Deploy Nuts-node

Scenario

There ifare two ways to run the Nuts part of your system. Choose one:

Option What it is When to choose it Nuts node (default) The Nuts node on its own. You build the integration with your EHR yourself, following this book. You want full control, or you already integrate with the Nuts node Nuts Knooppunt Has an embedded Nuts node, plus components for integrating with the MinVWS Generic Functions (Generieke Functies), such as a policy decision point (PDP) for access decisions and Mitz integration You want tomore useready-made Nuts-nodeparts, (default)

deploy Nuts-node using

Scenario ifor you wantintegrate towith usethe Generic Functions. See the Knooppunt

 section below

YouOne couldNuts usenode thisper vendor (and per environment) hosts all of the vendor's care organizations.

Nuts node

The Nuts node documentation describes deployment guidein detail. Start with the recommended deployment and/orand thisrunning docker-composeon fileDocker.

Image

Use nutsfoundation/nuts-node from Docker Hub, with a fixed version (nutsfoundation/nuts-node:<version>), not latest. For the latest version, see the tags on Docker Hub or the GitHub releases. Images are signed; see verifying image signatures.

Configuration

The settings you need for a spec v2 use case. Each can be set in nuts.yaml or as an environment variable (NUTS_ + the name in capitals, with _ instead of ., e.g. NUTS_HTTP_INTERNAL_ADDRESS).

Setting Value Why url Your node's public URL, e.g. https://nuts.example.com Used in your did:web DIDs and OAuth2 URLs. Must be HTTPS. strictmode true (default) Forbids insecure settings. Only turn it off on development or test systems without production data. didmethods web Spec v2 only uses did:web (see "Create a subject"). http.internal.address e.g. :8081 The internal API. Default 127.0.0.1:8081, which can't be reached from outside the container. storage.sql.connection Connection string to PostgreSQL or MySQL The default, SQLite, isn't meant for production. crypto.storage vaultkv (HashiCorp Vault) or azure-keyvault Where private keys are stored. fs (on disk) is only for development. discovery.definitions.directory Directory with the Discovery Service definitions See chapter "Configure the node for a use case". policy.directory Directory with the policy definitions See chapter "Configure the node for a use case".

Network

Put a reverse proxy in front of the node that terminates TLS. See "Endpoints and TLS certificates" for which endpoints to expose, and with which certificate. Never expose the internal API (:8081) to the internet. If the node runs on a subpath (e.g. https://example.com/nuts), rewrite the .well-known URLs. See "Configure url rewrite for OAuth".

Check that it works

GET http://<internal address>/health returns 200 OK with status UP. After creating your first subject, check that its DID resolves from the internet (see "Create a subject").

Nuts Knooppunt

Knooppunt has an embedded Nuts node, so the steps in this book still apply. It also has a policy decision point (PDP) that helps you decide whether to allow an inbound query (see "Validate the access token").

See the Knooppunt documentation, in particular:

Deployment Configuration Integration, including the PDP An example docker-compose.yml