KERIA Deployment Best Practices

[kentbull]

If you are deploying KERIA and could use some guidance then this discussion is for you. This will be updated as I gain new information on KERIA, KERIpy, and other KERI deployment best practices on any KERI implementation.

Overview

TOC

1. Deployment
   1. Component List
   2. Container-based deployments
      1. Kubernetes
2. Configuration
   1. KERIA configuration file
   2. Witness configuration file
   3. Signify Client Configuration
3. Common Problems
   1. 401 Unauthorized on OOBI resolutions; IPEX Grant Notifications never showing up

Contents

Deployment

Component List

A basic component list for a KERIA deployment includes the following:

1. A KERIA server (this repo).
2. One or more witness servers.
3. An ACDC schema hosting server (could be an NGINX server or the vLEI server)
4. Web apps running a Signify Client (SignifyTS or SignifyPy), like the Cardano Foundation's cf-identity-wallet

Container-based deployments

Kubernetes

Configuration

Common Problems

401 Unauthorized on OOBI resolutions

Problem:

This can often happen when you have a network load balancer or firewall that has filtering rules that do not properly forward HTTP headers or otherwise allow requests from the HIO HTTP client KERIA uses to make HTTP calls to witnesses, KERIA agents, and schema hosting servers.

Solution

Relax the filtering rules on your load balancer or firewall. This solution is lacking specificity and will be extended as the specific guidance for load balancers and firewalls are determined.