1、最终目录结构
CURRENT_WORK_DIR ~/workspace/ca_solo
先不考虑组件之间的通信tls加密
初始 一个orderer节点，两个组织每个组织一个peer节点
/etc/hosts
127.0.0.1 orderer.cares.sh.cn
127.0.0.1 peer0.nkg.cares.sh.cn
127.0.0.1 peer0.weh.cares.com
127.0.0.1 peer0.nkg.cares.com
127.0.0.1 peer0.njairport.com
127.0.0.1 peer1.njairport.com
127.0.0.1 peer0.airwh.com
127.0.0.1 peer1.airwh.com
127.0.0.1 orderer
127.0.0.1 orderer1.cares.com2、启动 FABRIC CA
fabric-ca-server init -b admin:admin -H /home/wangcj/workspace/ca_test/servermv fabric-ca-server-config.yaml msp-config.yamlmsp-config.yaml
version: 1.4.4
port: 5054
cors:
enabled: false
origins:
- "*"
debug: false
crlsizelimit: 512000
tls:
enabled: false
certfile:
keyfile:
clientauth:
type: noclientcert
certfiles:
ca:
name: 上海民航华东凯亚系统集成有限公司
keyfile:
certfile:
chainfile:
crl:
# Specifies expiration for the generated CRL. The number of hours
# specified by this property is added to the UTC time, the resulting time
# is used to set the 'Next Update' date of the CRL.
expiry: 24h
registry:
maxenrollments: -1
identities:
- name: admin
pass: admin
type: client
affiliation: ""
attrs:
hf.Registrar.Roles: "*"
hf.Registrar.DelegateRoles: "*"
hf.Revoker: true
hf.IntermediateCA: true
hf.GenCRL: true
hf.Registrar.Attributes: "*"
hf.AffiliationMgr: true
db:
type: sqlite3
datasource: msp.db
tls:
enabled: false
certfiles:
client:
certfile:
keyfile:
affiliations:
signing:
default:
usage:
- digital signature
expiry: 8760h
profiles:
ca:
usage:
- cert sign
- crl sign
expiry: 43800h
caconstraint:
isca: true
maxpathlen: 0
tls:
usage:
- signing
- key encipherment
- server auth
- client auth
- key agreement
expiry: 8760h
csr:
cn: fabric-ca-server
keyrequest:
algo: ecdsa
size: 256
names:
- C: CN
ST: "NanJing"
L:
O: 上海民航华东凯亚系统集成有限公司
OU: 南京研发中心
hosts:
- localhost.localdomain
- localhost
ca:
expiry: 131400h
pathlength: 1
idemix:
rhpoolsize: 1000
nonceexpiration: 15s
noncesweepinterval: 15m
bccsp:
default: SW
sw:
hash: SHA2
security: 256
filekeystore:
# The directory used for the software file-based keystore
keystore: msp/keystore
cacount:
cafiles:
intermediate:
parentserver:
url:
caname:
enrollment:
hosts:
profile:
label:
tls:
certfiles:
client:
certfile:
keyfile:
cfg:
identities:
passwordattempts: 10
allowremove: true
affiliations:
allowremove: true
operations:
tls:
enabled: false
cert:
file:
key:
file:
clientAuthRequired: false
clientRootCAs:
files: []
metrics:
provider: disabled
statsd:
network: udp
address: 127.0.0.1:8125
writeInterval: 10s
prefix: servernohup fabric-ca-server start -c /home/wangcj/workspace/ca_solo/server/msp-config.yaml > /dev/null 2>&1 &3、申请证书
3.1 登记服务msp根节点
fabric-ca-client enroll -u http://admin:admin@orderer1.cares.com:5054 -H /home/wangcj/workspace/ca_solo/client/root/3.2 注册组织层级关系
fabric-ca-client affiliation add com -H /home/wangcj/workspace/ca_solo/client/root/
fabric-ca-client affiliation add com.cares -H /home/wangcj/workspace/ca_solo/client/root/
fabric-ca-client affiliation add com.cares.orderer -H /home/wangcj/workspace/ca_solo/client/root/
fabric-ca-client affiliation add com.cares.nkg -H /home/wangcj/workspace/ca_solo/client/root/
fabric-ca-client affiliation add com.cares.weh -H /home/wangcj/workspace/ca_solo/client/root/[wangcj@localhost server]$ fabric-ca-client affiliation list -H /home/wangcj/workspace/ca_solo/client/root/
affiliation: com
affiliation: com.cares
affiliation: com.cares.orderer
affiliation: com.cares.nkg
affiliation: com.cares.weh3.3 注册证书
注册证书部分参考自动脚本 reqcerts函数，此处不是很准确
3.3.1 orderer 证书
mkdir -p /home/wangcj/workspace/ca_solo/client/ordererfabric-ca-client register --id.name orderer.cares.com --id.type orderer --id.affiliation com.care.orderer --id.secret orderer-password --home /home/wangcj/workspace/ca_solo/client/root/
fabric-ca-client enroll -u http://orderer.cares.com:orderer-password@127.0.0.1:5054 --home /home/wangcj/workspace/ca_solo/client/orderer/mkdir -p /home/wangcj/workspace/ca_solo/client/orderer/msp/admincerts
cp /home/wangcj/workspace/ca_solo/client/orderer/msp/signcerts/cert.pem /home/wangcj/workspace/ca_solo/client/orderer/msp/admincerts3.3.2 NKG peer0 证书
mkdir -p /home/wangcj/workspace/ca_solo/client/nkgfabric-ca-client register --id.name peer0.nkg.cares.com --id.type peer --id.affiliation com.cares.nkg --id.secret peer-password --home /home/wangcj/workspace/ca_solo/client/root/fabric-ca-client enroll -u http://peer0.nkg.cares.com:peer-password@127.0.0.1:5054 --home /home/wangcj/workspace/ca_solo/client/nkg/mkdir -p /home/wangcj/workspace/ca_solo/client/nkg/msp/admincerts
cp /home/wangcj/workspace/ca_solo/client/nkg/msp/signcerts/cert.pem /home/wangcj/workspace/ca_solo/client/nkg/msp/admincerts3.3.3 WEH peer0 证书
mkdir -p /home/wangcj/workspace/ca_solo/client/wehfabric-ca-client register --id.name peer0.weh.cares.sh --id.type peer --id.affiliation com.cares.weh --id.secret peer-password -H /home/wangcj/workspace/ca_solo/client/root/fabric-ca-client enroll -u http://peer0.weh.cares.sh:peer-password@127.0.0.1:5054 --home /home/wangcj/workspace/ca_solo/client/weh/mkdir -p /home/wangcj/workspace/ca_solo/client/weh/msp/admincerts
cp /home/wangcj/workspace/ca_solo/client/weh/msp/signcerts/cert.pem /home/wangcj/workspace/ca_solo/client/weh/msp/admincerts4、启动FABRIC 网络
4.1 修改 configtx.yaml
---
Organizations:
- &orderCares
Name: orderCares
ID: orderCares
Policies: &orderCarestPolicies
Readers:
Type: Signature
Rule: "OR('orderCares.member')"
Writers:
Type: Signature
Rule: "OR('orderCares.member')"
Admins:
Type: Signature
Rule: "OR('orderCares.admin')"
MSPDir: /home/wangcj/workspace/ca_solo/client/orderer/msp
- &njairport
Name: njairport
ID: njairport
Policies: &njairportPolicies
Readers:
Type: Signature
Rule: "OR('njairport.member')"
Writers:
Type: Signature
Rule: "OR('njairport.member')"
Admins:
Type: Signature
Rule: "OR('njairport.admin')"
MSPDir: /home/wangcj/workspace/ca_solo/client/nkg/msp
AnchorPeers:
- Host: peer0.nkg.cares.com
port: 7051
- &airwh
Name: airwh
ID: airwh
Policies: &airwhPolicies
Readers:
Type: Signature
Rule: "OR('airwh.member')"
Writers:
Type: Signature
Rule: "OR('airwh.member')"
Admins:
Type: Signature
Rule: "OR('airwh.admin')"
MSPDir: /home/wangcj/workspace/ca_solo/client/weh/msp
