Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
The Indicio TestNet is a free to use community resource built on the open-source technology of Hyperledger Indy, Aries and Ursa. It provides a neutral, independent, and reliable decentralized network for the exchange of verifiable credentials.
Combine the TestNet with optional support from our team of experienced engineers, and you’ll have everything you need to start building on a network you can depend on!
To begin using the TestNet, follow these steps:
Create a public DID (decentralized identifier). This can be done with the indy-cli, with the Aries Toolbox, an app of your choice, or by following these instructions.
Then, click here to get the DID written to the TestNet.
Using a decentralized network provides a layer of cryptographic trust and a source of truth for your solutions. Through cryptography and metadata you can always be sure on who issued a credential and that the information has not been tampered with. No personal data is ever written to the ledger.
Decentralized networks remove the need for personal data to be stored in siloed databases. In doing this, they provide a simple way to comply with data privacy law and remove the risk from data being stored in third-party databases.
The Indicio MainNet provides a home for your solutions no matter your use case, industry, or organization type. Our architects and engineers have years of experience and are standing by to help you build and deploy your solution on our world renowned network.
Indicio has three public networks you can use for your solutions the MainNet, DemoNet, and TestNet. We also provide private networks for internal testing or development – reach out to ask us more about a private network.
Our professionally managed network ensures you have a dependable, stable place to build mission critical products and services. Over the last four years we have had 100% uptime across all three networks.
Indicio has nodes across five continents, providing a robust decentralized network you can rely on. Learn more about hosting a node and joining the Indicio Network Consortium.
No personal data is ever written to a distributed network. The end user holds and has full control over their data, including who they share it with and how it is shared. Decentralized networks replace storing personal data in risky siloed or third-party databases. They provide a simple way for you to comply with evolving data privacy laws.
Become a Transaction Endoser to start writing to the MainNet today. Complete the
A private network refers to a network that requires permission to use. These “permissioned” networks allow companies or organizations with shared and specific interests and goals to provide verifiable information to their customers or stakeholders. You could, for example, use a private network for managing a supply chain, a government may want to control a private network for a particular purpose, or someone could spin up a private network to conduct specific testing.
Private networks gain power through using interoperable agents. This means that credentials created for use on one private network could have the option to also be verified on other networks, whether public or private. This creates a “network-of-networks effect,” and ensures long-term business flexibility.
Make your network for your own use. Governments, scientists, financial institutions, enterprise services, and specialized groups and services need to have control over where the network is hosted, which organizations are part of their network, who can write to the ledger, and how the network is governed. With our customizable Private Network Services, you can have this control.
We’ll get your network up and running in days. We understand the importance of being agile in today’s market and we’ve assembled an industry-leading team of engineers who will set up your network quickly and efficiently. We have your service support and advice—every step of the way.
With a private network, you can start building and testing your Trusted Data Ecosystem before deploying them in public. You get to understand the the innovative from the inside. Set up the governance that meets your and your customers’ needs.
You want your network to be private; trust us, you also need it to be interoperable. on Hyperledger Indy, the most widely used interoperable platform for decentralized identity. We give you the added functionality and business flexibility that a stand-alone network can’t provide.
The Indicio DemoNet uses the open-source technology of Hyperledger Indy, Aries and Ursa to provide a stable network platform for demonstrating your decentralized identity solution.
Combined with access to our team of experienced engineers, you’ll have the hands-on support you need to showcase your innovation.
It’s easy to start using the Indicio DemoNet, just follow these steps:
Create a public DID (decentralized identifier). This can be done with the , with the , or by .
After you create your public DID complete this form. Select “DemoNet” from the dropdown to get your DID written to the Network.
Our expertly managed network provides you with a reliable and consistent environment to develop mission-critical products and services. Boasting an impressive track record of 100% uptime across the networks over the past four years, you can count on our dedicated network professionals.
Indicio’s team of industry professionals have years of experience working with decentralized identity and delivering solutions that are in use around the world. They can help you migrate an existing project or start a new one and ensure you have everything you need to succeed.
With strategically positioned nodes Indicio provides an unparalleled decentralized network that both meets and elevates your ambitions with steadfast reliability. Unlock even greater advantages by becoming a Node Operator.
Elevate your business with networks designed to grow alongside you, seamlessly accommodating the needs of organizations and solutions of all sizes and sectors. Take advantage of our TestNet and DemoNet at no cost
By embracing decentralized networks, you significantly reduce the risks tied to storing personal data in vulnerable siloed environments or third-party databases. This approach fortifies your data protection and streamlines your ability to stay compliant with the ever-evolving landscape of data privacy regulations.
Indicio runs three public networks, the MainNet for hosting your solutions, the DemoNet for demoing solutions, and the TestNet for building your solutions. We also provide private networks for internal development. The TestNet and DemoNet are free to use and, if you’re a Node Operator, include free support.
Step-by-step guides and tutorials to help you launch, integrate, and scale with Indicio Proven
Indicio Proven is built to make decentralized identity simple, secure, and practical. Whether you're a business leader, developer, or solution architect, our getting started resources give you the tools to move fast and build with confidence.
This document will guide you through the steps to deploy and configure the Proven Mediator in Google Cloud using Indicio Proven ACA-Py Mediator from the GC Marketplace. The first part of this document is intended to be a “quick start” to get you up and running quickly, then you can look at the indicated appendices for more details if needed.
Get the most of your Indicio Proven ACA-Py Mediator
Indicio is here to help you on every step of your journey and is offering Google Cloud customers exclusive access and discounts to Indicio's expert support and training. Get your critical technical questions answered from our experienced support team. Help your development, sales, and marketing teams get up to speed with the fundamentals of the technology and communication of Trusted Digital Ecosystems by taking advantage of our instructor-led workshops and certifications from the Indicio Academy. Learn more about these exclusive discounts and benefits for Google Cloud customers and contact us today!
You will need a DNS name for your new mediator. This is mentioned before you begin as informational because you will probably want to create a static IP address during the installation process and because you will need the ability to add the DNS name to your registrar.
Navigate to the Google Cloud Console,
Select or create the project that you want the Mediator instance to reside in.
In the Navigation Menu (top left), go to Compute Engine > VM Instances
Click CREATE INSTANCE on the top bar
Add a DNS entry for your new mediator.
SSH into the VM
From Compute Engine > VM instances > [instance name] click SSH towards the top of the screen
Change directories to the mediator service directory cd /opt/indicio/aries-mediator-service
MEDIATOR_CONTROLLER_ADMIN_API_KEY=<your choice>
You can generate strong tokens for production with OpenSSL: openssl rand 32 -hex
MEDIATOR_AGENT_ADMIN_API_KEY=<your choice>
You can generate strong tokens for production with OpenSSL: openssl rand 32 -hex
MEDIATOR_ALIAS=
Can be any string. (e.g. MyProdMediator1)
LOG_LEVEL=
Can be ERROR, WARNING, or INFO, depending on your preference. Note: INFO level produces the largest log file.
SITE_ADDRESS=
This is the complete mediator DNS Name you configured in a previous step.
MEDIATOR_URL=
This is the same as SITE_ADDRESS, except add https:// to the front of it.
EMAIL_ADDRESS=
The email you want log information sent to.
MEDIATOR_AGENT_LABEL=
This is what you want the mediator name to show up as on other agents.
Here is an example of a configured .env file using a local database: MEDIATOR_CONTROLLER_ADMIN_API_KEY=openssl-secure-key-a<br> MEDIATOR_AGENT_ADMIN_API_KEY=openssl-secure-key-b<br> MEDIATOR_ALIAS=Indicio Mediator<br> LOG_LEVEL=WARNING<br> SITE_ADDRESS=indiciomediator.dev.indiciotech.io<br> MEDIATOR_URL=https://indiciomediator.dev.indiciotech.io<br> EMAIL_ADDRESS=example@indicio.tech<br> MEDIATOR_AGENT_LABEL=IndicioMediator
For instructions or help configuring the mediator to use a remote database, please contact support@indicio.tech, but to get started, please see the complete list of other possible config options in Appendix B.
To start the Mediator, run these commands
For future starts/stops of your mediator you can use the mediator service. (The first time, you needed to run it manually from the command line so that you could see and copy the invitation as described in the next step.)
sudo systemctl start mediator
sudo systemctl stop mediator
sudo systemctl restart mediator
You should see an Invitation URL in the mess of activity that occurs during startup. Just scroll up a ways and you will see it. Copy and save this invitation for later use.
If you open the mediator link generated, you should see the following message:
"You have received a connection invitation. To accept the invitation, paste it into your agent application."
Update the configuration files of your agents to use the new mediator invitation. For example, to update a Proven issuer to use your new mediator:
To setup DNS for your new Mediator on Google’s Cloud DNS, (by creating a new subdomain of your existing domain) do the following:
Go to GCP’s Cloud DNS section in Network services (Navigation Menu > Networking > Network Services > Cloud DNS)
Click Create Zone if a new Zone is desired. Otherwise, if a zone is already created, click on the zone name then skip to step 3.
Give the zone a name. This name is just how it will appear in the list and need not necessarily match the new subdomain.
CA_CERT=
This is the path to the SSL certificate for the remote database. You MUST specify a file, otherwise the mediator will not work at all if using a remote database. If you do not wish to use a certificate (they will not work with the setup detailed in this documentation), you will need to specify an empty file. Example: ./server-ca.pem
POSTGRESQL_HOST=
The hostname or ip address of the remote database. IP address will not work if you are using SSL, as SSL requires a FQDN. Postgresql options should not be set if using a local database.
POSTGRESQL_USER=
The username of an account on the remote database. This can be the same user as the Admin User. Postgresql options should not be set if using a local database.
POSTGRESQL_PASSWORD=
The password to the account on the remote database instance. MUST BE IN SINGLE QUOTES (eg: ‘samplepassword’) Postgresql options should not be set if using a local database.
POSTGRESQL_ADMIN_USER=
This is the username for the Administrator account on the remote database. It is “postgres” by default. Postgresql options should not be set if using a local database.
POSTGRESQL_ADMIN_PASSWORD=
This is the password for the Administrator account on the remote database. Postgresql options should not be set if using a local database.
MEDIATOR_WALLET_NAME=
Use a descriptive name
MEDIATOR_WALLET_KEY=
Use a secure string, we recommend a randomly generated 32 character string
This document will guide you through the steps to deploy and configure Proven in Google Cloud using Indicio Proven from the GC Marketplace. The first part of this document is intended to be a “quick start” to get you up and running quickly, then you can look at the indicated appendices for more details if needed.
Navigate to the Google Cloud Console,
Select the project that you want the Proven instance to reside in.
In the Navigation Menu (top left), go to Compute Engine > VM Instances
From the left menu select Marketplace.
In the Search Marketplace field type Proven and hit enter.
Select Indicio Proven ACA-Py Mediator.
Click GET STARTED then AGREE (as needed)
Click DEPLOY (or LAUNCH) to configure your mediator VM.
Change the Deployment name if desired.
Select and Record your Zone choice for later use.
Under Machine type choose a machine with at least 2 vCPU’s and 2G memory. For example:
Set Series to E2
Set Machine type to e2-small
Under Boot Disk it is recommended to select a disk at least 10GB in size. (default)
Under Networking -> External IP set a static IP address (recommended), this can also be done later if desired.
Click DEPLOY.
After deployment is complete, do the following from the right panel:
Note the link for instructions for creating a static IP address if needed (on the right under “Suggested next steps”)
Click on the instance name to bring up details about the Mediator instance you just deployed
Click “edit”
Scroll down to Networking and under Network interfaces -> Firewalls check the boxes that will allow HTTP and HTTPS traffic.
Click SAVE
Click VM instances
Record the External IP address of your Mediator instance for later use. \
sudo cp .env.sample .envEdit the .env file to fit your environment:
In the /opt/indicio/proven-release-docker/common-services.yml file change all instances of MEDIATOR_INVITE to be the new mediator invitation. Then run the following commands on the Proven Issuer server.
docker-compose down -v
docker-compose build
docker-compose up
Click Create
To “activate” this new subdomain in GC, you need to register the subdomain in your existing domain (i.e. at your registrar).
Click the name of the new zone you just created.
Click on REGISTRAR SETUP (upper right of the screen) to find the items needing added to the new NS record, then add the domain’s DNS Name Server entries to your registrar.
Click Add Standard
Create a DNS Name for proven and record it for later use (e.g. mediator.dev.indiciotech.io)
Defaults are ok
Set the “IPv4 Address” to the “External IP address” of the VM you created earlier.
Click “Create”
cd /opt/indicio/aries-mediator-service
sudo docker-compose upIf it’s a new project, click “Enable”
Click CREATE INSTANCE
From the left menu select “Marketplace”.
In the “Search Marketplace” field type “Proven” and hit enter.
Select “Indicio Proven”.
Click GET STARTED to configure your Proven VM as a trial, or click LAUNCH if you have already done the trial.
If a trial, agree to the agreements then click DEPLOY.
For new projects, click “Enable” to enable the required APIs.
Change the Deployment name if desired. This will be the name of your VM instance.
Select and record your Zone choice for later use.
For Machine type choose a machine with at least 2 vCPU’s and 4G memory. For example, these defaults should be adequate:
Set Series to E2
Set Machine type to e2-medium
Under Boot disk it is recommended to select a disk at least 50GB in size. (default)
You can set a static IP address later if desired. It is not available for change at this phase unless you have already pre-configured a static IP for use here. (This can be accomplished by creating a static external IP in your default VPC in a separate tab.)
Scroll to the bottom, check the box to accept the terms of service, then click DEPLOY.
After deployment is complete:
Note the link for instructions for creating a static IP address if needed (on the right under “Suggested next steps”)
In the right panel - Click on the instance name to bring up details about the Proven instance you just deployed
Click EDIT
Scroll down to Networking and under Firewalls check the boxes that will allow HTTP and HTTPS traffic.
Click SAVE
Click VM instances (in the left menu)
Record the External IP address of your Proven instance for later use.
Add a DNS entry for Proven.
Navigate back to the Google Cloud console
SSH into the VM 1. Select Compute engine > VM instances Then for [your-proven-instance] click SSH
Enter these commands in your instance to make it so that the “proven.service” starts up automatically after every server reboot.
cd /opt/indicio/proven-release-docker
sudo systemctl enable provenRun this command for Proven.
sudo cp staging.env .envRun the command ip a and record the private ip address of your primary network interface (ens4). This local IP address will be used in the next step.
Edit the .env file to fit your environment. -> sudo vim .env
Shown below are the minimal fields needing configured, their default values, and short descriptions. The remaining fields are described in Appendix B.
PROVEN_ISSUER_SERVER_NAME=proven.dev.indiciotech.io Use your DNS entry or the IP address for the issuer. Do not include “http://” or a trailing slash
PROVEN_ISSUER_SEED= Must be 32 alphanumeric characters. Has to have “--seed “ at the start. If you do not have a seed, you may leave this blank if this is a testing environment and if blank make sure to perform step 7. For a production environment, see Appendix D.
TAILS_URL=http://10.128.15.205:6543 Replace the IP address on this line with your local IP address. Leave the port as 6543.
NODE_ENV=production
PROVEN_ISSUER_API_DB_PASSWORD=provenapi Local database password. For security purposes, this MUST be changed.
