Skip to main content

Deploy Nuts-node

There are two ways to run the Nuts part of your system. Choose one:

Option What it is When to choose it
Nuts node (default) The Nuts node on its own. You build the integration with your EHR yourself, following this book. You want full control, or you already integrate with the Nuts node
Nuts Knooppunt Has an embedded Nuts node, plus components for integrating with the MinVWS Generic Functions (Generieke Functies), such as a policy decision point (PDP) for access decisions and Mitz integration You want more ready-made parts, or you integrate with the Generic Functions. See the Knooppunt section below

One Nuts node per vendor (and per environment) hosts all of the vendor's care organizations.

Nuts node

The Nuts node documentation describes deployment in detail. Start with the recommended deployment and running on Docker.

Image

Use nutsfoundation/nuts-node from Docker Hub, with a fixed version (nutsfoundation/nuts-node:<version>), not latest. For the latest version, see the tags on Docker Hub or the GitHub releases. Images are signed; see verifying image signatures.

Configuration

The settings you need for a spec v2 use case. Each can be set in nuts.yaml or as an environment variable (NUTS_ + the name in capitals, with _ instead of ., e.g. NUTS_HTTP_INTERNAL_ADDRESS).

Setting Value Why
url Your node's public URL, e.g. https://nuts.example.com Used in your did:web DIDs and OAuth2 URLs. Must be HTTPS.
strictmode true (default) Forbids insecure settings. Only turn it off on development or test systems without production data.
didmethods web Spec v2 only uses did:web (see "Create a subject").
http.internal.address e.g. :8081 The internal API. Default 127.0.0.1:8081, which can't be reached from outside the container.
storage.sql.connection Connection string to PostgreSQL or MySQL The default, SQLite, isn't meant for production.
crypto.storage vaultkv (HashiCorp Vault) or azure-keyvault Where private keys are stored. fs (on disk) is only for development.
discovery.definitions.directory Directory with the Discovery Service definitions See chapter "Configure the node for a use case".
policy.directory Directory with the policy definitions See chapter "Configure the node for a use case".

Network

  • Put a reverse proxy in front of the node that terminates TLS. See "Endpoints and TLS certificates" for which endpoints to expose, and with which certificate.
  • Never expose the internal API (:8081) to the internet.
  • If the node runs on a subpath (e.g. https://example.com/nuts), rewrite the .well-known URLs. See "Configure url rewrite for OAuth".

Check that it works

  • GET http://<internal address>/health returns 200 OK with status UP.
  • After creating your first subject, check that its DID resolves from the internet (see "Create a subject").

Nuts Knooppunt

Knooppunt has an embedded Nuts node, so the steps in this book still apply. It also has a policy decision point (PDP) that helps you decide whether to allow an inbound query (see "Validate the access token").

See the Knooppunt documentation, in particular: