Skip to main content

Configuration

We recommend using docker compose to configure the software. A simple exemplary configuration could look like:

---
services:
  hash2sign-pdf-preparation:
    container_name: hash2sign-pdf-preparation
    image: reg.a-trust.at/hash2sign/hash2sign-pdf-preparation:2.0.1.0@sha256:fe2fe5f3a76a26ac15de6b113a86ec1a580ec668ed012c996a86dd8fd1ef1886
    restart: unless-stopped
	  
  hash2sign:
    container_name: hash2sign
	image: reg.a-trust.at/hash2sign/hash2sign:1.7.1.0@sha256:e51cdc25752e27819770638bbfb8f9f6ff24aac933ede69504c2dac34536db9c
    restart: unless-stopped
    environment:
      Hash2Sign__HandySignatureServer: https://hs-abnahme.a-trust.at/mobile/rest/
      Hash2Sign__HandySignatureApiKey: YOUR_API_KEY
      Hash2Sign__PreparationUrl: http://hash2sign-pdf-preparation:8080/PDFPreparation/
      Hash2Sign__TimestampUrl: https://hs-abnahme.a-trust.at/timestamp/
      Hash2Sign__TimestampUser: test
      Hash2Sign__TimestampPassword: test
      ConnectionStrings__Hash2Sign: Server=hash2sign-db,1433;Database=hash2sign;UID=sa;Password=ChangeMe!;Encrypt=False;TrustServerCertificate=true
      ASPNETCORE_URLS: http://+:22008
      ASPNETCORE_HTTP_PORT: 22008

    ports:
      - 80:22008
	  
    depends_on:
      - hash2sign-pdf-preparation

In the following sections, we explain the configuration options in detail.

hash2sign-pdf-preparation image

For this image, no configuration is required.

Port mapping​

If the service should be tested from outside, a mapping could be defined:

   ports:
     - 1111:8080

hash2sign image

This image has various configuration options, which will now be explained in detail.

A-Trust QES​

The values Hash2Sign__HandySignatureServer and Hash2Sign__HandySignatureApiKey are used to configure access to the A-Trust backend. The server should be set to either https://hs-abnahme.a-trust.at/mobile/rest/ for development or https://service.a-trust.at/mobile/rest/ for production. Therefore, a development configuration would look like:

Hash2Sign__HandySignatureServer: https://hs-abnahme.a-trust.at/mobile/rest/
Hash2Sign__HandySignatureApiKey: YOUR_API_KEY

The respective API-Key are distributed by A-Trust via secure channel. The configuration is only required for qualified electronic signatures.

PDF preparation​

The Hash2Sign__PreparationUrl specifies where the pdf preparation service can be reached. If both images run inside docker, http://hash2sign-pdf-preparation:8080/PDFPreparation/ can be used:

Hash2Sign__PreparationUrl: http://hash2sign-pdf-preparation:8080/PDFPreparation/

Timestamp​

If all 3 timestamp values a configured, a timestamp is added to the PDF signature. For testing, the following values can be used:

Hash2Sign__TimestampUrl: https://hs-abnahme.a-trust.at/timestamp/
Hash2Sign__TimestampUser: test
Hash2Sign__TimestampPassword: test

For production, you receive dedicated credentials:

Hash2Sign__TimestampUrl: https://timestamp.a-trust.at/
Hash2Sign__TimestampUser: YOUR_USER
Hash2Sign__TimestampPassword: YOUR_PASSWORD

Database​

The database is configured via ConnectionStrings__Hash2Sign. e.g.:

ConnectionStrings__Hash2Sign: Server=hash2sign-db,1433;Database=hash2sign;UID=sa;Password=ChangeMe!;Encrypt=False;TrustServerCertificate=true

Seal​

For adding electronic seals to pdf documents, Hash2Sign__SealUrl must be set. For testing, the following value can be used:

Hash2Sign__SealUrl: https://test.seal.a-trust.at/SealQualified/v1

Additionally, it is required to configure the authentication and seal certificate for the respective API-Key.

Short term certificates​

When short term certificate signatures should be used, Hash2Sign__ShortTermUrl must be defined: For testing purposes, the following value can be used:

Hash2Sign__ShortTermUrl: https://hs-abnahme.a-trust.at/einmalzertifikate

Base path​

When running the software behind a proxy, the basepath can be set with Hash2Sign__BasePath, e.g.:

Hash2Sign__BasePath: https://testbox.a-trust.at/testboxrest

This replaces the basepath in URLs. E.g., when a signature batch is created on http://192.168.0.1/v2/signaturebatches, the location header is set to https://testbox.a-trust.at/testboxrest/v2/signaturebatches/{some_ticket} .

.NET hosting options​

We recommend running the application behind a proxy, e.g. nginx. Depending on the concrete setup, the application must be configured accordingly.

The following configuration serves the application via HTTP:

environment:
    ASPNETCORE_URLS: http://+:22008
    ASPNETCORE_HTTP_PORT: 22008
ports:
    - 80:22008

When the application should be served via HTTPS, a certificate is required. Therefore, a volume is required. Put the certificate there, and adjust the configuration like:

volumes:
    - /some/where/.../config:/app/config
environment:
    ASPNETCORE_URLS: https://+:22007
    ASPNETCORE_HTTP_PORT: 22007
    ASPNETCORE_Kestrel__Certificates__Default__Password: CERTIFICATE_PASSWORD
    ASPNETCORE_Kestrel__Certificates__Default__Path: /app/config/server.pfx	
ports:
    - 443:22008

For details see: https://learn.microsoft.com/en-us/aspnet/core/fundamentals/host/web-host?view=aspnetcore-8.0#server-urls

Long term validation​

If long term validation (LTV) is enabled, an LTV PDF update is added to the PDF document. The update contains the used certificates, as well as validation information, for the signature. To enable LTV, set the following value:

Hash2Sign__AddLtvData: true