PROVEN_ISSUER_AGENT_DB_PASSWORD=provenagent Local database password. For security purposes, this MUST be changed.
PROVEN_ISSUER_PROXY_DB_PASSWORD=provenagent Local database password. For security purposes, this MUST be changed.
PROVEN_ISSUER_AGENT_LABEL=Proven This is what you want the issuer name to show up as on other agents’ connection list. Change this so that agents can tell the difference between Proven issuers.
PROVEN_ISSUER_ENC_KEY=1ae2e84429d3447aa9aa8e38ea84fa6b For Security purposes, this value MUST be changed. Must be 32 alphanumeric characters. Encryption key.
PROVEN_ADMIN_PASSWORD= Must be added and must be 15 characters long.
PROVEN_ISSUER_WEB_ROOT=https://proven.dev.indiciotech.io If you have a DNS name, change localhost to the issuer DNS name with https://. Otherwise, change it to your VM’s external IP. Do not have a trailing slash.
PROVEN_ISSUER_JWT_SECRET=Zu0gPaBdGSP8dfgoK6C1vlBLaXOh6gGq For Security purposes, this value MUST be changed. Must be 32 alphanumeric characters.
PROVEN_ISSUER_SESSION_SECRET=Xn2r5u8xjAgD7G39jjdSgVkYp3s6v9y5 For Security purposes, this value MUST be changed. Must be 32 alphanumeric characters.
PROVEN_ISSUER_ENC_KEY=54234625127cb22694ff0e27cc14b685 For Security purposes, this value MUST be changed. Must be 32 alphanumeric characters.
For an example of a configured .env file, please see Appendix B.
Run the following command:
sudo systemctl start proven
Start a new SSH window if you want to monitor the progress of the starting of Proven.
sudo systemctl status proven
On error, return to the original ssh window, wait for the process to stop, then try again.
INFORMATIONAL NOTES: “proven.service” is a linux service file that makes it easy to start and stop your proven instance. It usually takes a minute or two for Proven to be ready for use. The following are some tips and FUTURE commands that you can run if you need to manage the proven service,
IMPORTANT: Do NOT stop the service in the middle of its initial starting time. You have a chance of interrupting the install process and it will corrupt files that will need to be removed before restarting.
For later use to stop the proven service: sudo systemctl stop proven
You should now be able to navigate to your Proven issuer in a web browser, using its DNS Name or ip address.
If you left the ISSUER seed variable blank during step 4d, this step is required
Run the following commands from the google cloud SSH window:
sudo docker-compose -f docker-compose.live.yml exec proven-issuer-api node firstimesetup.js
Agree to the Transaction Author Agreement
To anchor the new DID which is now displayed -> open
Select the Indicio DemoNet option from the Network dropdown box. DemoNet is the default used in Proven, but please select TestNet if you changed the .env file to that one. You will need to use a different tool if your identity network is not an Indicio network.
Copy the new DID and Verkey displayed on the Proven window, to the DID and Verkey fields of the Selfserve form.
Click Submit
Return to the Proven SSH window and enter ‘y’ to indicate having anchored the Endorser DID.
Wait while the Credential definitions are created for you.
When you see Completed, then press enter to continue.
Your Proven instance is now ready to go!
To try out Proven with a user credential do the following:
Install the latest Holdr+ app on your mobile device.
Navigate to your Proven IP address or DNS url.
Using your mobile Holdr+ app, scan the QR code displayed.
To setup DNS for Proven on Google’s Cloud DNS, (by creating a new subdomain of your existing domain) do the following:
Go to GCP’s Cloud DNS section in Network services (Navigation Menu > Networking > Network Services > Cloud DNS)
Click Create Zone if a new Zone is desired. Otherwise, if a zone is already created, click on the zone name then skip to step 3.
Give the zone a name. This name is just how it will appear in the list and need not necessarily match the new subdomain.
For DNS name, enter a new subdomain. (In the example configuration below, using the domain dev.indiciotech.io means we want to create a new dev subdomain of the existing indiciotech.io domain)
Click Create
Here’s an example configuration:
To “activate” this new subdomain in GC, you need to register the subdomain in your existing domain (i.e. at your registrar).
Click the name of the new zone you just created.
Click on REGISTRAR SETUP (upper right of the screen) to find the items needing added to the new NS record, then add the domain’s DNS Name Server entries to your registrar.
Click Add Standard
Create a DNS Name for proven and record it for later use (e.g. proven.dev.indiciotech.io)
Defaults are okay
Set the “IPv4 Address” to the “External IP address” of the VM you created earlier.
Full list of .env file variable descriptions
PROVEN_ISSUER_SSL_DOMAIN_PATH=
Path to Issuer SSL certificate. If not defined, creates a self-signed cert. If using certbot, leave blank before running certbot.
PROVEN_ISSUER_SERVER_NAME=proven.dev.indiciotech.io
Use your DNS entry for the issuer in place of “localhost.” Do not include “http://” or a trailing slash
PROVEN_ISSUER_HTTPS_PORT=443
The port that the issuer uses for https connections.
PROVEN_ISSUER_HTTP_PORT=80
The port that the issuer uses for http connections.
/genesis_files/pool_transactions_testnet_genesis
The URL to the Genesis pool file. Must be a URL. Do not include a trailing slash. The default connects to the testnet, make sure to adjust this for the network you are connecting to.
PROVEN_ISSUER_SEED=
Must be 32 alphanumeric characters. Has to have “--seed “ at the start. Typically only used in Live environments.
TEST_SEED=
Must be 32 alphanumeric characters. Has to have “--seed “ at the start. Not necessary.
TAILS_URL=http://10.128.15.205:6543
Replace the IP address with your local IP address on this line.
DISABLE_SSL_CHECK=true
NODE_ENV=development
Possible values: production, development
GOVERNANCE_PATH=http://localhost:3100/api/governance-framework
Where governance details are downloaded from. Can use DNS name, but typically left as localhost.
PROVEN_ISSUER_API_DB_HOST=db
Local database
PROVEN_ISSUER_API_DB=provenapi
Local database
PROVEN_ISSUER_API_DB_USERNAME=provenapi
Local database
PROVEN_ISSUER_API_DB_PASSWORD=provenapi
Local database
PROVEN_ISSUER_AGENT_DB=provenagent
Local database
PROVEN_ISSUER_AGENT_DB_HOST=db
Local database
PROVEN_ISSUER_AGENT_DB_USERNAME=provenagent
Local database
PROVEN_ISSUER_AGENT_DB_PASSWORD=provenagent
Local database
PROVEN_ISSUER_AGENT_ADMIN_DB_USERNAME=development
Local database
PROVEN_ISSUER_AGENT_ADMIN_DB_PASSWORD=development
Local database
PROVEN_ISSUER_AGENT_LABEL=Proven
This is what you want the issuer name to show up as on other agents’ connection list.
PROVEN_ISSUER_ENC_KEY=1ae2e84429d3447aa9aa8e38ea84fa6b
Encryption key. Must be 32 alphanumeric characters.
PROVEN_ISSUER_PROXY_DB=postgres://provenproxy:provenproxy@db:5432/provenproxy
PROVEN_ISSUER_WEB_ROOT=https://issuer.dev.indiciotech.io
If you have a DNS name, change localhost to the issuer DNS name with https://. Otherwise, change it to your VM’s external IP. Do not have a trailing slash.
PROVEN_ISSUER_JWT_SECRET=Zu0gPaBdGSP8dfgoK6C1vlBLaXOh6gGq
Must be 32 alphanumeric characters.
PROVEN_ISSUER_SESSION_SECRET=Xn2r5u8xjAgD7G39jjdSgVkYp3s6v9y5
Must be 32 alphanumeric characters.
