1. Install Trust Router

We’re now ready to install the Trust Router software and its required dependencies. Install the software by running the following command:

apk add trust_router moonshot

2. Configure Trust Router

Next, we need to configure the Trust Router.

2.1. RadSec

2.1.1. APC TLS

First, you will need a copy of a client key and certificate (and appropriate CA) from the APC(s) that your Trust Router serves. Copy them onto the filesystem.

2.1.2. Connection to APC

Next, we need to configure the RadSec configuration for the APC. We do this by creating a file at /etc/radsec.conf with the following:

realm gss-eap {
	type = "TLS"
	cacertfile = "/etc/pki/certs/tr-ca.pem"
	certfile = "/etc/pki/certs/tr-client.pem"
	certkeyfile = "/etc/pki/private/tr-client.key"
	disable_hostname_check = yes
	server {
		hostname = "YOUR_APC_HOSTNAME"
		service = "2083"
		secret = "radsec"
	}
}

Then check the file and the certificates can be read by the Trust Router user:

sudo -u trustrouter cat /etc/radsec.conf  /etc/pki/certs/tr-*.* /etc/pki/private/tr-*.*

2.2. Trust Router

2.2.1. Daemon Configuration

Your Trust Router will need to have a few core configuration items set. To do this:

1. Open the default instance's main configuration file at /etc/trust_router/default-internal.cfg for editing.
   
   1. Change the hostname to the (fully qualified) hostname of your Trust Router.

2.2.2. Moonshot Configuration

Moonshot, you say? Yes, Trust Router uses Moonshot to authenticate and secure all communications between Trust Router clients and servers. So, you will need to configure the trust router user to make use of the Moonshot flatstore (i.e. telling Moonshot that this is a special system account, not a regular user account), and you will need to import a set of credentials for your Trust Router to use.

1. Import it using the moonshot-webp command (as the trustrouter user):

   su - --shell=/bin/bash trustrouter
   moonshot-webp -f [path to credential file]

   The credentials file will be given to you by the administrator of the APC.

2.2.3. Default Peer

If your Trust Router is going to run in a wider trust network, then you can configure your Trust Router's default peer - i.e. the Trust Router it sends its clients to when they ask it to locate a Moonshot entity that your Trust Router doesn't know about. To do this:

1. Open /etc/trust_router/peering.cfg for editing. Change the content as follows:

   {
   "default_servers": [
    "[hostname of trust router]"
    ]
   }

   Example

   If you were configuring your default Trust Router peer to be Janet's Trust Router at tr.moonshot.ja.net, its peering.cfg file would look like this:

   {
   "default_servers": [
    "tr.moonshot.ja.net"
    ]
   }

2.2.4. Configure your Trust Router

A trust router requires a trust configuration to function correctly. See the trust configuration file for more information.

Place an appropriate trusts.cfg file info the /etc/trust_router directory and symbolically link it into the default configuration directory:

2.2.5. Start your Trust Router

You are now ready to restart your Trust Router and test it. To do this:

1. As root, start the Trust Router daemon:

   rc-service trust_router start

3. Testing

To test your trust router, you should attempt a TIDC request on a Moonshot service connected to your trust router. If you have defined a default peer, the TIDC request may take a little longer, but it should succeed.

If it fails, please contact us.

4. Next Steps

At this point, you now have a Trust Router.

4.1. Automatically start the software

4.1.1. Trust Router

To automatically start Trust Router, issue the following command (as root):

rc-update add trust_router
rc-service trust_router start

If this is working correctly, you should see trust_router running as a daemon process.