AnchorPeers:
- Host: peer0.weh.cares.com
port: 7053
Capabilities:
Channel: &ChannelCapabilities
V1_4_3: true
V1_3: false
V1_1: false
Orderer: &OrdererCapabilities
V1_4_2: true
V1_1: false
Application: &ApplicationCapabilities
V1_4_2: true
V1_3: false
V1_2: false
V1_1: false
Application: &ApplicationDefaults
ACLs: &ACLsDefault
lscc/ChaincodeExists: /Channel/Application/Readers
lscc/GetDeploymentSpec: /Channel/Application/Readers
lscc/GetChaincodeData: /Channel/Application/Readers
lscc/GetInstantiatedChaincodes: /Channel/Application/Readers
qscc/GetChainInfo: /Channel/Application/Readers
qscc/GetBlockByNumber: /Channel/Application/Readers
qscc/GetBlockByHash: /Channel/Application/Readers
qscc/GetTransactionByID: /Channel/Application/Readers
qscc/GetBlockByTxID: /Channel/Application/Readers
cscc/GetConfigBlock: /Channel/Application/Readers
cscc/GetConfigTree: /Channel/Application/Readers
cscc/SimulateConfigTreeUpdate: /Channel/Application/Readers
peer/Propose: /Channel/Application/Writers
peer/ChaincodeToChaincode: /Channel/Application/Readers
event/Block: /Channel/Application/Readers
event/FilteredBlock: /Channel/Application/Readers
Organizations:
Policies: &ApplicationDefaultPolicies
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
Capabilities:
<<: *ApplicationCapabilities
Orderer: &OrdererDefaults
OrdererType: solo
Addresses:
- orderer.cares.sh.cn:7050
BatchTimeout: 2s
BatchSize:
MaxMessageCount: 500
AbsoluteMaxBytes: 10 MB
PreferredMaxBytes: 2 MB
MaxChannels: 0
Kafka:
Brokers:
- kafka0:9092
- kafka1:9092
- kafka2:9092
EtcdRaft:
Consenters:
- Host: raft0.example.com
Port: 7050
ClientTLSCert: path/to/ClientTLSCert0
ServerTLSCert: path/to/ServerTLSCert0
- Host: raft1.example.com
Port: 7050
ClientTLSCert: path/to/ClientTLSCert1
ServerTLSCert: path/to/ServerTLSCert1
- Host: raft2.example.com
Port: 7050
ClientTLSCert: path/to/ClientTLSCert2
ServerTLSCert: path/to/ServerTLSCert2
Options:
TickInterval: 500ms
ElectionTick: 10
HeartbeatTick: 1
MaxInflightBlocks: 5
SnapshotIntervalSize: 20 MB
Organizations:
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
BlockValidation:
Type: ImplicitMeta
Rule: "ANY Writers"
Capabilities:
<<: *OrdererCapabilities
Channel: &ChannelDefaults
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
Capabilities:
<<: *ChannelCapabilities
Profiles:
SampleSingleMSPSolo:
<<: *ChannelDefaults
Orderer:
<<: *OrdererDefaults
OrdererType: solo
Organizations:
- *orderCares
Consortiums:
SampleConsortium:
Organizations:
- *njairport
- *airwh
SampleSingleMSPSoloChannel:
Consortium: SampleConsortium
<<: *ChannelDefaults
Application:
<<: *ApplicationDefaults
Organizations:
- *njairport
- *airwh
Capabilities:
<<: *ApplicationCapabilities4.2 peer0 NKG orderer.yaml
# Copyright IBM Corp. All Rights Reserved.
#
# SPDX-License-Identifier: Apache-2.0
#
---
################################################################################
#
# Orderer Configuration
#
# - This controls the type and configuration of the orderer.
#
################################################################################
General:
# Ledger Type: The ledger type to provide to the orderer.
# Two non-production ledger types are provided for test purposes only:
# - ram: An in-memory ledger whose contents are lost on restart.
# - json: A simple file ledger that writes blocks to disk in JSON format.
# Only one production ledger type is provided:
# - file: A production file-based ledger.
LedgerType: file
# Listen address: The IP on which to bind to listen.
ListenAddress: 0.0.0.0
# Listen port: The port on which to bind to listen.
ListenPort: 7050
# TLS: TLS settings for the GRPC server.
TLS:
Enabled: false
# PrivateKey governs the file location of the private key of the TLS certificate.
PrivateKey: /home/wangcj/workspace/solo/config/crypto-config/ordererOrganizations/cares.sh.cn/orderers/orderer.cares.sh.cn/tls/server.key
# Certificate governs the file location of the server TLS certificate.
Certificate: /home/wangcj/workspace/solo/config/crypto-config/ordererOrganizations/cares.sh.cn/orderers/orderer.cares.sh.cn/tls/server.crt
RootCAs:
- /home/wangcj/workspace/solo/config/crypto-config/ordererOrganizations/cares.sh.cn/orderers/orderer.cares.sh.cn/tls/ca.crt
ClientAuthRequired: false
ClientRootCAs:
# Keepalive settings for the GRPC server.
Keepalive:
# ServerMinInterval is the minimum permitted time between client pings.
# If clients send pings more frequently, the server will
# disconnect them.
ServerMinInterval: 60s
# ServerInterval is the time between pings to clients.
ServerInterval: 7200s
# ServerTimeout is the duration the server waits for a response from
# a client before closing the connection.
ServerTimeout: 20s
# Cluster settings for ordering service nodes that communicate with other ordering service nodes
# such as Raft based ordering service.
Cluster:
# SendBufferSize is the maximum number of messages in the egress buffer.
# Consensus messages are dropped if the buffer is full, and transaction
# messages are waiting for space to be freed.
SendBufferSize: 10
# ClientCertificate governs the file location of the client TLS certificate
# used to establish mutual TLS connections with other ordering service nodes.
ClientCertificate:
# ClientPrivateKey governs the file location of the private key of the client TLS certificate.
ClientPrivateKey:
# The below 4 properties should be either set together, or be unset together.
# If they are set, then the orderer node uses a separate listener for intra-cluster
# communication. If they are unset, then the general orderer listener is used.
# This is useful if you want to use a different TLS server certificates on the
# client-facing and the intra-cluster listeners.
# ListenPort defines the port on which the cluster listens to connections.
ListenPort:
# ListenAddress defines the IP on which to listen to intra-cluster communication.
ListenAddress:
# ServerCertificate defines the file location of the server TLS certificate used for intra-cluster
# communication.
ServerCertificate:
# ServerPrivateKey defines the file location of the private key of the TLS certificate.
ServerPrivateKey:
# Genesis method: The method by which the genesis block for the orderer
# system channel is specified. Available options are "provisional", "file":
# - provisional: Utilizes a genesis profile, specified by GenesisProfile,
# to dynamically generate a new genesis block.
# - file: Uses the file provided by GenesisFile as the genesis block.
GenesisMethod: file
# Genesis profile: The profile to use to dynamically generate the genesis
# block to use when initializing the orderer system channel and
# GenesisMethod is set to "provisional". See the configtx.yaml file for the
# descriptions of the available profiles. Ignored if GenesisMethod is set to
# "file".
GenesisProfile: SampleSingleMSPSolo
# Genesis file: The file containing the genesis block to use when
# initializing the orderer system channel and GenesisMethod is set to
# "file". Ignored if GenesisMethod is set to "provisional".
GenesisFile: /home/wangcj/workspace/ca_solo/test/data/orderer.genesis.block
# LocalMSPDir is where to find the private crypto material needed by the
# orderer. It is set relative here as a default for dev environments but
# should be changed to the real location in production.
LocalMSPDir: /home/wangcj/workspace/ca_solo/client/orderer/msp
# LocalMSPID is the identity to register the local MSP material with the MSP
# manager. IMPORTANT: The local MSP ID of an orderer needs to match the MSP
# ID of one of the organizations defined in the orderer system channel's
# /Channel/Orderer configuration. The sample organization defined in the
# sample configuration provided has an MSP ID of "SampleOrg".
LocalMSPID: orderCares
# Enable an HTTP service for Go "pprof" profiling as documented at:
# https://golang.org/pkg/net/http/pprof
Profile:
Enabled: false
Address: 0.0.0.0:6060
# BCCSP configures the blockchain crypto service providers.
BCCSP:
# Default specifies the preferred blockchain crypto service provider
# to use. If the preferred provider is not available, the software
# based provider ("SW") will be used.
# Valid providers are:
# - SW: a software based crypto provider
# - PKCS11: a CA hardware security module crypto provider.
Default: SW
# SW configures the software based blockchain crypto provider.
SW:
# TODO: The default Hash and Security level needs refactoring to be
# fully configurable. Changing these defaults requires coordination
# SHA2 is hardcoded in several places, not only BCCSP
Hash: SHA2
Security: 256
# Location of key store. If this is unset, a location will be
# chosen using: 'LocalMSPDir'/keystore
FileKeyStore:
KeyStore:
# Authentication contains configuration parameters related to authenticating
# client messages
Authentication:
# the acceptable difference between the current server time and the
# client's time as specified in a client request message
TimeWindow: 15m
################################################################################
#
# SECTION: File Ledger
#
# - This section applies to the configuration of the file or json ledgers.
#
################################################################################
FileLedger:
# Location: The directory to store the blocks in.
# NOTE: If this is unset, a new temporary location will be chosen every time
# the orderer is restarted, using the prefix specified by Prefix.
Location: /home/wangcj/workspace/ca_solo/test/data/orderer
# The prefix to use when generating a ledger directory in temporary space.
# Otherwise, this value is ignored.
Prefix: hyperledger-fabric-ordererledger
################################################################################
#
# SECTION: RAM Ledger
#
# - This section applies to the configuration of the RAM ledger.
#
################################################################################
RAMLedger:
# History Size: The number of blocks that the RAM ledger is set to retain.
# WARNING: Appending a block to the ledger might cause the oldest block in
# the ledger to be dropped in order to limit the number total number blocks
# to HistorySize. For example, if history size is 10, when appending block
# 10, block 0 (the genesis block!) will be dropped to make room for block 10.
HistorySize: 1000
################################################################################
#
# SECTION: Kafka
#
# - This section applies to the configuration of the Kafka-based orderer, and
# its interaction with the Kafka cluster.
#
################################################################################
Kafka:
# Retry: What do if a connection to the Kafka cluster cannot be established,
# or if a metadata request to the Kafka cluster needs to be repeated.
Retry:
# When a new channel is created, or when an existing channel is reloaded
# (in case of a just-restarted orderer), the orderer interacts with the
# Kafka cluster in the following ways:
# 1. It creates a Kafka producer (writer) for the Kafka partition that
# corresponds to the channel.
# 2. It uses that producer to post a no-op CONNECT message to that
# partition
# 3. It creates a Kafka consumer (reader) for that partition.
# If any of these steps fail, they will be re-attempted every
# <ShortInterval> for a total of <ShortTotal>, and then every
# <LongInterval> for a total of <LongTotal> until they succeed.
# Note that the orderer will be unable to write to or read from a
# channel until all of the steps above have been completed successfully.
ShortInterval: 5s
ShortTotal: 10m
LongInterval: 5m
LongTotal: 12h
# Affects the socket timeouts when waiting for an initial connection, a
# response, or a transmission. See Config.Net for more info:
# https://godoc.org/github.com/Shopify/sarama#Config
NetworkTimeouts:
DialTimeout: 10s
ReadTimeout: 10s
WriteTimeout: 10s
# Affects the metadata requests when the Kafka cluster is in the middle
# of a leader election.See Config.Metadata for more info:
# https://godoc.org/github.com/Shopify/sarama#Config
Metadata:
RetryBackoff: 250ms
RetryMax: 3
# What to do if posting a message to the Kafka cluster fails. See
# Config.Producer for more info:
# https://godoc.org/github.com/Shopify/sarama#Config
Producer:
RetryBackoff: 100ms
RetryMax: 3
# What to do if reading from the Kafka cluster fails. See
# Config.Consumer for more info:
# https://godoc.org/github.com/Shopify/sarama#Config
Consumer:
RetryBackoff: 2s
# Settings to use when creating Kafka topics. Only applies when
# Kafka.Version is v0.10.1.0 or higher
Topic:
# The number of Kafka brokers across which to replicate the topic
ReplicationFactor: 3
# Verbose: Enable logging for interactions with the Kafka cluster.
Verbose: false
# TLS: TLS settings for the orderer's connection to the Kafka cluster.
TLS:
# Enabled: Use TLS when connecting to the Kafka cluster.
Enabled: false
# PrivateKey: PEM-encoded private key the orderer will use for
# authentication.
PrivateKey:
# As an alternative to specifying the PrivateKey here, uncomment the
# following "File" key and specify the file name from which to load the
# value of PrivateKey.
#File: path/to/PrivateKey
# Certificate: PEM-encoded signed public key certificate the orderer will
# use for authentication.
Certificate:
# As an alternative to specifying the Certificate here, uncomment the
# following "File" key and specify the file name from which to load the
# value of Certificate.
#File: path/to/Certificate
# RootCAs: PEM-encoded trusted root certificates used to validate
# certificates from the Kafka cluster.
RootCAs:
# As an alternative to specifying the RootCAs here, uncomment the
# following "File" key and specify the file name from which to load the
# value of RootCAs.
#File: path/to/RootCAs
# SASLPlain: Settings for using SASL/PLAIN authentication with Kafka brokers
SASLPlain:
# Enabled: Use SASL/PLAIN to authenticate with Kafka brokers
Enabled: false
# User: Required when Enabled is set to true
User:
# Password: Required when Enabled is set to true
Password:
# Kafka protocol version used to communicate with the Kafka cluster brokers
# (defaults to 0.10.2.0 if not specified)
Version:
################################################################################
#
# Debug Configuration
#
# - This controls the debugging options for the orderer
#
################################################################################
Debug:
# BroadcastTraceDir when set will cause each request to the Broadcast service
# for this orderer to be written to a file in this directory
BroadcastTraceDir:
# DeliverTraceDir when set will cause each request to the Deliver service
# for this orderer to be written to a file in this directory
DeliverTraceDir:
################################################################################
#
# Operations Configuration
#
# - This configures the operations server endpoint for the orderer
#
################################################################################
Operations:
# host and port for the operations server
ListenAddress: 127.0.0.1:8443
# TLS configuration for the operations endpoint
TLS:
# TLS enabled
Enabled: false
# Certificate is the location of the PEM encoded TLS certificate
Certificate:
# PrivateKey points to the location of the PEM-encoded key
PrivateKey:
# Most operations service endpoints require client authentication when TLS
# is enabled. ClientAuthRequired requires client certificate authentication
# at the TLS layer to access all resources.
ClientAuthRequired: false
# Paths to PEM encoded ca certificates to trust for client authentication
ClientRootCAs: []
################################################################################
#
# Metrics Configuration
#
# - This configures metrics collection for the orderer
#
################################################################################
Metrics:
# The metrics provider is one of statsd, prometheus, or disabled
Provider: disabled
# The statsd configuration
Statsd:
# network type: tcp or udp
Network: udp
# the statsd server address
Address: 127.0.0.1:8125
# The interval at which locally cached counters and gauges are pushed
# to statsd; timings are pushed immediately
WriteInterval: 30s
# The prefix is prepended to all emitted statsd metrics
Prefix:
################################################################################
#
# Consensus Configuration
#
# - This section contains config options for a consensus plugin. It is opaque
# to orderer, and completely up to consensus implementation to make use of.
#
################################################################################
Consensus:
# The allowed key-value pairs here depend on consensus plugin. For etcd/raft,
# we use following options:
# WALDir specifies the location at which Write Ahead Logs for etcd/raft are
# stored. Each channel will have its own subdir named after channel ID.
WALDir: /var/hyperledger/production/orderer/etcdraft/wal
# SnapDir specifies the location at which snapshots for etcd/raft are
# stored. Each channel will have its own subdir named after channel ID.
SnapDir: /var/hyperledger/production/orderer/etcdraft/snapshot4.3 peer0 NKG core.yaml
# Copyright IBM Corp. All Rights Reserved.
#
# SPDX-License-Identifier: Apache-2.0
#
###############################################################################
#
# Peer section
#
###############################################################################
peer:
# The Peer id is used for identifying this Peer instance.
id: peer0.njairport.com
# The networkId allows for logical seperation of networks
networkId: dev
# The Address at local network interface this Peer will listen on.
# By default, it will listen on all network interfaces
listenAddress: 0.0.0.0:7051
# The endpoint this peer uses to listen for inbound chaincode connections.
# If this is commented-out, the listen address is selected to be
# the peer's address (see below) with port 7052
chaincodeListenAddress: 0.0.0.0:7052
# The endpoint the chaincode for this peer uses to connect to the peer.
# If this is not specified, the chaincodeListenAddress address is selected.
# And if chaincodeListenAddress is not specified, address is selected from
# peer listenAddress.
chaincodeAddress: peer0.nkg.cares.com:7052
# When used as peer config, this represents the endpoint to other peers
# in the same organization. For peers in other organization, see
# gossip.externalEndpoint for more info.
# When used as CLI config, this means the peer's endpoint to interact with
address: 0.0.0.0:7051
# Whether the Peer should programmatically determine its address
# This case is useful for docker containers.
addressAutoDetect: false
# Setting for runtime.GOMAXPROCS(n). If n < 1, it does not change the
# current setting
gomaxprocs: -1
# Keepalive settings for peer server and clients
keepalive:
# MinInterval is the minimum permitted time between client pings.
# If clients send pings more frequently, the peer server will
# disconnect them
minInterval: 60s
# Client keepalive settings for communicating with other peer nodes
client:
# Interval is the time between pings to peer nodes. This must
# greater than or equal to the minInterval specified by peer
# nodes
interval: 60s
# Timeout is the duration the client waits for a response from
# peer nodes before closing the connection
timeout: 20s
# DeliveryClient keepalive settings for communication with ordering
# nodes.
deliveryClient:
# Interval is the time between pings to ordering nodes. This must
# greater than or equal to the minInterval specified by ordering
# nodes.
interval: 60s
# Timeout is the duration the client waits for a response from
# ordering nodes before closing the connection
timeout: 20s
# Gossip related configuration
gossip:
# Bootstrap set to initialize gossip with.
# This is a list of other peers that this peer reaches out to at startup.
# Important: The endpoints here have to be endpoints of peers in the same
# organization, because the peer would refuse connecting to these endpoints
# unless they are in the same organization as the peer.
bootstrap:
# NOTE: orgLeader and useLeaderElection parameters are mutual exclusive.
# Setting both to true would result in the termination of the peer
# since this is undefined state. If the peers are configured with
# useLeaderElection=false, make sure there is at least 1 peer in the
# organization that its orgLeader is set to true.
# Defines whenever peer will initialize dynamic algorithm for
# "leader" selection, where leader is the peer to establish
# connection with ordering service and use delivery protocol
# to pull ledger blocks from ordering service. It is recommended to
# use leader election for large networks of peers.
useLeaderElection: true
# Statically defines peer to be an organization "leader",
# where this means that current peer will maintain connection
# with ordering service and disseminate block across peers in
# its own organization
orgLeader: false
# Interval for membershipTracker polling
membershipTrackerInterval: 5s
# Overrides the endpoint that the peer publishes to peers
# in its organization. For peers in foreign organizations
# see 'externalEndpoint'
endpoint: peer0.nkg.cares.com:7051
# Maximum count of blocks stored in memory
maxBlockCountToStore: 100
# Max time between consecutive message pushes(unit: millisecond)
maxPropagationBurstLatency: 10ms
# Max number of messages stored until a push is triggered to remote peers
maxPropagationBurstSize: 10
# Number of times a message is pushed to remote peers
propagateIterations: 1
# Number of peers selected to push messages to
propagatePeerNum: 3
# Determines frequency of pull phases(unit: second)
# Must be greater than digestWaitTime + responseWaitTime
pullInterval: 4s
# Number of peers to pull from
pullPeerNum: 3
# Determines frequency of pulling state info messages from peers(unit: second)
requestStateInfoInterval: 4s
# Determines frequency of pushing state info messages to peers(unit: second)
publishStateInfoInterval: 4s
# Maximum time a stateInfo message is kept until expired
stateInfoRetentionInterval:
# Time from startup certificates are included in Alive messages(unit: second)
publishCertPeriod: 10s
# Should we skip verifying block messages or not (currently not in use)
skipBlockVerification: false
# Dial timeout(unit: second)
dialTimeout: 3s
# Connection timeout(unit: second)
connTimeout: 2s
# Buffer size of received messages
recvBuffSize: 20
# Buffer size of sending messages
sendBuffSize: 200
# Time to wait before pull engine processes incoming digests (unit: second)
# Should be slightly smaller than requestWaitTime
digestWaitTime: 1s
# Time to wait before pull engine removes incoming nonce (unit: milliseconds)
# Should be slightly bigger than digestWaitTime
requestWaitTime: 1500ms
# Time to wait before pull engine ends pull (unit: second)
responseWaitTime: 2s
# Alive check interval(unit: second)
aliveTimeInterval: 5s
# Alive expiration timeout(unit: second)
aliveExpirationTimeout: 25s
# Reconnect interval(unit: second)
reconnectInterval: 25s
# This is an endpoint that is published to peers outside of the organization.
# If this isn't set, the peer will not be known to other organizations.
externalEndpoint: peer0.nkg.cares.com:7051
# Leader election service configuration
election:
# Longest time peer waits for stable membership during leader election startup (unit: second)
startupGracePeriod: 15s
# Interval gossip membership samples to check its stability (unit: second)
membershipSampleInterval: 1s
# Time passes since last declaration message before peer decides to perform leader election (unit: second)
leaderAliveThreshold: 10s
# Time between peer sends propose message and declares itself as a leader (sends declaration message) (unit: second)
leaderElectionDuration: 5s
pvtData:
