Configure each service

For the complete documentation index see: llms.txt

All documentation pages available in markdown.

The get-started tutorial connected the authorization service’s write path in Aerospike to the support-search path in Elasticsearch over plain HTTP. This section adds the certificates and credentials each service needs to keep that same path encrypted, from the write in Aerospike to a support agent’s search in Elasticsearch.

Create aerospike.conf in the project directory. The file adds a network.tls configuration for the asd.aerospike.com identity, then enables mTLS on the esDC Cross-Datacenter Replication (XDR) configuration.

service {
    cluster-name elasticsearch-demo
    feature-key-file /etc/aerospike/features.conf
}

logging {
    console {
        context any info
    }
}

network {
    tls asd.aerospike.com {
        cert-file /etc/aerospike/security/asd.aerospike.com.crt
        key-file  /etc/aerospike/security/asd.aerospike.com.key
        ca-file   /etc/aerospike/security/ca.crt
    }

    service {
        address any
        port 3000
    }
    heartbeat {
        mode mesh
        port 3002
        address any
        interval 150
        timeout 10
    }
    fabric {
        port 3001
        address any
    }
    info {
        port 3003
        address any
    }
}

namespace test {
    replication-factor 1
    storage-engine memory {
        data-size 1G
    }
    nsup-period 10
}

xdr {
    dc esDC {
        connector true
        tls-name asd.aerospike.com
        node-address-port aerospike-elasticsearch-outbound 8443 connector.aerospike.com
        namespace test {
        }
    }
}

The network.tls configuration gives XDR the Aerospike client certificate, private key, and trusted CA. In esDC, tls-name selects that TLS context, and the TLS name definition after the port in node-address-port identifies the Elasticsearch connector as connector.aerospike.com. See Secure XDR with TLS for the complete XDR TLS options.

Create aerospike-elasticsearch-outbound.yml in the project directory. The file adds a service.tls configuration for the incoming XDR connection and a tls-config under es-client for the outgoing Elasticsearch connection.

service:
    tls:
        port: 8443
        mutual-auth: true
        allowed-peer-names:
            - asd.aerospike.com
        key-store:
            store-type: PEM
            store-file: /etc/aerospike-elasticsearch-outbound/security/connector.aerospike.com.key
            certificate-chain-files: /etc/aerospike-elasticsearch-outbound/security/connector.aerospike.com.crt
        trust-store:
            store-type: PEM
            certificate-files: /etc/aerospike-elasticsearch-outbound/security/ca.crt
    manage:
        address: 0.0.0.0
        port: 8902

logging:
    enable-console-logging: true

routing:
    mode: static
    destination: aerospike

doc-id:
    source: digest

format:
    mode: custom
    batch-formatter-class: com.aerospike.connect.elasticsearch.outbound.formatter.ElasticsearchDefaultBatchFormatter
    payload-format:
        mode: flat-json
        metadata-key: metadata

es-client:
    cluster-config:
        type: on-prem
        nodes:
            - host:
                  hostname: elasticsearch
                  port: 9200
                  scheme: https
    auth-config:
        type: basic
        username: elastic
        password-file: /etc/aerospike-elasticsearch-outbound/security/elastic-password.txt
    tls-config:
        trust-store:
            store-type: PEM
            certificate-files: /etc/aerospike-elasticsearch-outbound/security/ca.crt

The service.tls settings require a certificate issued by the local CA with the peer name asd.aerospike.com. The Elasticsearch connector presents its own certificate from key-store. Under es-client, the Elasticsearch connector uses HTTPS, reads the elastic password from a file, and trusts Elasticsearch certificates issued by the local CA.

For more options in this section, see Connector settings and Elasticsearch client.

Create elasticsearch.yml to enable authentication and serve HTTPS on port 9200.
elasticsearch.yml
```
cluster.name: aerospike-demo
node.name: elasticsearch
network.host: 0.0.0.0
discovery.type: single-node

xpack.security.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: certs/elasticsearch.local.key
xpack.security.http.ssl.certificate: certs/elasticsearch.local.crt
```
The security setting activates the built-in elastic user and requires authentication. The HTTP SSL settings serve the Elasticsearch certificate over HTTPS. Transport-layer TLS between Elasticsearch nodes is not enabled in this single-node tutorial.
Create security/elastic-password.txt with a dev-only password for the elastic user. The Elasticsearch connector reads this value when it authenticates to Elasticsearch. The built-in elastic superuser is appropriate only for this local tutorial. For longer-lived environments, use a dedicated account or API key with only the permissions the Elasticsearch connector requires.
Terminal
```
echo -n "changeme-for-dev" > security/elastic-password.txt
chmod 0640 security/elastic-password.txt
```

Checkpoint

Before you compose the stack, your project directory contains these configuration and security files:

Directoryaerospike-elastic-tls/
- .env
- aerospike-elasticsearch-outbound.yml
- aerospike.conf
- elasticsearch.yml
- features.conf
- Directorysecurity/
  - asd.aerospike.com.crt
  - asd.aerospike.com.key
  - ca.crt
  - connector.aerospike.com.crt
  - connector.aerospike.com.key
  - elastic-password.txt
  - elasticsearch.local.crt
  - elasticsearch.local.key