Skip to content

Latest commit

 

History

History
77 lines (53 loc) · 2.31 KB

README.md

File metadata and controls

77 lines (53 loc) · 2.31 KB

YubiHSM Connector Docker

This repository contains a Dockerized version of the YubiHSM Connector, which enables communication with YubiHSM 2 devices.

Prerequisites

Files

  • Dockerfile: Contains the container build instructions
  • 70-yubihsm.rules: udev rules for YubiHSM 2 device access
  • yubihsm-connector-config.yaml: Configuration file for the YubiHSM connector

Building

Build the Docker image with:

docker build --platform linux/amd64 -t AxLabs/yubihsm-connector-docker .

Running

Run the container with the following command to ensure proper USB device access:

docker run -d \
  --name yubihsm-connector \
  --restart unless-stopped \
  --privileged \
  --device=/dev/bus/usb \
  -v /run/udev:/run/udev:ro \
  -p 12345:12345 \
  AxLabs/yubihsm-connector-docker

Run Options Explained

  • --privileged: Gives the container access to host devices
  • --device=/dev/bus/usb: Mounts the USB bus
  • -v /run/udev:/run/udev:ro: Mounts udev information (read-only)
  • -p 12345:12345: Exposes the default YubiHSM Connector port
  • --restart unless-stopped: Automatically restart the container unless manually stopped

Verifying the Connection

To verify that the connector is running properly:

curl http://localhost:12345/connector/status

You should receive a JSON response indicating the connector status.

Security Considerations

  • The container runs as a non-root user yubihsm-connector
  • USB device access is restricted through udev rules
  • Consider network security when exposing port 12345

Troubleshooting

  1. If the device is not detected:

    • Ensure the YubiHSM 2 is properly connected
    • Check that the udev rules are properly loaded
    • Verify USB permissions on the host system

  2. If the connector fails to start:

    • Check the container logs: docker logs yubihsm-connector
    • Verify the configuration in yubihsm-connector-config.yaml

License

This project is distributed under the terms of the Apache License 2.0. See LICENSE for more information.