# pullRetryThreshold determines the maximum duration of time private data corresponding for a given block
# would be attempted to be pulled from peers until the block would be committed without the private data
pullRetryThreshold: 60s
# As private data enters the transient store, it is associated with the peer's ledger's height at that time.
# transientstoreMaxBlockRetention defines the maximum difference between the current ledger's height upon commit,
# and the private data residing inside the transient store that is guaranteed not to be purged.
# Private data is purged from the transient store when blocks with sequences that are multiples
# of transientstoreMaxBlockRetention are committed.
transientstoreMaxBlockRetention: 1000
# pushAckTimeout is the maximum time to wait for an acknowledgement from each peer
# at private data push at endorsement time.
pushAckTimeout: 3s
# Block to live pulling margin, used as a buffer
# to prevent peer from trying to pull private data
# from peers that is soon to be purged in next N blocks.
# This helps a newly joined peer catch up to current
# blockchain height quicker.
btlPullMargin: 10
# the process of reconciliation is done in an endless loop, while in each iteration reconciler tries to
# pull from the other peers the most recent missing blocks with a maximum batch size limitation.
# reconcileBatchSize determines the maximum batch size of missing private data that will be reconciled in a
# single iteration.
reconcileBatchSize: 10
# reconcileSleepInterval determines the time reconciler sleeps from end of an iteration until the beginning
# of the next reconciliation iteration.
reconcileSleepInterval: 1m
# reconciliationEnabled is a flag that indicates whether private data reconciliation is enable or not.
reconciliationEnabled: true
# skipPullingInvalidTransactionsDuringCommit is a flag that indicates whether pulling of invalid
# transaction's private data from other peers need to be skipped during the commit time and pulled
# only through reconciler.
skipPullingInvalidTransactionsDuringCommit: false
# Gossip state transfer related configuration
state:
# indicates whenever state transfer is enabled or not
# default value is true, i.e. state transfer is active
# and takes care to sync up missing blocks allowing
# lagging peer to catch up to speed with rest network
enabled: true
# checkInterval interval to check whether peer is lagging behind enough to
# request blocks via state transfer from another peer.
checkInterval: 10s
# responseTimeout amount of time to wait for state transfer response from
# other peers
responseTimeout: 3s
# batchSize the number of blocks to request via state transfer from another peer
batchSize: 10
# blockBufferSize reflect the maximum distance between lowest and
# highest block sequence number state buffer to avoid holes.
# In order to ensure absence of the holes actual buffer size
# is twice of this distance
blockBufferSize: 100
# maxRetries maximum number of re-tries to ask
# for single state transfer request
maxRetries: 3
# TLS Settings
# Note that peer-chaincode connections through chaincodeListenAddress is
# not mutual TLS auth. See comments on chaincodeListenAddress for more info
tls:
# Require server-side TLS
enabled: false
# Require client certificates / mutual TLS.
# Note that clients that are not configured to use a certificate will
# fail to connect to the peer.
clientAuthRequired: false
# X.509 certificate used for TLS server
cert:
file: /home/wangcj/workspace/solo/config/crypto-config/peerOrganizations/njairport.com/peers/peer0.njairport.com/tls/server.crt
# Private key used for TLS server (and client if clientAuthEnabled
# is set to true
key:
file: /home/wangcj/workspace/solo/config/crypto-config/peerOrganizations/njairport.com/peers/peer0.njairport.com/tls/server.key
# Trusted root certificate chain for tls.cert
rootcert:
file: /home/wangcj/workspace/solo/config/crypto-config/peerOrganizations/njairport.com/peers/peer0.njairport.com/tls/ca.crt
# Set of root certificate authorities used to verify client certificates
clientRootCAs:
files:
- /home/wangcj/workspace/solo/config/crypto-config/peerOrganizations/njairport.com/peers/peer0.njairport.com/tls/ca.crt
# Private key used for TLS when making client connections. If
# not set, peer.tls.key.file will be used instead
clientKey:
file:
# X.509 certificate used for TLS when making client connections.
# If not set, peer.tls.cert.file will be used instead
clientCert:
file:
# Authentication contains configuration parameters related to authenticating
# client messages
authentication:
# the acceptable difference between the current server time and the
# client's time as specified in a client request message
timewindow: 15m
# Path on the file system where peer will store data (eg ledger). This
# location must be access control protected to prevent unintended
# modification that might corrupt the peer operations.
fileSystemPath: /home/wangcj/workspace/ca_solo/test/data/peer0.nkg.cares.com
# BCCSP (Blockchain crypto provider): Select which crypto implementation or
# library to use
BCCSP:
Default: SW
# Settings for the SW crypto provider (i.e. when DEFAULT: SW)
SW:
# TODO: The default Hash and Security level needs refactoring to be
# fully configurable. Changing these defaults requires coordination
# SHA2 is hardcoded in several places, not only BCCSP
Hash: SHA2
Security: 256
# Location of Key Store
FileKeyStore:
# If "", defaults to 'mspConfigPath'/keystore
KeyStore:
# Settings for the PKCS#11 crypto provider (i.e. when DEFAULT: PKCS11)
PKCS11:
# Location of the PKCS11 module library
Library:
# Token Label
Label:
# User PIN
Pin:
Hash:
Security:
FileKeyStore:
KeyStore:
# Path on the file system where peer will find MSP local configurations
mspConfigPath: /home/wangcj/workspace/ca_solo/client/nkg/msp
# Identifier of the local MSP
# ----!!!!IMPORTANT!!!-!!!IMPORTANT!!!-!!!IMPORTANT!!!!----
# Deployers need to change the value of the localMspId string.
# In particular, the name of the local MSP ID of a peer needs
# to match the name of one of the MSPs in each of the channel
# that this peer is a member of. Otherwise this peer's messages
# will not be identified as valid by other nodes.
localMspId: njairport
# CLI common client config options
client:
# connection timeout
connTimeout: 3s
# Delivery service related config
deliveryclient:
# The total time to spend retrying connections to ordering nodes
# before giving up and returning an error.
reconnectTotalTimeThreshold: 3600s
# The connection timeout when connecting to ordering service nodes.
connTimeout: 3s
# The maximum delay between consecutive connection retry attempts to
# ordering nodes.
reConnectBackoffThreshold: 3600s
# A list of orderer endpoint addresses which should be overridden
# when found in channel configurations.
addressOverrides:
# - from:
# to:
# caCertsFile:
# - from:
# to:
# caCertsFile:
# Type for the local MSP - by default it's of type bccsp
localMspType: bccsp
# Used with Go profiling tools only in none production environment. In
# production, it should be disabled (eg enabled: false)
profile:
enabled: false
listenAddress: 0.0.0.0:6060
# The admin service is used for administrative operations such as
# control over logger levels, etc.
# Only peer administrators can use the service.
adminService:
# The interface and port on which the admin server will listen on.
# If this is commented out, or the port number is equal to the port
# of the peer listen address - the admin service is attached to the
# peer's service (defaults to 7051).
#listenAddress: 0.0.0.0:7055
# Handlers defines custom handlers that can filter and mutate
# objects passing within the peer, such as:
# Auth filter - reject or forward proposals from clients
# Decorators - append or mutate the chaincode input passed to the chaincode
# Endorsers - Custom signing over proposal response payload and its mutation
# Valid handler definition contains:
# - A name which is a factory method name defined in
# core/handlers/library/library.go for statically compiled handlers
# - library path to shared object binary for pluggable filters
# Auth filters and decorators are chained and executed in the order that
# they are defined. For example:
# authFilters:
# -
# name: FilterOne
# library: /opt/lib/filter.so
# -
# name: FilterTwo
# decorators:
# -
# name: DecoratorOne
# -
# name: DecoratorTwo
# library: /opt/lib/decorator.so
# Endorsers are configured as a map that its keys are the endorsement system chaincodes that are being overridden.
# Below is an example that overrides the default ESCC and uses an endorsement plugin that has the same functionality
# as the default ESCC.
# If the 'library' property is missing, the name is used as the constructor method in the builtin library similar
# to auth filters and decorators.
# endorsers:
# escc:
# name: DefaultESCC
# library: /etc/hyperledger/fabric/plugin/escc.so
handlers:
authFilters:
-
name: DefaultAuth
-
name: ExpirationCheck # This filter checks identity x509 certificate expiration
decorators:
-
name: DefaultDecorator
endorsers:
escc:
name: DefaultEndorsement
library:
validators:
vscc:
name: DefaultValidation
library:
