Operate the node

Monitoring

Endpoint (internal interface)	Use it for
/health	Health checks by Docker or Kubernetes. Returns 200 OK when the node is healthy.
/status/diagnostics	Details about the node's state, for administrators
/metrics	Metrics in Prometheus format

See monitoring in the Nuts node documentation.

Backups

Back up both, and test that you can restore them:

• the SQL database (storage.sql.connection);
• the private keys (crypto.storage, e.g. HashiCorp Vault or Azure Key Vault).

Without the private keys, the node can't use its DIDs anymore, and every care organization needs a new subject, new credentials and a new registration.

Upgrades

• Read the release notes before you upgrade.
• Upgrade test and acceptance first, then production.
• Keep a fixed version in your deployment (see "Deploy Nuts-the Nuts node").

Troubleshooting

Problem	Likely cause	What to do
The node doesn't start	A Discovery Service definition can't be read	The log says which file. Use the files from the use case's IG, unchanged.
A DID doesn't resolve from the internet	Reverse proxy, TLS or DNS	See "Endpoints and TLS certificates" and check 2 in "Test your setup step by step"
Discovery registration returns 412	Missing or expired credentials, or the Discovery Server can't be reached	The response says which. Fix it and call the registration POST again: the node doesn't retry by itself.
Registration status is error	A refresh failed	error in the status says why. Fix it; the node retries at the next refresh.
You can't find a care organization that just registered	Your node updates its copy of the Discovery Service every 10 minutes by default	Wait, or check discovery.client.refreshinterval
Token request returns 412	Your wallet doesn't have the credentials the other party's policy requires	Check the wallet and the use case's policy definition
Token request returns 503	The other party's authorization server can't be reached	Check the authServerURL and your outbound network
The other party returns 401 for a token that hasn't expired	Their authorization server may have lost the token, e.g. after a restart	Request a new token with the header Cache-Control: no-cache, which skips your node's token cache. Don't do this by default: it adds load on both sides.
DPoP validation fails for incoming requests	The URL your API sees differs from the URL the requester used, e.g. after a reverse proxy rewrote it	Validate with the URL as the requester called it (see "Validate the access token")

Still stuck? Set verbosity to debug for more detail in the log, and ask on the Nuts Slack.