PROVEN_ISSUER_ENC_KEY=54234625127cb22694ff0e27cc14b685
Must be 32 alphanumeric characters.
ISSUER_RECAPTCHA_SITEKEY=
Paste in your saved recaptcha site key that you created in step 3
ISSUER_RECAPTCHA_SECRETKEY=
Paste in your saved recaptcha secret key that you created in step 3
SCHEMA_USER=Gj39gdivhMneKBaamMsX7P:2:User:1.0
Here is an example of a configured .env:
PROVEN_ISSUER_SSL_DOMAIN_PATH=
PROVEN_ISSUER_SERVER_NAME=issuer-proven-test.dev.indiciotech.io
PROVEN_ISSUER_HTTPS_PORT=443
PROVEN_ISSUER_HTTP_PORT=80
PROVEN_SESSION_MAXAGE=86400000
WDS_SOCKET_PORT=0
WDS_SOCKET_HOST=0.0.0.0
WDS_SOCKET_PATH=sockjs-node
PROVEN_ISSUER_SEED=
TEST_SEED=
TAILS_URL=http://10.128.15.205:6543
DISABLE_SSL_CHECK=true
NODE_ENV=development
GOVERNANCE_PATH=http://localhost:3100/api/governance-framework
PROVEN_ISSUER_API_DB_HOST=db
PROVEN_ISSUER_API_DB=provenapi
PROVEN_ISSUER_API_DB_USERNAME=provenapi
PROVEN_ISSUER_API_DB_PASSWORD=provenapi
PROVEN_ISSUER_AGENT_DB=provenagent
PROVEN_ISSUER_AGENT_DB_HOST=db
PROVEN_ISSUER_AGENT_DB_USERNAME=provenagent
PROVEN_ISSUER_AGENT_DB_PASSWORD=provenagent
PROVEN_ISSUER_AGENT_ADMIN_DB_USERNAME=development
PROVEN_ISSUER_AGENT_ADMIN_DB_PASSWORD=development
PROVEN_ISSUER_AGENT_LABEL=Proven
PROVEN_ISSUER_ENC_KEY=1ae2e84429d3447aa9aa8e38ea84fa6b
PROVEN_ISSUER_PROXY_DB=postgres://provenproxy:provenproxy@db:5432/provenproxy
PROVEN_ISSUER_WEB_ROOT=https://issuer-proven-test.dev.indiciotech.io
PROVEN_ISSUER_JWT_SECRET=Zu0gPaBdGSP8dfgoK6C1vlBLaXOh6gGq
PROVEN_ISSUER_SESSION_SECRET=Xn2r5u8xjAgD7G39jjdSgVkYp3s6v9y5
PROVEN_ISSUER_ENC_KEY=54234625127cb22694ff0e27cc14b685
ISSUER_RECAPTCHA_SITEKEY=6LcokwUmAAAAAOg8mC4bXpRObIMVpB6LsFvzty3e
ISSUER_RECAPTCHA_SECRETKEY=6LcokwUmAAAAAIcuLhLZ_Vgd_6TUhOj0E9QcBAXS
SCHEMA_USER=Gj39gdivhMneKBaamMsX7P:2:User:1.0
Proven ships with just a User credential by default. The following details the instructions for adding a new credential type to the list of credentials managed by your instance of Proven. These instructions just include the method needed for altering the Proven configuration to include an existing schema and do not include the instructions for building and adding a schema to an identity network. Please contact support@indicio.tech for more information.
These instructions are an example of how to add an employment schema to your instance of Proven.
Find the Schema ID of the credential you would like to add to Proven.
For this example, we use the employment schema 4rZRryzpji8LUwuvKRVdzU:2:Employment:1.0 which is from the Indicio DemoNet.
Update the environment file with the schema:
sudo vi .env
Add a line right after the SCHEMA_USER line
SCHEMA_EMPLOYMENT=4rZRryzpji8LUwuvKRVdzU:2:Employment:1.0
Save and exit
Update the common-services.yml file to pass the schema variable to the proven-issuer-api service:
sudo vi common-services.yml
Locate the line containing SCHEMA_USER in the file. (It’s about a third of the way through the file.)
Below that line, add the following line:
Update the schema definition files with the new schema:
sudo vi config/proven-issuer-api/schemas.json { "schemas": [ { "id": "Gj39gdivhMneKBaamMsX7P:2:User:1.0" }, { "id": "4rZRryzpji8LUwuvKRVdzU:2:Employment:1.0" } ] }
sudo vi config/proven-issuer-api/schemas-verification.json { "schemaList": [ { "verification_label": "User - Full Disclosure", "schema_id": "Gj39gdivhMneKBaamMsX7P:2:User:1.0", "schema_attributes": [ "username", "user_email", "user_id", "user_roles" ] }, { "verification_label": "User - Username and User Email", "schema_id": "Gj39gdivhMneKBaamMsX7P:2:User:1.0", "schema_attributes": [ "username", "user_email" ] }, { "verification_label": "Employment - Full Disclosure", "schema_id": "4rZRryzpji8LUwuvKRVdzU:2:Employment:1.0", "schema_attributes": [ "employer_region", "employment_type", "employee_given_names", "employer_country", "employment_postal_code", "employment_start_date", "employer_postal_code", "employment_country", "employment_role", "employer_city", "employer_address", "employment_role_description", "employee_surnames", "employer_name", "employment_city", "employment_region", "employment_address" ] } ] }
WARNING: The following commands do a complete reset of your Proven Agent. This means that all of your previous connections and issued credentials will no longer be accessible. This also means that you might need to re-anchor a new DID to the ledger (unless you are using a static DID in the .env file). If you are adding the new credential type before starting Proven for the first time, then you can ignore this warning and ignore the following steps.
Reset your proven agent so that the new credential schema will be usable by your Proven agent:
sudo systemctl stop proven
sudo docker-compose -f docker-compose.live.yml down -v
sudo rm -rf postgres-db
Return to main instructions and continue.
For help with setting up your own Issuer DID, please contact us: support@indicio.tech
For later use to restart the proven service: sudo systemctl stop proven sudo systemctl start proven
This creates a connection between your mobile device and the Proven Issuer
Troubleshooting Tip: If you see "Loading Please wait" for a long time at this point, try refreshing the browser page. If that doesn’t fix the problem then you might have an issue with your DNS setup that is causing the problem.
Change the IP address in your browser by adding “/admin” to the end of it.
Login using the following credentials:
Username: admin
Password:
You should now see the Issuer admin interface.
Click on CONTACTS in the left menu
Click on the most recent contact.
Under choose credential, select “user”
Hint: if the “user” option is not in the list, refresh the page and try again
Fill in the fields
Click “Send”
You should now see a notification of a new credential on your mobile device (go to the home screen to see notifications on Holdr+)
Click “view” to view the credential offer.
Scroll to the bottom of the Credential offer and click “Accept”
After the credential is added to your wallet, click ‘Done’.
You now have Proven Issuer working!
Click “Create”
- SCHEMA_EMPLOYMENT=${SCHEMA_EMPLOYMENT}
Save and exit
Save and exit
sudo systemctl start proven
This document will guide you through the steps to deploy and configure Proven in Google Cloud using Indicio Proven from the GC Marketplace. The first part of this document is intended to be a “quick start” to get you up and running quickly, then you can look at the indicated appendices for more details if needed.
Get the most of your Indicio Proven
Indicio is here to help you on every step of your journey and is offering Google Cloud customers exclusive access and discounts to Indicio’s expert support and training. Get your critical technical questions answered from our experienced support team. Help your development, sales, and marketing teams get up to speed with the fundamentals of the technology and communication of Trusted Digital Ecosystems by taking advantage of our instructor-led workshops and certifications from the Indicio Academy. Learn more about these exclusive discounts and benefits for Google Cloud customers and contact us today!
