EventStore Configurator

Specification

Certificates

Configuration

Client connection

Certificates

We have a certificate generation tool, which creates certificated adapted for EventStoreDB.

Download the tool

Download and extract the binary from the tool repository Releases page.

On macOS you will get a warning that the binary is not trusted. You will have to run the tool from Finder once. Right click on the es-gencert-cli binary and choose Open. Then, choose Open again in the warning window. The tool will run once in the terminal window. From that moment on you will be run the tool using the command line.

In the directory where you'll be running the tool, create a certs subdirectory.

mkdir certs

Generate the CA certificate

Then, generate the CA certificate, which you'd need to trust for each of the nodes:

./es-gencert-cli create-ca -out ./certs/ca

By default, the tool will create the ca directory in the certs directory you created earlier and add two files there:

ca.crt and ca.key.

Generate certificates for nodes

You need to generate certificates signed by the CA for each node as described below.

Node 1

Subject Name - Common Name (CN):

eventstoredb-node

Ext: Subject Alternative Name (SAN)

DNS Name

[not provided]

Ext: Subject Alternative Name (SAN)

DNS Name

[not provided]

Ext: Subject Alternative Name (SAN)

IP Address

[not provided]

Command for the node certificate generation:

./es-gencert-cli create-node -ca-certificate ./certs/ca/ca.crt -ca-key ./certs/ca/ca.key -out ./certs/node1  -ip-addresses [not provided]  -dns-names [not provided]

Node 2

Subject Name - Common Name (CN):

eventstoredb-node

Ext: Subject Alternative Name (SAN)

DNS Name

[not provided]

Ext: Subject Alternative Name (SAN)

DNS Name

[not provided]

Ext: Subject Alternative Name (SAN)

IP Address

[not provided]

Command for the node certificate generation:

./es-gencert-cli create-node -ca-certificate ./certs/ca/ca.crt -ca-key ./certs/ca/ca.key -out ./certs/node2  -ip-addresses [not provided]  -dns-names [not provided]

Node 3

Subject Name - Common Name (CN):

eventstoredb-node

Ext: Subject Alternative Name (SAN)

DNS Name

[not provided]

Ext: Subject Alternative Name (SAN)

DNS Name

[not provided]

Ext: Subject Alternative Name (SAN)

IP Address

[not provided]

Command for the node certificate generation:

./es-gencert-cli create-node -ca-certificate ./certs/ca/ca.crt -ca-key ./certs/ca/ca.key -out ./certs/node3  -ip-addresses [not provided]  -dns-names [not provided]

Copy files to servers

You will need to copy the ca.crt file to each node to /etc/eventstore/certs/ca.

In addition, you need to copy the certificate and the key for each node to the machine of the node. Both files (node.crt and node.key) need to be placed in the /etc/eventstore/certs directory of the server.

Permissions

Remember that all certificate files should have restrictive rights, otherwise the OS won't allow using them. Usually, you'd need to change rights for each certificate file to prevent the "permissions are too open" error. You can do it by running the following command:

chmod 600 [file]

EventStoreDB installation and configuration

Installation

Open-Source

Install EventStoreDB on each node

Use packagecloud private repository:

curl -s https://packagecloud.io/install/repositories/EventStore/EventStore-OSS/script.deb.sh | sudo bash
sudo apt install eventstore-oss=21.10.6

Alternatively, visit the Downloads section of the Event Store website to download the latest binaries.

After installing the package, the eventstore service doesn't start automatically. That's because you need to provide the configuration first, which includes all the necessary options for the EventStoreDB node to work.

Complete post-installation steps

Copy node.crt and node.key files to /etc/eventstore/certs on each node.
Copy the wildcard certificate and key files to /etc/eventstore/certs on each node.
Copy ca.crt file to /etc/eventstore/certs/ca on each node.
Create a file called eventstore.conf using the node configuration from the section below, for each node.
Place the file to the /etc/eventstore directory of the node.
We recommend that when using Linux you set the 'open file limit' to a high number. The precise value depends on your use case, but at least between 30,000 and 60,000.
Start the service using sudo systemctl start eventstore command.
Start the server by EventStore.ClusterNode.exe --config /etc/eventstore\eventstore.conf

Configuration

Node 1

---
# Paths
Db: /var/lib/eventstore
Index: /var/lib/eventstore/index
Log: /var/log/eventstore

# Certificates configuration
CertificateFile: /etc/eventstore/certs/node.crt
CertificatePrivateKeyFile: /etc/eventstore/certs/node.key
TrustedRootCertificatesPath: /etc/eventstore/certs/ca

# Network configuration
IntIp: [not provided]
ExtIp: [not provided]
HttpPort: 2113
IntTcpPort: 1112
ExtTcpPort: 1113
EnableExternalTcp: true
EnableAtomPubOverHTTP: true

# Cluster gossip
ClusterSize: 3
DiscoverViaDns: true
ClusterDns: [not provided]

# Projections configuration
RunProjections: All

Node 2

---
# Paths
Db: /var/lib/eventstore
Index: /var/lib/eventstore/index
Log: /var/log/eventstore

# Certificates configuration
CertificateFile: /etc/eventstore/certs/node.crt
CertificatePrivateKeyFile: /etc/eventstore/certs/node.key
TrustedRootCertificatesPath: /etc/eventstore/certs/ca

# Network configuration
IntIp: [not provided]
ExtIp: [not provided]
HttpPort: 2113
IntTcpPort: 1112
ExtTcpPort: 1113
EnableExternalTcp: true
EnableAtomPubOverHTTP: true

# Cluster gossip
ClusterSize: 3
DiscoverViaDns: true
ClusterDns: [not provided]

# Projections configuration
RunProjections: All

Node 3

---
# Paths
Db: /var/lib/eventstore
Index: /var/lib/eventstore/index
Log: /var/log/eventstore

# Certificates configuration
CertificateFile: /etc/eventstore/certs/node.crt
CertificatePrivateKeyFile: /etc/eventstore/certs/node.key
TrustedRootCertificatesPath: /etc/eventstore/certs/ca

# Network configuration
IntIp: [not provided]
ExtIp: [not provided]
HttpPort: 2113
IntTcpPort: 1112
ExtTcpPort: 1113
EnableExternalTcp: true
EnableAtomPubOverHTTP: true

# Cluster gossip
ClusterSize: 3
DiscoverViaDns: true
ClusterDns: [not provided]

# Projections configuration
RunProjections: All