Skip to content

Commit

Permalink
cleanup docs
Browse files Browse the repository at this point in the history
  • Loading branch information
usmansaleem committed Jul 9, 2024
1 parent 34caa4e commit 1e920b7
Showing 1 changed file with 16 additions and 12 deletions.
28 changes: 16 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -38,17 +38,21 @@ The plugin jar will be available at `build/libs/besu-pkcs11-plugin-<version>.jar
Drop the `besu-pkcs11-plugin-<version>.jar` in the `/plugins` folder under Besu installation. This plugin will expose
following additional cli options:
```shell
--plugin-pkcs11-softhsm-config-path=<path>
--plugin-pkcs11-hsm-config-path=<path>
Path to the PKCS11 configuration file
--plugin-pkcs11-softhsm-key-alias=<path>
--plugin-pkcs11-hsm-key-alias=<label>
Alias or label of the private key that is stored in the HSM
--plugin-pkcs11-softhsm-password-path=<path>
--plugin-pkcs11-hsm-password-path=<path>
Path to the file that contains password or PIN to access PKCS11 token
```
The security module provided by this plugin can be loaded with following cli option:
```shell
--security-module=pkcs11-hsm
```


## Docker setup
- The plugin can be tested as a docker image. The provided `Dockerfile` is based on Besu's official docker image.
- The plugin can be tested as a docker image. The provided [`Dockerfile`](./Dockerfile) is based on Besu's official docker image.
It installs following additional package to manage SECP256K1 private keys and SoftHSM:

```
Expand All @@ -59,21 +63,21 @@ apt-get install -y --no-install-recommends \
opensc \
gnutls-bin
```
- The Dockerfile uses `scripts/entrypoint.sh` as entrypoint. This script initializes SoftHSM and generates a private key
if required.
- The Dockerfile uses a custom script [`entrypoint.sh`](./docker/scripts/entrypoint.sh) as entrypoint. This script
initializes SoftHSM and generates a private key if required.
- The Dockerfile copies the plugin jar to `/plugins` folder.
- To persist SoftHSM data, a volume should be mounted to `/softhsm2`. The host directory should have ownership of userid 1000:1000.
- Decide the token/pin to use for SoftHSM.
- See [Besu documentation](https://besu.hyperledger.org/public-networks/get-started/install/run-docker-image) for further details about other docker options.
- See [Besu documentation](https://besu.hyperledger.org/public-networks/get-started/install/run-docker-image) for
further details about other docker options required to run Besu.
- See the sample [Besu config file](./docker/volumes/config) that defines minimal options required to use the plugin.
- Following is an example to build the docker image:
```shell
docker build --no-cache -t besu-pkcs11:latest .
```
- To run Besu node for testing with SoftHSM, Following directories be mounted as volumes.
Change the path according to your requirements:
- `./docker/volumes/data` for Besu data. Will be mounted to `/var/lib/besu`
- `./docker/volumes/tokens` for SoftHSM data. Will be mounted to `/var/lib/tokens`
- `./docker/volumes/config` for Besu and PKCS11 config files. Will be mounted to `/etc/besu/config`. This directory already contains sample configurations.
- `./docker/volumes/data` for Besu data. It should be mounted to `/var/lib/besu`
- `./docker/volumes/tokens` for SoftHSM data. It should be mounted to `/var/lib/tokens`
- `./docker/volumes/config` for Besu and PKCS11 config files. It MUST be mounted to `/etc/besu/config`. This directory contains the sample configurations.

> [!NOTE]
> To initialize the SoftHSM tokens, the entrypoint script will attempt to generate a SECP256K1 private key and
Expand Down

0 comments on commit 1e920b7

Please sign in to comment.