request (at most 16). |
keystore.eudi.wia.issuer |
none | Required. The iss claim of every wallet instance attestation, an absolute https URL of the wallet provider. |
keystore.backend.domains.<domain> |
A backend domain: its storage mode (RESIDENT or WRAPPED), accepted key types and generations. See Backend Keys API. |
|
keystore.backend.clients.<id> |
A backend client: the SHA-256 of its bearer token, its domains, and whether it may register and revoke units. |
Profiles
Profiles are not active by default.
| Profile | Effect |
|---|---|
dev |
Sets only the datasource URL (still overridable by SECURE_KEYSTORE_DATASOURCE_URL, falling back to local PostgreSQL) and the console logging configuration (logback-dev.xml). Changes nothing security-related. |
test |
Uses an in-memory H2 database in tests, so tests need no database. |