Single Container

Documentation for the image tag 1.0.0-rc1.1. See Versions for the documentation of a release.

Single Container

All services except EST run in one container, supervised inside it, sharing one /data volume. Redis runs inside the container, bound to loopback with nothing on disk. This is the quickest way to a working CA.

Not included: EST. If you need EST, use Multi Container.

Run it

docker run -d --name qertum \
  -e QERTUM_HOST=192.168.1.50 \
  -e IdentityService__SeedAdminPassword='choose-a-strong-password' \
  -p 8080:8080 -p 8081:8081 -p 8082:8082 -p 8083:8083 \
  -v qertum-data:/data \
  --restart unless-stopped \
  qertum/qertum:1.0.0-rc1.1

• QERTUM_HOST is the name or IP address that browsers and ACME clients use to reach this host. Set it. The default, localhost, only works from the machine itself. Browse to Qertum with exactly the text you gave as QERTUM_HOST: localhost, 127.0.0.1 and the machine's LAN IP are different values, and a browser address that differs from it fails sign-in with The specified 'redirect_uri' is not valid for this client application (ID2043).
• Published host ports must equal the container ports. Qertum advertises these port numbers in the OIDC authority and the ACME directory URL. If you must remap one, set the matching WEB_PORT, IDENTITY_PORT, API_PORT or ACME_PORT to the same value.
• /data can be a named volume (as above) or a bind mount such as /srv/qertum:/data. The container starts as root only to make /data writable for its unprivileged user (UID 1654), then drops privileges.

Check it started:

docker ps --filter name=qertum         # STATUS should become "healthy"
docker logs qertum | tail -30           # lists the web, identity, API and ACME addresses

First login and onboarding

1. Browse to http://<QERTUM_HOST>:8080.
2. Sign in as admin with the password you set in IdentityService__SeedAdminPassword. If you left it unset, the password is password, and the first login forces you to change it before anything else works.
3. Follow the onboarding flow to create or import your root CA. You can generate a root in the browser, import an existing one (PEM, PKCS#7 or PKCS#12), or use an offline root with an online intermediate.
4. Download the root certificate and install it as a trust anchor on every client that will rely on it. See TLS and Reverse Proxy.

The seed password is read only while the identity store is empty. Changing the variable later does not change an existing password.

Two protocol defaults that start closed

• ACME http-01 validates nothing until you add at least one network (CIDR) that the CA may connect to under Settings. The list starts empty. dns-01 does not use it.
• ACME and EST requests start Pending and wait for an approver unless you turn on auto-approval in Settings.

Point an ACME client at it

The directory URL is http://<QERTUM_HOST>:8083/acme/directory. The enrollment wizard in the web UI shows ready-to-paste examples for certbot, acme.sh and cert-manager. The client must already trust your root, or its TLS handshake fails; do not use --insecure.

Compose file

The same run as a Compose file:

services:
  qertum:
    image: qertum/qertum:1.0.0-rc1.1
    container_name: qertum
    restart: unless-stopped
    environment:
      QERTUM_HOST: "192.168.1.50"
      IdentityService__SeedAdminPassword: "choose-a-strong-password"
    ports:
      - "8080:8080"
      - "8081:8081"
      - "8082:8082"
      - "8083:8083"
    volumes:
      - qertum-data:/data
volumes:
  qertum-data:

Stop, start, update

docker stop qertum          # graceful: waits for the services to exit
docker start qertum
docker logs -f qertum

To install a newer release, see Upgrading. Take a backup first.

Limits to know

• One container means one failure domain and no independent scaling. Fine for a lab or a small CA.
• Plain HTTP puts tokens and credentials on the wire. Keep it on a trusted LAN, or put TLS in front of the web, identity and API ports. ACME is never put behind a TLS-terminating proxy. See TLS and Reverse Proxy.