Navigate to the Google Cloud Console, https://console.cloud.google.com/
Select the project that you want the Proven instance to reside in.
In the Navigation Menu (top left), go to Compute Engine > VM Instances
If it’s a new project, click “Enable”
Click CREATE INSTANCE
From the left menu select “Marketplace”.
In the “Search Marketplace” field type “Proven” and hit enter.
Select “Indicio Proven”.
Change the Deployment name if desired. This will be the name of your VM instance.
Select and record your Zone choice for later use.
For Machine type choose a machine with at least 2 vCPU’s and 4G memory. For example, these defaults should be adequate:
Set Series to E2
Set Machine type to e2-medium
Under Boot disk it is recommended to select a disk at least 50GB in size. (default)
You can set a static IP address later if desired. It is not available for change at this phase unless you have already pre-configured a static IP for use here. (This can be accomplished by creating a static external IP in your default VPC in a separate tab.)
Scroll to the bottom, check the box to accept the terms of service, then click DEPLOY.
After deployment is complete:
Note the link for instructions for creating a static IP address if needed (on the right under “Suggested next steps”)
In the right panel - Click on the instance name to bring up details about the Proven instance you just deployed
Click EDIT
Add a DNS entry for Proven.
Navigate back to the Google Cloud console
SSH into the VM 1. Select Compute engine > VM instances Then for [your-proven-instance] click SSH
Enter these commands in your instance to make it so that the “proven.service” starts up automatically after every server reboot.
Run this command for Proven.
PROVEN_ISSUER_SERVER_NAME=proven.dev.indiciotech.io Use your DNS entry or the IP address for the issuer. Do not include “http://” or a trailing slash
PROVEN_ISSUER_SEED= Must be 32 alphanumeric characters. Has to have “--seed “ at the start. If you do not have a seed, you may leave this blank if this is a testing environment and if blank make sure to perform step 7. For a production environment, see Appendix D.
TAILS_URL= Replace the IP address on this line with your local IP address. Leave the port as 6543.
NODE_ENV=production
PROVEN_ISSUER_API_DB_PASSWORD=provenapi Local database password. For security purposes, this MUST be changed.
PROVEN_ISSUER_AGENT_DB_PASSWORD=provenagent Local database password. For security purposes, this MUST be changed.
PROVEN_ISSUER_PROXY_DB_PASSWORD=provenagent Local database password. For security purposes, this MUST be changed.
PROVEN_ISSUER_AGENT_LABEL=Proven This is what you want the issuer name to show up as on other agents’ connection list. Change this so that agents can tell the difference between Proven issuers.
PROVEN_ISSUER_ENC_KEY=1ae2e84429d3447aa9aa8e38ea84fa6b For Security purposes, this value MUST be changed. Must be 32 alphanumeric characters. Encryption key.
PROVEN_ADMIN_PASSWORD= Must be added and must be 15 characters long.
PROVEN_ISSUER_WEB_ROOT= If you have a DNS name, change localhost to the issuer DNS name with https://. Otherwise, change it to your VM’s external IP. Do not have a trailing slash.
PROVEN_ISSUER_JWT_SECRET=Zu0gPaBdGSP8dfgoK6C1vlBLaXOh6gGq For Security purposes, this value MUST be changed. Must be 32 alphanumeric characters.
PROVEN_ISSUER_SESSION_SECRET=Xn2r5u8xjAgD7G39jjdSgVkYp3s6v9y5 For Security purposes, this value MUST be changed. Must be 32 alphanumeric characters.
PROVEN_ISSUER_ENC_KEY=54234625127cb22694ff0e27cc14b685 For Security purposes, this value MUST be changed. Must be 32 alphanumeric characters.
Run the following command:
sudo systemctl start proven
Start a new SSH window if you want to monitor the progress of the starting of Proven.
sudo systemctl status proven
You should now be able to navigate to your Proven issuer in a web browser, using its DNS Name or ip address.
If you left the ISSUER seed variable blank during step 4d, this step is required
Run the following commands from the google cloud SSH window:
sudo docker-compose -f docker-compose.live.yml exec proven-issuer-api node firstimesetup.js
Agree to the Transaction Author Agreement
To setup DNS for Proven on Google’s Cloud DNS, (by creating a new subdomain of your existing domain) do the following:
Go to GCP’s Cloud DNS section in Network services (Navigation Menu > Networking > Network Services > Cloud DNS)
Click Create Zone if a new Zone is desired. Otherwise, if a zone is already created, click on the zone name then skip to step 3.
Give the zone a name. This name is just how it will appear in the list and need not necessarily match the new subdomain.
Full list of .env file variable descriptions
PROVEN_ISSUER_SSL_DOMAIN_PATH= Path to Issuer SSL certificate. If not defined, creates a self-signed cert. If using certbot, leave blank before running certbot.
PROVEN_ISSUER_SERVER_NAME=proven.dev.indiciotech.io Use your DNS entry for the issuer in place of “localhost.” Do not include “http://” or a trailing slash
PROVEN_ISSUER_HTTPS_PORT=443 The port that the issuer uses for https connections.
PROVEN_ISSUER_HTTP_PORT=80 The port that the issuer uses for http connections.
GENESIS_URL=<https://raw.githubusercontent.com/Indicio-tech/indicio-network/main/genesis_files/pool_transactions_testnet_genesis The URL to the Genesis pool file. Must be a URL. Do not include a trailing slash. The default connects to the testnet, make sure to adjust this for the network you are connecting to.
PROVEN_ISSUER_SEED= Must be 32 alphanumeric characters. Has to have “--seed “ at the start. Typically only used in Live environments.
TEST_SEED= Must be 32 alphanumeric characters. Has to have “--seed “ at the start. Not necessary.
TAILS_URL= Replace the IP address with your local IP address on this line.
DISABLE_SSL_CHECK=true NODE_ENV=development Possible values: production, development
GOVERNANCE_PATH= Where governance details are downloaded from. Can use DNS name, but typically left as localhost.
PROVEN_ISSUER_API_DB_HOST=db Local database
PROVEN_ISSUER_API_DB=provenapi Local database
PROVEN_ISSUER_API_DB_USERNAME=provenapi Local database
PROVEN_ISSUER_API_DB_PASSWORD=provenapi Local database
PROVEN_ISSUER_AGENT_DB=provenagent Local database
PROVEN_ISSUER_AGENT_DB_HOST=db Local database
PROVEN_ISSUER_AGENT_DB_USERNAME=provenagent Local database
PROVEN_ISSUER_AGENT_DB_PASSWORD=provenagent Local database
PROVEN_ISSUER_AGENT_ADMIN_DB_USERNAME=development Local database
PROVEN_ISSUER_AGENT_ADMIN_DB_PASSWORD=development Local database
PROVEN_ISSUER_AGENT_LABEL=Proven This is what you want the issuer name to show up as on other agents’ connection list.
PROVEN_ISSUER_ENC_KEY=1ae2e84429d3447aa9aa8e38ea84fa6b Encryption key. Must be 32 alphanumeric characters.
PROVEN_ISSUER_PROXY_DB=postgres://provenproxy:provenproxy@db:5432/provenproxy
PROVEN_ISSUER_WEB_ROOT= If you have a DNS name, change localhost to the issuer DNS name with https://. Otherwise, change it to your VM’s external IP. Do not have a trailing slash.
PROVEN_ISSUER_JWT_SECRET=Zu0gPaBdGSP8dfgoK6C1vlBLaXOh6gGq Must be 32 alphanumeric characters.
PROVEN_ISSUER_SESSION_SECRET=Xn2r5u8xjAgD7G39jjdSgVkYp3s6v9y5 Must be 32 alphanumeric characters.
