# Deploy the Nuts node

There are two ways to run the Nuts part of your system. Choose one:

| Option | What it is | When to choose it |
|---|---|---|
| **Nuts node** (default) | The Nuts node on its own. You build the integration with your EHR yourself, following this book. | You want full control, or you already integrate with the Nuts node |
| **Nuts Knooppunt** | Has an embedded Nuts node, plus components for integrating with the MinVWS Generic Functions (Generieke Functies), such as a policy decision point (PDP) for access decisions and Mitz integration | You want more ready-made parts, or you integrate with the Generic Functions. See the Knooppunt section below |

One Nuts node per vendor (and per environment) hosts all of the vendor's care organizations.

## Nuts node

The [Nuts node documentation](https://nuts-node.readthedocs.io/en/latest/) describes deployment in detail. Start with the [recommended deployment](https://nuts-node.readthedocs.io/en/latest/pages/deployment/recommended-deployment.html) and [running on Docker](https://nuts-node.readthedocs.io/en/latest/pages/deployment/docker.html).

### Install

The Nuts node is published as:

| Form | Where |
|---|---|
| Docker image | `nutsfoundation/nuts-node` on [Docker Hub](https://hub.docker.com/r/nutsfoundation/nuts-node/tags) |
| Helm chart, for Kubernetes | Helm repository `https://nuts-foundation.github.io/nuts-node`, chart `nuts-node-chart` ([source](https://github.com/nuts-foundation/nuts-node/tree/master/charts/nuts-node)) |
| Binaries (Linux, amd64 and arm64) | [GitHub releases](https://github.com/nuts-foundation/nuts-node/releases) |

Use a fixed version (e.g. `nutsfoundation/nuts-node:<version>`), not `latest`. For the latest version, see the [GitHub releases](https://github.com/nuts-foundation/nuts-node/releases). Docker images are signed; see [verifying image signatures](https://nuts-node.readthedocs.io/en/latest/pages/deployment/docker.html#verifying-image-signatures).

### Configuration

The settings you need for a spec v2 use case. Each can be set in `nuts.yaml` or as an environment variable (`NUTS_` + the name in capitals, with `_` instead of `.`, e.g. `NUTS_HTTP_INTERNAL_ADDRESS`).

| Setting | Value | Why |
|---|---|---|
| `url` | Your node's public URL, e.g. `https://nuts.example.com` | Used in your did:web DIDs and OAuth2 URLs. Must be HTTPS. |
| `strictmode` | `true` (default) | Forbids insecure settings. Only turn it off on development or test systems without production data. |
| `didmethods` | `web` | Spec v2 only uses did:web (see "Create a subject"). |
| `http.internal.address` | e.g. `:8081` | The internal API. Default `127.0.0.1:8081`, which can't be reached from outside the container. |
| `storage.sql.connection` | Connection string to PostgreSQL, MySQL or SQL Server (including Azure SQL) | The default, SQLite, isn't meant for production. |
| `crypto.storage` | `vaultkv` (HashiCorp Vault) or `azure-keyvault` | Where private keys are stored. `fs` (on disk) is only for development. |
| `discovery.definitions.directory` | Directory with the Discovery Service definitions | See chapter "Configure the node for a use case". |
| `policy.directory` | Directory with the policy definitions | See chapter "Configure the node for a use case". |

### Network

- Put a reverse proxy in front of the node that terminates TLS. See "Endpoints and TLS certificates" for which endpoints to expose, and with which certificate.
- Never expose the internal API (`:8081`) to the internet.
- If the node runs on a subpath (e.g. `https://example.com/nuts`), rewrite the `.well-known` URLs. See "Configure url rewrite for OAuth".

### Check that it works

- `GET <internal Nuts interface>/health` returns `200 OK` with status `UP`.
- After creating your first subject, check that its DID resolves from the internet (see "Create a subject").

## Nuts Knooppunt

Knooppunt has an embedded Nuts node, so the steps in this book still apply. It also has a policy decision point (PDP) that helps you decide whether to allow an inbound query (see "Validate the access token").

See the [Knooppunt documentation](https://github.com/nuts-foundation/nuts-knooppunt/tree/main/docs), in particular:

- [Deployment](https://github.com/nuts-foundation/nuts-knooppunt/blob/main/docs/DEPLOYMENT.md)
- [Configuration](https://github.com/nuts-foundation/nuts-knooppunt/blob/main/docs/CONFIGURATION.md)
- [Integration](https://github.com/nuts-foundation/nuts-knooppunt/blob/main/docs/INTEGRATION.md), including the PDP
- An example [docker-compose.yml](https://github.com/nuts-foundation/nuts-knooppunt/blob/main/docker-compose.yml)