validator_operator/validator_compose

[giscus[bot]]

validator_operator/validator_compose

https://docs.sync.global/validator_operator/validator_compose.html

[mnguyen-io]

Hi - we are trying to decide on whether or not docker compose is sufficient for Mainnet or if a Kubernetes cluster is a must have. We're not clear on whether or not External Ingress traffic is a requirement and if it is, would an NGINX proxy work to serve these requests to the containers?

In our environment it's much quicker (and maintainable with our current toolset) for us to be able to spin up via docker compose so we'd like to make sure we do this right the first time and not find out that something doesn't work later on down the road.

Thanks!

[stas-sbi]

whether or not docker compose is sufficient for Mainnet or if a Kubernetes cluster is a must have

Docker Compose is sufficient considering caveats mentioned at the top of the page.

We're not clear on whether or not External Ingress traffic is a requirement

The network connections for Validator are all outbound. Inbound is needed to access UIs and APIs.

would an NGINX proxy work to serve these requests to the containers

yes, Nginx would do the work

we'd like to make sure we do this right the first time and not find out that something doesn't work later on down the road

Docker compose based validator setup is being continuously tested and updated. As far as I'm concerned Splice team is committed to continue supporting it.

[wallacekelly-da]

In the section on Configuring Authentication, the following appears in the table:

LEDGER_API_AUTH_AUDIENCE: The audience for the participant ledger API. e.g. https://ledger_api.example.com.

I would not have expected an example like "https://ledger_api.example.com", because the Canton docs say that the aud: value should contain the participant id.

What am I missing?

[moritzkiefer-da]

see https://docs.digitalasset-staging.com/operate/3.3/howtos/secure/apis/jwt.html#configure-the-target-audience-for-jwt-authorization. You can configure the target audience

[nyetwurk]

Is there a non-docker compose way to either

1. run this with docker run alone (e.g. via ansible)
2. run this as standalone processes without docker

[nyetwurk]

Is there an architectural diagram as to what, exactly, docker compose is doing towards building up such a system?

[stephencompall-DA]

docker-compose and kubernetes are the only tested and supported ways to set up a working production-ready validator.