PROVEN_ISSUER_ENC_KEY=54234625127cb22694ff0e27cc14b685 Must be 32 alphanumeric characters.
ISSUER_RECAPTCHA_SITEKEY= Paste in your saved recaptcha site key that you created in step 3
ISSUER_RECAPTCHA_SECRETKEY= Paste in your saved recaptcha secret key that you created in step 3
SCHEMA_USER=Gj39gdivhMneKBaamMsX7P:2:User:1.0
Proven ships with just a User credential by default. The following details the instructions for adding a new credential type to the list of credentials managed by your instance of Proven. These instructions just include the method needed for altering the Proven configuration to include an existing schema and do not include the instructions for building and adding a schema to an identity network. Please contact for more information.
These instructions are an example of how to add an employment schema to your instance of Proven.
Find the Schema ID of the credential you would like to add to Proven.
For this example, we use the employment schema 4rZRryzpji8LUwuvKRVdzU:2:Employment:1.0 which is from the Indicio DemoNet.
Update the environment file with the schema:
For help with setting up your own Issuer DID, please contact us:
Click GET STARTED to configure your Proven VM as a trial, or click LAUNCH if you have already done the trial.
If a trial, agree to the agreements then click DEPLOY.
For new projects, click “Enable” to enable the required APIs.
Scroll down to Networking and under Firewalls check the boxes that will allow HTTP and HTTPS traffic.
Click SAVE
Click VM instances (in the left menu)
Record the External IP address of your Proven instance for later use.
Run the command ip a and record the private ip address of your primary network interface (ens4). This local IP address will be used in the next step.
Edit the .env file to fit your environment. -> sudo vim .env
Shown below are the minimal fields needing configured, their default values, and short descriptions. The remaining fields are described in Appendix B.
On error, return to the original ssh window, wait for the process to stop, then try again.
INFORMATIONAL NOTES: “proven.service” is a linux service file that makes it easy to start and stop your proven instance. It usually takes a minute or two for Proven to be ready for use. The following are some tips and FUTURE commands that you can run if you need to manage the proven service,
IMPORTANT: Do NOT stop the service in the middle of its initial starting time. You have a chance of interrupting the install process and it will corrupt files that will need to be removed before restarting.
For later use to stop the proven service: sudo systemctl stop proven
For later use to restart the proven service: sudo systemctl stop proven sudo systemctl start proven
To anchor the new DID which is now displayed -> open https://selfserve.indiciotech.io
Select the Indicio DemoNet option from the Network dropdown box. DemoNet is the default used in Proven, but please select TestNet if you changed the .env file to that one. You will need to use a different tool if your identity network is not an Indicio network.
Copy the new DID and Verkey displayed on the Proven window, to the DID and Verkey fields of the Selfserve form.
Click Submit
Return to the Proven SSH window and enter ‘y’ to indicate having anchored the Endorser DID.
Wait while the Credential definitions are created for you.
When you see Completed, then press enter to continue.
Your Proven instance is now ready to go!
To try out Proven with a user credential do the following:
Install the latest Holdr+ app on your mobile device.
Navigate to your Proven IP address or DNS url.
Using your mobile Holdr+ app, scan the QR code displayed.
This creates a connection between your mobile device and the Proven Issuer
Troubleshooting Tip: If you see "Loading Please wait" for a long time at this point, try refreshing the browser page. If that doesn’t fix the problem then you might have an issue with your DNS setup that is causing the problem.
Change the IP address in your browser by adding “/admin” to the end of it.
Login using the following credentials:
Username: admin
Password:
You should now see the Issuer admin interface.
Click on CONTACTS in the left menu
Click on the most recent contact.
Under choose credential, select “user”
Hint: if the “user” option is not in the list, refresh the page and try again
Fill in the fields
Click “Send”
You should now see a notification of a new credential on your mobile device (go to the home screen to see notifications on Holdr+)
Click “view” to view the credential offer.
Scroll to the bottom of the Credential offer and click “Accept”
After the credential is added to your wallet, click ‘Done’.
You now have Proven Issuer working!
Click Create
Here’s an example configuration:
To “activate” this new subdomain in GC, you need to register the subdomain in your existing domain (i.e. at your registrar).
Click the name of the new zone you just created.
Click on REGISTRAR SETUP (upper right of the screen) to find the items needing added to the new NS record, then add the domain’s DNS Name Server entries to your registrar.
Click Add Standard
Create a DNS Name for proven and record it for later use (e.g. proven.dev.indiciotech.io)
Defaults are okay
Set the “IPv4 Address” to the “External IP address” of the VM you created earlier.
Click “Create”
Add a line right after the SCHEMA_USER line
SCHEMA_EMPLOYMENT=4rZRryzpji8LUwuvKRVdzU:2:Employment:1.0
Save and exit
Update the common-services.yml file to pass the schema variable to the proven-issuer-api service:
sudo vi common-services.yml
Locate the line containing SCHEMA_USER in the file. (It’s about a third of the way through the file.)
Below that line, add the following line:
- SCHEMA_EMPLOYMENT=${SCHEMA_EMPLOYMENT}
Save and exit
Update the schema definition files with the new schema:
sudo vi config/proven-issuer-api/schemas.json { "schemas": [ { "id": "Gj39gdivhMneKBaamMsX7P:2:User:1.0" }, { "id": "4rZRryzpji8LUwuvKRVdzU:2:Employment:1.0" } ] }
sudo vi config/proven-issuer-api/schemas-verification.json { "schemaList": [ { "verification_label": "User - Full Disclosure", "schema_id": "Gj39gdivhMneKBaamMsX7P:2:User:1.0", "schema_attributes": [ "username", "user_email", "user_id", "user_roles" ] }, { "verification_label": "User - Username and User Email", "schema_id": "Gj39gdivhMneKBaamMsX7P:2:User:1.0", "schema_attributes": [ "username", "user_email" ] }, { "verification_label": "Employment - Full Disclosure", "schema_id": "4rZRryzpji8LUwuvKRVdzU:2:Employment:1.0", "schema_attributes": [ "employer_region", "employment_type", "employee_given_names", "employer_country", "employment_postal_code", "employment_start_date", "employer_postal_code", "employment_country", "employment_role", "employer_city", "employer_address", "employment_role_description", "employee_surnames", "employer_name", "employment_city", "employment_region", "employment_address" ] } ] }
Save and exit
WARNING: The following commands do a complete reset of your Proven Agent. This means that all of your previous connections and issued credentials will no longer be accessible. This also means that you might need to re-anchor a new DID to the ledger (unless you are using a static DID in the .env file). If you are adding the new credential type before starting Proven for the first time, then you can ignore this warning and ignore the following steps.
Reset your proven agent so that the new credential schema will be usable by your Proven agent:
sudo systemctl stop proven
sudo docker-compose -f docker-compose.live.yml down -v
sudo rm -rf postgres-db
sudo systemctl start proven
Return to main instructions and continue.
cd /opt/indicio/proven-release-docker
sudo systemctl enable proven sudo cp staging.env .envIndicio NoDe 20.04 GC User Guide
This document describes the steps to take to deploy your own NoDe 20.04 Indy Node from Google Cloud Marketplace using the Indy Node Image provided by Indicio, PBC.
Please read all instructions before attempting to create an Indy Node, as there are many steps that vary from default values. Unless otherwise noted, these instructions do not include items that work with default or blank values. If you wish to create your own complete Indy Network, you will need to create multiple NoDe instances, and a full overview can be found in the NoDe Network Creation Guide.
Create a new GC Project for your node. 1. From the GC console (https://console.cloud.google.com/), select the drop down next to Google Cloud in the upper right 2. Click New Project in the upper left of the pop-up 3. All configurations are your choice, click CREATE when done
Before creating the instance, you must configure the default and also an additional VPC network for your new node.
