diff --git a/docs/nix_services_deployment.md b/docs/nix_services_deployment.md --- a/docs/nix_services_deployment.md +++ b/docs/nix_services_deployment.md @@ -9,28 +9,31 @@ The Docker image can be built with the following command: ```bash -docker build -f services/identity -t commapp/identity-server: . +docker build --platform linux/amd64 -f services/identity/Dockerfile -t commapp/identity-server: . ``` ### Generating OPAQUE secrets -OPAQUE is an implementation of a PAKE (Passwor-Authenticated Key Exchange) protocol. This allows for authentication of a user without requiring the password credentials to be stored on the server. To generate the server credentials: +OPAQUE is an implementation of a PAKE (Password-Authenticated Key Exchange) protocol. This allows for the authentication of a user without the server ever possessing the underlying password. To generate the server credentials: ``` -docker run -v comm-identity-secrets:/home/comm/app/identity/secrets identity keygen +cd services/identity +mkdir secrets/ +docker run -v $(pwd)/secrets:/home/comm/app/identity/secrets commapp/identity-server: identity keygen ``` -**NOTE:** This OPAQUE keypair is used to encrypt the password credentials of all users. The contents of this file should be persisted in a safe manner beyond a Docker volume. +**NOTE:** This OPAQUE keypair is used to encrypt the password credentials of all users. The contents of this file should be persisted safely. ### Running the Identity service To run the service: -``` +```bash +cd services/identity docker run -d \ -e KEYSERVER_PUBLIC_KEY= \ + -e OPAQUE_SERVER_SETUP=$(cat secrets/server_setup.txt) \ -p 50054:50054 \ - -v comm-identity-secrets:/home/comm/app/identity/secrets \ commapp/identity-server: ```