Networking configuration

Use this page to understand certificate, proxy, and ingress fields for Ripple Custody. The example shows one possible networking shape; your certificates, DNS records, ingress controller, proxy, and TLS policy depend on your deployment.

For networking design, see Networking planning. For service URL fields, see URL configuration.

Networking configuration covers:

• Root CA and component certificates.
• Additional trusted certificates mounted into components.
• HTTP proxy settings for outbound traffic.
• Ingress settings for externally exposed services.

Database SSL and message-broker TLS are covered separately in PostgreSQL configuration and AMQP configuration.

Location: harmonize.certificates.rootCA

The root CA certificate is stored in a ConfigMap, mounted into components at /app/rootCA.crt, and used through the NODE_EXTRA_CA_CERTS environment variable.

Location: harmonize.certificates.<component>

Supported certificate formats documented in this reference include PEM, PKCS#12, and PKCS#8.

When existingSecret is used, the referenced Kubernetes TLS secret must contain:

Example secret shape:

apiVersion: v1
kind: Secret
metadata:
  name: frontend-tls-secret
type: kubernetes.io/tls
data:
  tls.crt: <base64-encoded-certificate>
  tls.key: <base64-encoded-private-key>

Most component certificates inherit from the frontend certificate by default. Override a component certificate only when that component needs a different certificate than the default frontend certificate.

harmonize:
  certificates:
    frontend:
      enabled: true
      existingSecret: "wildcard-tls"
    keycloak:
      existingSecret: "wildcard-tls"
    oauth:
      existingSecret: "wildcard-tls"

To mount additional CA certificates or custom certificates into components, use common.persistence:

common:
  persistence:
    myCert:
      enabled: true
      name: my-certificate
      type: configMap
      mountPath: /etc/ssl/certs/myCert.crt
      subPath: myCert.crt

Location: harmonize.httpProxy

The proxy URL is constructed from the proxy fields:

{protocol}://{username}:{password}@{host}:{port}

When proxy configuration is applied to an indexer, the deployment sets HTTP_PROXY and HTTPS_PROXY for that indexer.

Global URL settings are configured under harmonize.urls. Component ingress settings are configured under components.<component>.ingress.

This example shows root CA, component certificate, proxy, and ingress fields together:

harmonize:
  urls:
    base: "custody.example.com"
    tls: true

  certificates:
    rootCA:
      enabled: true
      certificate: |-
        -----BEGIN CERTIFICATE-----
        <root-ca-certificate>
        -----END CERTIFICATE-----
    frontend:
      enabled: true
      existingSecret: "frontend-tls"

  httpProxy:
    enabled: true
    protocol: "https"
    host: "proxy.example.com"
    port: 8080
    username: "<proxy-user>"
    password: "<proxy-password>"
    indexers:
      - nbxplorer
      - eth-indexer

components:
  frontend:
    ingress:
      enabled: true
      className: "nginx"
      hosts:
        - host: "app.custody.example.com"
          paths:
            - path: /
              pathType: Prefix
      tls:
        - secretName: frontend-tls
          hosts:
            - app.custody.example.com

• Secure communication
• Networking planning
• URL configuration
• PostgreSQL configuration
• AMQP configuration