From the Navigation Menu, scroll over VPC network and select VPC networks (If you haven’t already, you will need to click ENABLE to use the compute engine API)
Before you begin, decide on a region to run your VM in that matches the jurisdiction of your company's corporate offices. Record the region selected for use throughout these instructions. You will use this same region later in the instructions when required.
Under VPC networks click default to edit the network configurations:
Click on the SUBNETS tab and then on ADD SUBNET and input the following values
Name - client-subnet-9702 (or make a name according to your needs, making sure it is descriptive)
Region - Your selected region
IPv4 range - 10.0.1.0/24 (or enter another valid range according to your needs)
Click ADD
Click the back arrow next to VPC network details to go back to VPC Networks
Click CREATE VPC NETWORK at the top of the screen to create a network for your node connection on your node.
Name - your choice (e.g. node-vpc)
Under Subnet creation mode select Custom
Expand the New subnet section and enter the following values
Navigate to VPC network then select IP addresses from the menu
Click RESERVE EXTERNAL STATIC IP ADDRESS
Name - node-external-ip or your choice
Network Service Tier - Standard
Navigate back to VPC network then VPC networks
Under VPC networks click default to edit the network configurations for the NoDe’s “client” connection.
Click the FIREWALLS tab at the top of the page, and then click ADD FIREWALL RULE to add SSH access through the Client VPC. Use the following values in the fields below:
From the Navigation Menu, select Compute Engine then Snapshots
Select the SNAPSHOT SCHEDULES tab then click CREATE SNAPSHOT SCHEDULE
Name - your choice (e.g. 'nodesnapweekly')
From the Navigation Menu, select Compute Engine, then select VM instances
Click Create Instance at the top of the page
Select Marketplace in the left hand menu
In the search bar, type Indicio NoDe and hit enter
Once the VM is created, navigate to Compute Engine>VM instances
Click on the name of the VM you just created to access it’s settings
Click Edit at the top of the page
To set up ssh keys:
SSH into your new node VM
You can navigate to Compute Engine then VM instances then click SSH towards the right of your NoDe Instance
OR you can use the SSH key access setup from an earlier optional step.
Setup 2FA for SSH access to the Node for your base user.
Complete the network setup process
Run the Oneshot startup process
sudo /opt/indy-startup/Oneshot.sh
sudo netplan generate
To start the indy-cli using your new config file, run the following: indy-cli --config ~/cliconfig
Next, generate a Steward DID using the CLI machine you just installed. This will comprise a public and private key pair, generated from a seed. Knowing your seed will allow you to regenerate the key on demand. To keep this secure, you will need to have a very secure Steward seed that is not easy to guess.
sudo apt install pwgen
Open your wallet and create a DID based on the “Steward Seed” created earlier.
Provide Information to Trustees
At this point you should have the following data available:
Your Steward verkey and DID
The Validator ‘node IP address’
Note: You are done with the first part of the installation and onboarding. Send an email to (or the equivalent) and the network administrator staff will help you to set up the rest.
Name - your choice (e.g. node-subnet-9701)
Region - Your selected region
IPv4 range - Type in a valid new subnet block. (e.g. 10.0.2.0/24)
Click DONE
For Dynamic routing mode select Regional
Click CREATE
Region - Your selected region
Attached to - None (it will be attached to your vm later during your creation of the main node vm)
Click RESERVE
Click RESERVE EXTERNAL STATIC IP ADDRESS
Name - client-external-ip or your choice
Network Service Tier - Standard
Region - Your selected region
Attached to - None (it will be attached to your vm later during your creation of the main node vm)
Click RESERVE
Direction of traffic - Ingress
Action on match - Allow
Targets - All instances in the network
Source filter - IPv4 ranges
Source IPv4 ranges - Enter the public IP addresses or ranges for your Node Administrators. (e.g. 67.199.174.247/32)
Protocols and ports - Specified protocols and ports
Select the TCP check box and enter 22 for the port
Click Create
Click Add firewall rule. Use the following values in the fields below:
Name - your choice (e.g. client-access-9702)
Network - default (should already be set)
Targets - All instances in the network
Source filter - IPv4 ranges
Source IPv4 ranges - 0.0.0.0/0
Protocols and ports - Specified protocols and ports
Select the TCP check box and enter 9702 for the port.
Click Create
Navigate back to VPC Network then VPC Networks
Click on the node-vpc network then click Firewalls
Ask your network administrator for a list of node IPs to add to your whitelist as part of the following steps. For each node IP on the network, do the following.
Click Add firewall rule
Name - Name (alias) of the node you are adding
Network - node-vpc
Direction of traffic - Ingress
Action on match - Allow
Targets - All instances in the network
Source filter - IPv4 ranges
Source IPv4 ranges - Enter the public IP address matching the Node name that you are adding. (e.g. 68.179.145.150/32)
Protocols and ports - Specified protocols and ports
Select the TCP check box and enter 9701 for the port
Click Create
Repeat the last set of steps for each node in the node list, changing the node Name and IP address for each new rule (you may omit your own address)
NOTE: If you do not yet have a list of Network nodes and IP’s for the network you will be joining, you can do that part later. For now, just open up port 9701 to “all” source IP’s (0.0.0.0/0) in the same way you did that for port 9702 in the “client” firewall. Be sure to enter the appropriate firewall entries when you get the list.
Snapshot location - Regional (default location)
Schedule frequency - Weekly (then your choice of day and time.)
Autodelete snapshots after - 60 days
Deletion rule - your choice (e.g. Select Delete snapshots older than 60 days to remove the snapshots every 2 months)
Click CREATE
Select the option that is named Indicio NoDe (Ubuntu 20.04)
Click GET STARTED
Agree to the terms by checking the box and clicking AGREE
Click DEPLOY
Deployment name - <your company name>
This name will become the name of your node on the network as well (the node ALIAS) so including your company name in this is desired. Do NOT use "Indicio", "Sovrin”, “IDunion”, "CANDY", or the network owner's name in this name.
i.e. use “<company name>", "<company name>-node", "<company name>-TestNet-Node", "<company name>-TestNet-Node1", or something similar
Choose and record a zone from the same region as you used previously in this document (ex. us-east4-c)
Machine configuration
Network Technical Governance requirements determine the values in this step. 2 vCPUs and 8G memory are the minimum requirements for Indicio Networks.
Series - N2
Machine Type - n2-standard-2 (2 vCPUs and 8G memory)
Boot disk
Boot disk type - Standard persistent disk is adequate.
Size - 250 GB
Network interfaces
Expand and change the existing default network interface. This will be your “client” interface.
Network - default (or client-vpc)
Subnetwork - select the subnet you created earlier for the Client (client-subnet-9702 10.0.1.0/24)
External IP - select the external client IP you created earlier (client-external-ip)
Click DONE (For this network interface)
Click Add A Network Interface to add a second network interface. (Required)
Network - node-vpc
Subnetwork - select the subnet you created earlier for the node (node-subnet-9701)
Primary internal IP - select the internal node IP you created earlier
Click "Deploy" to create the new NoDe GC VM instance.
Scroll down to Security and access
Check the Block project-wide SSH keys (recommended)
Enter a public SSH key for each Admin user (at least your own)
Click + ADD ITEM for each SSH key.
To create an SSH key:
You can use the following command to create a new SSH key pair on Linux or MAC that will work for this step. ssh-keygen -P "" -t rsa -b 4096 -m pem -f ~/pems/gcnode.pem
Once a public key is created the following example can be used on MAC or Linux to display the public key and copy it to the form: cat ~/pems/gcnode.pem.pub
Copy the results of the previous step and paste it into the space provided, being careful NOT to copy any leading or trailing whitespace.
