# Networking configuration

Use this page to understand certificate, proxy, and ingress fields for Ripple Custody. The example shows one possible networking shape; your certificates, DNS records, ingress controller, proxy, and TLS policy depend on your deployment.

This page applies to on-premise deployments only. For current defaults and the full supported schema, use the configuration packaged with your release.

For networking design, see [Networking planning](/products/custody/v1.36/deployment/planning/networking). For service URL fields, see [URL configuration](/products/custody/v1.36/deployment/reference/urls).

## What this config controls

Networking configuration covers:

- Root CA and component certificates.
- Additional trusted certificates mounted into components.
- HTTP proxy settings for outbound traffic.
- Ingress settings for externally exposed services.


Database SSL and message-broker TLS are covered separately in [PostgreSQL configuration](/products/custody/v1.36/deployment/reference/postgresql) and [AMQP configuration](/products/custody/v1.36/deployment/reference/amqp).

## Root CA certificate

Location: `harmonize.certificates.rootCA`

| Parameter | Type | Default | Description |
|  --- | --- | --- | --- |
| `enabled` | boolean | `true` | Enables root CA certificate configuration. |
| `certificate` | string | Demo certificate | PEM-encoded root CA certificate. |


The root CA certificate is stored in a ConfigMap, mounted into components at `/app/rootCA.crt`, and used through the `NODE_EXTRA_CA_CERTS` environment variable.

The default certificate is for demonstration purposes only. Replace it with the certificate required by your deployment.

## Component certificates

Location: `harmonize.certificates.<component>`

| Parameter | Type | Description |
|  --- | --- | --- |
| `enabled` | boolean | Enables TLS certificate configuration for this component. |
| `existingSecret` | string | Reference to an existing Kubernetes TLS secret. |
| `privateKey` | string | PEM-encoded private key. |
| `certificate` | string | PEM-encoded X.509 certificate. |


Supported certificate formats documented in this reference include PEM, PKCS#12, and PKCS#8.

### Existing TLS secret

When `existingSecret` is used, the referenced Kubernetes TLS secret must contain:

| Secret key | Description |
|  --- | --- |
| `tls.crt` | Base64-encoded certificate. |
| `tls.key` | Base64-encoded private key. |


Example secret shape:


```yaml
apiVersion: v1
kind: Secret
metadata:
  name: frontend-tls-secret
type: kubernetes.io/tls
data:
  tls.crt: <base64-encoded-certificate>
  tls.key: <base64-encoded-private-key>
```

### Certificate inheritance

Most component certificates inherit from the `frontend` certificate by default. Override a component certificate only when that component needs a different certificate than the default frontend certificate.


```yaml
harmonize:
  certificates:
    frontend:
      enabled: true
      existingSecret: "wildcard-tls"
    keycloak:
      existingSecret: "wildcard-tls"
    oauth:
      existingSecret: "wildcard-tls"
```

### Additional certificates

To mount additional CA certificates or custom certificates into components, use `common.persistence`:


```yaml
common:
  persistence:
    myCert:
      enabled: true
      name: my-certificate
      type: configMap
      mountPath: /etc/ssl/certs/myCert.crt
      subPath: myCert.crt
```

## HTTP proxy

Location: `harmonize.httpProxy`

| Parameter | Type | Default | Description |
|  --- | --- | --- | --- |
| `enabled` | boolean | `false` | Enables HTTP proxy configuration. |
| `protocol` | string | `"https"` | Proxy protocol. Possible values: `http`, `https`. |
| `host` | string | `""` | Proxy server hostname. |
| `port` | integer | - | Proxy server port. |
| `username` | string | `""` | Proxy authentication username. |
| `password` | string | `""` | Proxy authentication password. |
| `indexers` | array | `[]` | Indexers that use the proxy. |


The proxy URL is constructed from the proxy fields:


```text
{protocol}://{username}:{password}@{host}:{port}
```

When proxy configuration is applied to an indexer, the deployment sets `HTTP_PROXY` and `HTTPS_PROXY` for that indexer.

## Ingress

Global URL settings are configured under `harmonize.urls`. Component ingress settings are configured under `components.<component>.ingress`.

### Global URL fields

| Parameter | Type | Default | Description |
|  --- | --- | --- | --- |
| `harmonize.urls.tls` | boolean | `false` | Enables TLS for ingress endpoints. |
| `harmonize.urls.base` | string | See release values | Base URL for service subdomains. |


### Component ingress fields

| Parameter | Type | Description |
|  --- | --- | --- |
| `enabled` | boolean | Enables ingress for this component. |
| `className` | string | Ingress class name. |
| `annotations` | object | Ingress annotations. |
| `hosts` | array | Hostname and path rules. |
| `tls` | array | TLS secret and hostname mappings. |


## Example

This example shows root CA, component certificate, proxy, and ingress fields together:


```yaml
harmonize:
  urls:
    base: "custody.example.com"
    tls: true

  certificates:
    rootCA:
      enabled: true
      certificate: |-
        -----BEGIN CERTIFICATE-----
        <root-ca-certificate>
        -----END CERTIFICATE-----
    frontend:
      enabled: true
      existingSecret: "frontend-tls"

  httpProxy:
    enabled: true
    protocol: "https"
    host: "proxy.example.com"
    port: 8080
    username: "<proxy-user>"
    password: "<proxy-password>"
    indexers:
      - nbxplorer
      - eth-indexer

components:
  frontend:
    ingress:
      enabled: true
      className: "nginx"
      hosts:
        - host: "app.custody.example.com"
          paths:
            - path: /
              pathType: Prefix
      tls:
        - secretName: frontend-tls
          hosts:
            - app.custody.example.com
```

## Related topics

- [Secure communication](/products/custody/v1.36/overview/security/secure-communication)
- [Networking planning](/products/custody/v1.36/deployment/planning/networking)
- [URL configuration](/products/custody/v1.36/deployment/reference/urls)
- [PostgreSQL configuration](/products/custody/v1.36/deployment/reference/postgresql)
- [AMQP configuration](/products/custody/v1.36/deployment/reference/amqp)