Connect SignServer to external database
All production deployments should use an external database for data persistence. The following sections provide information on connecting to an external database along with examples for different databases.
The following databases are supported:
MariaDB
MySQL
Microsoft SQL Server
PostgreSQL
Oracle
Connect SignServer to an external database
All production deployments of SignServer should use an external database for data persistence.
The following sections provides examples for connecting to different databases.
Reference Kubernetes Secret
Create a Kubernetes secret to store the database credentials, then reference it in values.yaml using envFrom
to make all keys and values available to SignServer.
Create a dedicated Kubernetes secret for storing the database credentials:
BASHkubectl create secret generic signserver-db-credentials \ --from-literal=DATABASE_USER='signserver' \ --from-literal=DATABASE_PASSWORD='foo123'
Make all keys and values of the secret available to SignServer by referencing it in
values.yaml
:YAMLsignserver: env: DATABASE_JDBC_URL: <jdbc connection string> envFrom: - secretRef: name: signserver-db-credentials
Reference specific credentials
Reference specific credentials in an existing secret , for example, signserver-credentials
using envRaw
:
signserver:
env:
DATABASE_JDBC_URL: <jdbc connection string>
envRaw:
- name: DATABASE_PASSWORD
valueFrom:
secretKeyRef:
name: signserver-credentials
key: database_password
- name: DATABASE_USER
valueFrom:
secretKeyRef:
name: signserver-credentials
key: database_user
Use plain text values
This method is only recommended for testing purposes.
For testing, you can optionally use env
and plain text values:
signserver:
env:
DATABASE_JDBC_URL: <jdbc connection string>
DATABASE_USER: signserver
DATABASE_PASSWORD: foo123
MariaDB
The following example shows modifications to the helm chart values file used to connect to a MariaDB database with server name mariadb-server
and database name signserverdb
using username signserver
and password foo123
:
signserver:
useEphemeralH2Database: false
env:
DATABASE_JDBC_URL: "jdbc:mariadb://signserver-mariadb:3306/signserverdb?characterEncoding=utf8"
DATABASE_USER: signserver
DATABASE_PASSWORD: foo123
PostgreSQL
The following example connects SignServer to a PostgreSQL database and uses a Kubernetes secret for storing the database username and password:
signserver:
useEphemeralH2Database: false
env:
DATABASE_JDBC_URL: jdbc:postgresql://postgresql-server:5432/signserverdb
envRaw:
- name: DATABASE_PASSWORD
valueFrom:
secretKeyRef:
name: signserver-db-credentials
key: database_password
- name: DATABASE_USER
valueFrom:
secretKeyRef:
name: signserver-db-credentials
key: database_user
Microsoft SQL Server
The following example connects SignServer to a Microsoft SQL Server database…
signserver:
env:
DATABASE_JDBC_URL: jdbc:sqlserver://mssql-server:1433;DatabaseName=signserver;encrypt=true;trustServerCertificate=false;hostNameInCertificate=*.database.windows.net;loginTimeout=30;sendStringParametersAsUnicode=false
envFrom:
- secretRef:
name: signserver-db-credentials
Oracle
The following example connects SignServer to an Oracle database using a secret that contains DATABASE_USER
and DATABASE_PASSWORD
keys:
signserver:
env:
DATABASE_JDBC_URL: jdbc:oracle:thin:@//oracle-server:1521/signserver
envFrom:
- secretRef:
name: signserver-db-credentials