To enable deletion protection:
Under Basic information select the Enable deletion protection box (recommended)
Install Google Authenticator, Duo, or Authy on your phone.
Configure the authenticator to allow both password and SSH key login with 2FA by changing the following file:
sudo vim /etc/ssh/sshd_config
uncomment the following line at the bottom of the file: AuthenticationMethods publickey,keyboard-interactive
:wq
sudo systemctl restart sshd
Setup your base user to use 2FA by running the following from a terminal:
google-authenticator
Answer "y" to all questions asked during the setup
Save the secret key, verification code and scratch codes in a safe place. These are all just for your user and can be used to login or to recover as needed.
Add other administrative users:
Send the other new admin users the following instructions for generating their own SSH keys:
ssh-keygen -P "" -t rsa -b 4096 -m pem -f ~/pems/gcnode.pem
Have the new users send you their public key (e.g. gcnode.pem.pub if they do the above command)
Also have them send you their Public IP address so that you can add it to the GC firewall to allow them access. Optionally, have them send a preferred username also.
Add their IP addresses to the GC firewall:
From the GC VPC Networks screen (GC main menu -> VPC network->VPC networks), click on your Client VPC (e.g. client-vpc-9702)
Click the "Firewall rules" tab (in about the middle of the screen).
Click on the name of the rule that allows port 22 access for your admins (e.g. ssh-for-admin-access)
Add the users to the server:
Login to the node as the base user.
Run the following commands, substituting the username in for <newuser>
sudo adduser <newuser>
The new users are now able to login. Since 2FA is required, when you send the password to each of the new users, also send the following instructions (HINT: fill in the username, Client IP address, and password for them with the correct values):
Thanks for agreeing to help with the administration of our Indy Validator Node. Please login to the node, change your password, and setup Two Factor Authentication (2FA) using the following instructions:
ssh -i <your private SSH key file> <username>@<Client IP Addr>
Type in password1 for your password
sudo netplan apply
sudo add-apt-repository "deb http://security.ubuntu.com/ubuntu bionic-security main"
Before proceeding, verify the network directory name for the network that you will be joining with your network administrator. The default used for NoDe is “itn” which is the directory name for the Indicio TestNet. If you will be joining a different network, please run the following command (substitute in your network directory name for “<network>”).
sudo -i -u indy sed -i -re "s/(NETWORK_NAME = ')\w+/\1<network>/" /etc/indy/indy_config.py
For example, for the Indicio DemoNet, the directory name is “idn” and the command would be sudo -i -u indy sed -i -re "s/(NETWORK_NAME = ')\\w+/\\1idn/" /etc/indy/indy_config.py
NOTE: The genesis files are pre-installed to the correct places if you are joining one of the Indicio networks, but if you are joining a different network, then please use the genesis files provided by your network administrator and install them in the directory name they provided.
Run the following command
sudo -i -u indy init_indy_node <ALIAS> <node ip> <node port> <client ip> <client port>
TIP: run ip a to find your IP addresses needed here.
For example: sudo -i -u indy init_indy_node Node8 10.0.2.2 9701 10.0.1.2 9702
You can view an example that is tailored to your system by running the following
cat /opt/indy-startup/init_indy_node_example
Save the above init_indy_node command and all of the output in a safe place. You will need it later during onboarding and other actions.
IPTables DDOS protection (required for most Indy Networks)
sudo sed -i -re "s/(^CLIENT_CONNECTIONS_LIMIT=).*$/\115000/" /etc/indy/indy.env
sudo DEBIAN_FRONTEND=noninteractive apt install -y -q iptables-persistent
sudo setup_indy_node_iptables
Since your node is Ubuntu 20.04 based, if you are joining a network that has Ubuntu 16.04 nodes on it (or has in the past) you must run the following:
echo "REV_STRATEGY_USE_COMPAT_ORDERING = True" | sudo tee -a /etc/indy/indy_config.py
If you are unsure, please check with your network administrator.
Run the Technical Verification Script on the validator node:
Download this script, upload it to your Validator node, and set the execution flag on it:
ubuntu@validator$ cd ~
ubuntu@validator$ curl -O https://raw.githubusercontent.com/Indicio-tech/indicio-network/main/nodeop-tools/nodeop-tech-check.py
ubuntu@validator$ chmod +x nodeop-tech-check.py
Execute it, answering the questions that it asks. There are no wrong answers; please be honest. Questions that can be answered by scripting are automatically completed for you.
ubuntu@validator$ sudo python3 ./nodeop-tech-check.py
After the script completes, copy the output beginning at '== Results for "A Node Operator MUST" ==', and paste it into an email addressed to then send it.
From this step onward you will need 2 machines, the Node VM that you just configured, and a separate machine to install and run the Indy CLI on: such as your workstation or a VM specifically for network administration tasks.
On the machine you’ve chosen for the CLI, install indy-cli using instructions from Appendix A at this link: Indicio SelfServe Instructions
Create a JSON Config file containing your taaAcceptanceMechanism. (You can also add plugins to this config file, but for now just set it up as basic as possible.) vi ~/cliconfig
This example cliconfig file contains the line that sets the AML:
pwgen -s 32 1
Record the output of the above command as the “Steward Seed”
Next we run the indy-cli command line CLI by entering: indy-cli --config ~/cliconfig
In the command line, enter the following to create your pool configuration and your wallet locally. When creating your wallet, you will need to provide a "key" that is any string desired. It will be the encryption key of your local wallet.
The Validator ‘client IP address’
The Validator ‘node port’
The Validator ‘client port’
The Validator alias
The Validator verkey
The BLS key
Please go to the Node Operator Validator Registration form for Indicio networks (or the equivalent for the network you are joining) and provide the requested information.
{
"taaAcceptanceMechanism": "for_session"
}indy> pool create <pool name (e.g. itn)>
gen_txn_file=pool_transactions_<Network Name (e.g. TestNet)>\_genesis
indy> wallet create <wallet name (e.g. itn_wallet)> key indy> wallet open <wallet_name> key
indy> did new <Steward Seed> metadata=”steward DID”External IP - select the external node IP you created earlier
Click DONE
On your phone app add an account and then scan the barcode or enter the 16 character secret key from the previous steps output.
Reboot the instance and login to make sure 2FA is configured properly.
Click "EDIT" at the top of the screen.
Scroll down to the list of Source IP ranges and add the new Admins' IP addresses.
Click "SAVE" (Note: Restart is not needed. As soon as you save, they should have access.)
You can safely ignore messages like “sent invalidate(passwd) request, exiting“
For “Enter new UNIX password:” input “password1” (This will be changed later)
Enter a name (optional)
Defaults are fine for the rest
sudo usermod -aG sudo <newuser>
Then create a file in the newusers home directory:
sudo mkdir /home/<newuser>/.ssh
sudo chown <newuser>:<newuser> /home/<newuser>/.ssh
sudo vim /home/<newuser>/.ssh/authorized_keys
Paste the users public key into the open file and then save it (:wq)
sudo chown <newuser>:<newuser> /home/<newuser>/.ssh/authorized_keys
Repeat the above for each new admin user you create.
On successful login, type in "passwd" to change your password on the Validator Node. Please use a unique password of sufficient length and store it in a secure place (i.e. a password manager).
To set up 2FA, type in "google-authenticator"
Answer "y" to all questions asked during the setup
Save the secret key, verification code, and scratch codes in a safe place. These are all for your user and can be used to login or to recover as needed.
Install Google Authenticator, Duo, Authy, or other google-authenticator compatible app on your phone or device. 2. On your 2FA phone app, add an account, and then scan the barcode or enter the 16 character secret key from step 4’s output. 3. Log out and then log back in to check and make sure it worked!