# library: /etc/hyperledger/fabric/plugin/escc.so
# Number of goroutines that will execute transaction validation in parallel.
# By default, the peer chooses the number of CPUs on the machine. Set this
# variable to override that choice.
# NOTE: overriding this value might negatively influence the performance of
# the peer so please change this value only if you know what you're doing
validatorPoolSize:
# The discovery service is used by clients to query information about peers,
# such as - which peers have joined a certain channel, what is the latest
# channel config, and most importantly - given a chaincode and a channel,
# what possible sets of peers satisfy the endorsement policy.
discovery:
enabled: true
# Whether the authentication cache is enabled or not.
authCacheEnabled: true
# The maximum size of the cache, after which a purge takes place
authCacheMaxSize: 1000
# The proportion (0 to 1) of entries that remain in the cache after the cache is purged due to overpopulation
authCachePurgeRetentionRatio: 0.75
# Whether to allow non-admins to perform non channel scoped queries.
# When this is false, it means that only peer admins can perform non channel scoped queries.
orgMembersAllowedAccess: false
###############################################################################
#
# VM section
#
###############################################################################
vm:
# Endpoint of the vm management system. For docker can be one of the following in general
# unix:///var/run/docker.sock
# http://localhost:2375
# https://localhost:2376
endpoint: unix:///var/run/docker.sock
# settings for docker vms
docker:
tls:
enabled: false
ca:
file: docker/ca.crt
cert:
file: docker/tls.crt
key:
file: docker/tls.key
# Enables/disables the standard out/err from chaincode containers for
# debugging purposes
attachStdout: false
# Parameters on creating docker container.
# Container may be efficiently created using ipam & dns-server for cluster
# NetworkMode - sets the networking mode for the container. Supported
# standard values are: `host`(default),`bridge`,`ipvlan`,`none`.
# Dns - a list of DNS servers for the container to use.
# Note: `Privileged` `Binds` `Links` and `PortBindings` properties of
# Docker Host Config are not supported and will not be used if set.
# LogConfig - sets the logging driver (Type) and related options
# (Config) for Docker. For more info,
# https://docs.docker.com/engine/admin/logging/overview/
# Note: Set LogConfig using Environment Variables is not supported.
hostConfig:
NetworkMode: host
Dns:
# - 192.168.0.1
LogConfig:
Type: json-file
Config:
max-size: "50m"
max-file: "5"
Memory: 2147483648
###############################################################################
#
# Chaincode section
#
###############################################################################
chaincode:
# The id is used by the Chaincode stub to register the executing Chaincode
# ID with the Peer and is generally supplied through ENV variables
# the `path` form of ID is provided when installing the chaincode.
# The `name` is used for all other requests and can be any string.
id:
path:
name:
# Generic builder environment, suitable for most chaincode types
builder: $(DOCKER_NS)/fabric-ccenv:latest
# Enables/disables force pulling of the base docker images (listed below)
# during user chaincode instantiation.
# Useful when using moving image tags (such as :latest)
pull: false
golang:
# golang will never need more than baseos
runtime: $(BASE_DOCKER_NS)/fabric-baseos:$(ARCH)-$(BASE_VERSION)
# whether or not golang chaincode should be linked dynamically
dynamicLink: false
car:
# car may need more facilities (JVM, etc) in the future as the catalog
# of platforms are expanded. For now, we can just use baseos
runtime: $(BASE_DOCKER_NS)/fabric-baseos:$(ARCH)-$(BASE_VERSION)
java:
# This is an image based on java:openjdk-8 with addition compiler
# tools added for java shim layer packaging.
# This image is packed with shim layer libraries that are necessary
# for Java chaincode runtime.
runtime: $(DOCKER_NS)/fabric-javaenv:$(ARCH)-$(PROJECT_VERSION)
node:
# need node.js engine at runtime, currently available in baseimage
# but not in baseos
runtime: $(BASE_DOCKER_NS)/fabric-baseimage:$(ARCH)-$(BASE_VERSION)
# Timeout duration for starting up a container and waiting for Register
# to come through. 1sec should be plenty for chaincode unit tests
startuptimeout: 300s
# Timeout duration for Invoke and Init calls to prevent runaway.
# This timeout is used by all chaincodes in all the channels, including
# system chaincodes.
# Note that during Invoke, if the image is not available (e.g. being
# cleaned up when in development environment), the peer will automatically
# build the image, which might take more time. In production environment,
# the chaincode image is unlikely to be deleted, so the timeout could be
# reduced accordingly.
executetimeout: 30s
# There are 2 modes: "dev" and "net".
# In dev mode, user runs the chaincode after starting peer from
# command line on local machine.
# In net mode, peer will run chaincode in a docker container.
mode: net
# keepalive in seconds. In situations where the communiction goes through a
# proxy that does not support keep-alive, this parameter will maintain connection
# between peer and chaincode.
# A value <= 0 turns keepalive off
keepalive: 0
# system chaincodes whitelist. To add system chaincode "myscc" to the
# whitelist, add "myscc: enable" to the list below, and register in
# chaincode/importsysccs.go
system:
cscc: enable
lscc: enable
escc: enable
vscc: enable
qscc: enable
# System chaincode plugins:
# System chaincodes can be loaded as shared objects compiled as Go plugins.
# See examples/plugins/scc for an example.
# Plugins must be white listed in the chaincode.system section above.
systemPlugins:
# example configuration:
# - enabled: true
# name: myscc
# path: /opt/lib/myscc.so
# invokableExternal: true
# invokableCC2CC: true
# Logging section for the chaincode container
logging:
# Default level for all loggers within the chaincode container
level: info
# Override default level for the 'shim' logger
shim: warning
# Format for the chaincode container logs
format: '%{color}%{time:2006-01-02 15:04:05.000 MST} [%{module}] %{shortfunc} -> %{level:.4s} %{id:03x}%{color:reset} %{message}'
###############################################################################
#
# Ledger section - ledger configuration encompases both the blockchain
# and the state
#
###############################################################################
ledger:
blockchain:
state:
# stateDatabase - options are "goleveldb", "CouchDB"
# goleveldb - default state database stored in goleveldb.
# CouchDB - store state database in CouchDB
stateDatabase: goleveldb
# Limit on the number of records to return per query
totalQueryLimit: 100000
couchDBConfig:
# It is recommended to run CouchDB on the same server as the peer, and
# not map the CouchDB container port to a server port in docker-compose.
# Otherwise proper security must be provided on the connection between
# CouchDB client (on the peer) and server.
couchDBAddress: 127.0.0.1:5984
# This username must have read and write authority on CouchDB
username:
# The password is recommended to pass as an environment variable
# during start up (eg CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD).
# If it is stored here, the file must be access control protected
# to prevent unintended users from discovering the password.
password:
# Number of retries for CouchDB errors
maxRetries: 3
# Number of retries for CouchDB errors during peer startup
maxRetriesOnStartup: 12
# CouchDB request timeout (unit: duration, e.g. 20s)
requestTimeout: 35s
# Limit on the number of records per each CouchDB query
# Note that chaincode queries are only bound by totalQueryLimit.
# Internally the chaincode may execute multiple CouchDB queries,
# each of size internalQueryLimit.
internalQueryLimit: 1000
# Limit on the number of records per CouchDB bulk update batch
maxBatchUpdateSize: 1000
# Warm indexes after every N blocks.
# This option warms any indexes that have been
# deployed to CouchDB after every N blocks.
# A value of 1 will warm indexes after every block commit,
# to ensure fast selector queries.
# Increasing the value may improve write efficiency of peer and CouchDB,
# but may degrade query response time.
warmIndexesAfterNBlocks: 1
# Create the _global_changes system database
# This is optional. Creating the global changes database will require
# additional system resources to track changes and maintain the database
createGlobalChangesDB: false
history:
# enableHistoryDatabase - options are true or false
# Indicates if the history of key updates should be stored.
# All history 'index' will be stored in goleveldb, regardless if using
# CouchDB or alternate database for the state.
enableHistoryDatabase: true
###############################################################################
#
# Operations section
#
###############################################################################
operations:
# host and port for the operations server
listenAddress: 127.0.0.1:9443
# TLS configuration for the operations endpoint
tls:
# TLS enabled
enabled: false
# path to PEM encoded server certificate for the operations server
cert:
file:
# path to PEM encoded server key for the operations server
key:
file:
# most operations service endpoints require client authentication when TLS
# is enabled. clientAuthRequired requires client certificate authentication
# at the TLS layer to access all resources.
clientAuthRequired: false
# paths to PEM encoded ca certificates to trust for client authentication
clientRootCAs:
files: []
###############################################################################
#
# Metrics section
#
###############################################################################
metrics:
# metrics provider is one of statsd, prometheus, or disabled
provider: disabled
# statsd configuration
statsd:
# network type: tcp or udp
network: udp
# statsd server address
address: 127.0.0.1:8125
# the interval at which locally cached counters and gauges are pushed
# to statsd; timings are pushed immediately
writeInterval: 10s
# prefix is prepended to all emitted statsd metrics
prefix:4.4 peer0 WEH core.yaml
# Copyright IBM Corp. All Rights Reserved.
#
# SPDX-License-Identifier: Apache-2.0
#
###############################################################################
#
# Peer section
#
###############################################################################
peer:
# The Peer id is used for identifying this Peer instance.
id: peer0.airwh.com
# The networkId allows for logical seperation of networks
networkId: devairwh
# The Address at local network interface this Peer will listen on.
# By default, it will listen on all network interfaces
listenAddress: 0.0.0.0:7053
# The endpoint this peer uses to listen for inbound chaincode connections.
# If this is commented-out, the listen address is selected to be
# the peer's address (see below) with port 7052
chaincodeListenAddress: 0.0.0.0:7054
# The endpoint the chaincode for this peer uses to connect to the peer.
# If this is not specified, the chaincodeListenAddress address is selected.
# And if chaincodeListenAddress is not specified, address is selected from
# peer listenAddress.
chaincodeAddress: peer0.weh.cares.com:7054
# When used as peer config, this represents the endpoint to other peers
# in the same organization. For peers in other organization, see
# gossip.externalEndpoint for more info.
# When used as CLI config, this means the peer's endpoint to interact with
address: peer0.weh.cares.com:7053
# Whether the Peer should programmatically determine its address
# This case is useful for docker containers.
addressAutoDetect: false
# Setting for runtime.GOMAXPROCS(n). If n < 1, it does not change the
# current setting
gomaxprocs: -1
# Keepalive settings for peer server and clients
keepalive:
# MinInterval is the minimum permitted time between client pings.
# If clients send pings more frequently, the peer server will
# disconnect them
minInterval: 60s
# Client keepalive settings for communicating with other peer nodes
client:
# Interval is the time between pings to peer nodes. This must
# greater than or equal to the minInterval specified by peer
# nodes
interval: 60s
# Timeout is the duration the client waits for a response from
# peer nodes before closing the connection
timeout: 20s
# DeliveryClient keepalive settings for communication with ordering
# nodes.
deliveryClient:
# Interval is the time between pings to ordering nodes. This must
# greater than or equal to the minInterval specified by ordering
# nodes.
interval: 60s
# Timeout is the duration the client waits for a response from
# ordering nodes before closing the connection
timeout: 20s
# Gossip related configuration
gossip:
# Bootstrap set to initialize gossip with.
# This is a list of other peers that this peer reaches out to at startup.
# Important: The endpoints here have to be endpoints of peers in the same
# organization, because the peer would refuse connecting to these endpoints
# unless they are in the same organization as the peer.
bootstrap:
# NOTE: orgLeader and useLeaderElection parameters are mutual exclusive.
# Setting both to true would result in the termination of the peer
# since this is undefined state. If the peers are configured with
# useLeaderElection=false, make sure there is at least 1 peer in the
# organization that its orgLeader is set to true.
# Defines whenever peer will initialize dynamic algorithm for
# "leader" selection, where leader is the peer to establish
# connection with ordering service and use delivery protocol
# to pull ledger blocks from ordering service. It is recommended to
# use leader election for large networks of peers.
useLeaderElection: true
# Statically defines peer to be an organization "leader",
# where this means that current peer will maintain connection
# with ordering service and disseminate block across peers in
# its own organization
orgLeader: false
# Interval for membershipTracker polling
membershipTrackerInterval: 5s
# Overrides the endpoint that the peer publishes to peers
# in its organization. For peers in foreign organizations
# see 'externalEndpoint'
endpoint: peer0.weh.cares.com:7053
# Maximum count of blocks stored in memory
maxBlockCountToStore: 100
# Max time between consecutive message pushes(unit: millisecond)
maxPropagationBurstLatency: 10ms
# Max number of messages stored until a push is triggered to remote peers
maxPropagationBurstSize: 10
# Number of times a message is pushed to remote peers
propagateIterations: 1
# Number of peers selected to push messages to
propagatePeerNum: 3
# Determines frequency of pull phases(unit: second)
# Must be greater than digestWaitTime + responseWaitTime
pullInterval: 4s
# Number of peers to pull from
pullPeerNum: 3
# Determines frequency of pulling state info messages from peers(unit: second)
requestStateInfoInterval: 4s
# Determines frequency of pushing state info messages to peers(unit: second)
publishStateInfoInterval: 4s
# Maximum time a stateInfo message is kept until expired
stateInfoRetentionInterval:
# Time from startup certificates are included in Alive messages(unit: second)
publishCertPeriod: 10s
# Should we skip verifying block messages or not (currently not in use)
skipBlockVerification: false
# Dial timeout(unit: second)
dialTimeout: 3s
# Connection timeout(unit: second)
connTimeout: 2s
# Buffer size of received messages
recvBuffSize: 20
# Buffer size of sending messages
sendBuffSize: 200
# Time to wait before pull engine processes incoming digests (unit: second)
# Should be slightly smaller than requestWaitTime
digestWaitTime: 1s
# Time to wait before pull engine removes incoming nonce (unit: milliseconds)
# Should be slightly bigger than digestWaitTime
requestWaitTime: 1500ms
# Time to wait before pull engine ends pull (unit: second)
responseWaitTime: 2s
# Alive check interval(unit: second)
aliveTimeInterval: 5s
# Alive expiration timeout(unit: second)
aliveExpirationTimeout: 25s
# Reconnect interval(unit: second)
reconnectInterval: 25s
# This is an endpoint that is published to peers outside of the organization.
# If this isn't set, the peer will not be known to other organizations.
externalEndpoint: peer0.weh.cares.com:7053
# Leader election service configuration
election:
# Longest time peer waits for stable membership during leader election startup (unit: second)
startupGracePeriod: 15s
# Interval gossip membership samples to check its stability (unit: second)
membershipSampleInterval: 1s
# Time passes since last declaration message before peer decides to perform leader election (unit: second)
leaderAliveThreshold: 10s
# Time between peer sends propose message and declares itself as a leader (sends declaration message) (unit: second)
leaderElectionDuration: 5s
pvtData:
# pullRetryThreshold determines the maximum duration of time private data corresponding for a given block
# would be attempted to be pulled from peers until the block would be committed without the private data
pullRetryThreshold: 60s
# As private data enters the transient store, it is associated with the peer's ledger's height at that time.
# transientstoreMaxBlockRetention defines the maximum difference between the current ledger's height upon commit,
# and the private data residing inside the transient store that is guaranteed not to be purged.
# Private data is purged from the transient store when blocks with sequences that are multiples
# of transientstoreMaxBlockRetention are committed.
transientstoreMaxBlockRetention: 1000
# pushAckTimeout is the maximum time to wait for an acknowledgement from each peer
# at private data push at endorsement time.
pushAckTimeout: 3s
# Block to live pulling margin, used as a buffer
# to prevent peer from trying to pull private data
# from peers that is soon to be purged in next N blocks.
# This helps a newly joined peer catch up to current
# blockchain height quicker.
btlPullMargin: 10
# the process of reconciliation is done in an endless loop, while in each iteration reconciler tries to
# pull from the other peers the most recent missing blocks with a maximum batch size limitation.
# reconcileBatchSize determines the maximum batch size of missing private data that will be reconciled in a
# single iteration.
reconcileBatchSize: 10
# reconcileSleepInterval determines the time reconciler sleeps from end of an iteration until the beginning
# of the next reconciliation iteration.
reconcileSleepInterval: 1m
# reconciliationEnabled is a flag that indicates whether private data reconciliation is enable or not.
reconciliationEnabled: true
# skipPullingInvalidTransactionsDuringCommit is a flag that indicates whether pulling of invalid
# transaction's private data from other peers need to be skipped during the commit time and pulled
# only through reconciler.
skipPullingInvalidTransactionsDuringCommit: false
# Gossip state transfer related configuration
state:
# indicates whenever state transfer is enabled or not
# default value is true, i.e. state transfer is active
# and takes care to sync up missing blocks allowing
# lagging peer to catch up to speed with rest network
enabled: true
# checkInterval interval to check whether peer is lagging behind enough to
# request blocks via state transfer from another peer.
checkInterval: 10s
# responseTimeout amount of time to wait for state transfer response from
# other peers
responseTimeout: 3s
# batchSize the number of blocks to request via state transfer from another peer
batchSize: 10
# blockBufferSize reflect the maximum distance between lowest and
# highest block sequence number state buffer to avoid holes.
# In order to ensure absence of the holes actual buffer size
# is twice of this distance
blockBufferSize: 100
# maxRetries maximum number of re-tries to ask
# for single state transfer request
maxRetries: 3
# TLS Settings
# Note that peer-chaincode connections through chaincodeListenAddress is
# not mutual TLS auth. See comments on chaincodeListenAddress for more info
tls:
# Require server-side TLS
enabled: false
# Require client certificates / mutual TLS.
# Note that clients that are not configured to use a certificate will
# fail to connect to the peer.
clientAuthRequired: false
# X.509 certificate used for TLS server
cert:
file: /home/wangcj/workspace/solo/config/crypto-config/peerOrganizations/airwh.com/peers/peer0.airwh.com/tls/server.crt
# Private key used for TLS server (and client if clientAuthEnabled
# is set to true
key:
file: /home/wangcj/workspace/solo/config/crypto-config/peerOrganizations/airwh.com/peers/peer0.airwh.com/tls/server.key
# Trusted root certificate chain for tls.cert
rootcert:
file: /home/wangcj/workspace/solo/config/crypto-config/peerOrganizations/airwh.com/peers/peer0.airwh.com/tls/ca.crt
# Set of root certificate authorities used to verify client certificates
clientRootCAs:
files:
- /home/wangcj/workspace/solo/config/crypto-config/peerOrganizations/airwh.com/peers/peer0.airwh.com/tls/ca.crt
# Private key used for TLS when making client connections. If
# not set, peer.tls.key.file will be used instead
clientKey:
file:
# X.509 certificate used for TLS when making client connections.
# If not set, peer.tls.cert.file will be used instead
clientCert:
file:
# Authentication contains configuration parameters related to authenticating
# client messages
authentication:
# the acceptable difference between the current server time and the
# client's time as specified in a client request message
timewindow: 15m
# Path on the file system where peer will store data (eg ledger). This
# location must be access control protected to prevent unintended
# modification that might corrupt the peer operations.
fileSystemPath: /home/wangcj/workspace/ca_solo/test/data/peer0.weh.cares.com/
# BCCSP (Blockchain crypto provider): Select which crypto implementation or
# library to use
BCCSP:
Default: SW
# Settings for the SW crypto provider (i.e. when DEFAULT: SW)
SW:
# TODO: The default Hash and Security level needs refactoring to be
# fully configurable. Changing these defaults requires coordination
# SHA2 is hardcoded in several places, not only BCCSP
Hash: SHA2
Security: 256
# Location of Key Store
FileKeyStore:
# If "", defaults to 'mspConfigPath'/keystore
KeyStore:
# Settings for the PKCS#11 crypto provider (i.e. when DEFAULT: PKCS11)
PKCS11:
# Location of the PKCS11 module library
Library:
# Token Label
Label:
# User PIN
Pin:
Hash:
Security:
FileKeyStore:
KeyStore:
# Path on the file system where peer will find MSP local configurations
mspConfigPath: /home/wangcj/workspace/ca_solo/client/weh/msp
# Identifier of the local MSP
# ----!!!!IMPORTANT!!!-!!!IMPORTANT!!!-!!!IMPORTANT!!!!----
# Deployers need to change the value of the localMspId string.
# In particular, the name of the local MSP ID of a peer needs
# to match the name of one of the MSPs in each of the channel
# that this peer is a member of. Otherwise this peer's messages
# will not be identified as valid by other nodes.
localMspId: airwh
# CLI common client config options
client:
# connection timeout
connTimeout: 3s
# Delivery service related config
deliveryclient:
# The total time to spend retrying connections to ordering nodes
# before giving up and returning an error.
reconnectTotalTimeThreshold: 3600s
# The connection timeout when connecting to ordering service nodes.
connTimeout: 3s
# The maximum delay between consecutive connection retry attempts to
# ordering nodes.
reConnectBackoffThreshold: 3600s
# A list of orderer endpoint addresses which should be overridden
# when found in channel configurations.
addressOverrides:
# - from:
# to:
# caCertsFile:
# - from:
# to:
# caCertsFile:
# Type for the local MSP - by default it's of type bccsp
localMspType: bccsp
# Used with Go profiling tools only in none production environment. In
# production, it should be disabled (eg enabled: false)
profile:
enabled: false
listenAddress: 0.0.0.0:6060
# The admin service is used for administrative operations such as
# control over logger levels, etc.
# Only peer administrators can use the service.
adminService:
# The interface and port on which the admin server will listen on.
# If this is commented out, or the port number is equal to the port
# of the peer listen address - the admin service is attached to the
# peer's service (defaults to 7051).
#listenAddress: 0.0.0.0:7055
# Handlers defines custom handlers that can filter and mutate
# objects passing within the peer, such as:
# Auth filter - reject or forward proposals from clients
# Decorators - append or mutate the chaincode input passed to the chaincode
# Endorsers - Custom signing over proposal response payload and its mutation
# Valid handler definition contains:
# - A name which is a factory method name defined in
# core/handlers/library/library.go for statically compiled handlers
# - library path to shared object binary for pluggable filters
# Auth filters and decorators are chained and executed in the order that
# they are defined. For example:
# authFilters:
# -
# name: FilterOne
# library: /opt/lib/filter.so
# -
# name: FilterTwo
# decorators:
# -
# name: DecoratorOne
# -
# name: DecoratorTwo
# library: /opt/lib/decorator.so
# Endorsers are configured as a map that its keys are the endorsement system chaincodes that are being overridden.
# Below is an example that overrides the default ESCC and uses an endorsement plugin that has the same functionality
# as the default ESCC.
# If the 'library' property is missing, the name is used as the constructor method in the builtin library similar
# to auth filters and decorators.
# endorsers:
# escc:
# name: DefaultESCC
# library: /etc/hyperledger/fabric/plugin/escc.so
handlers:
authFilters:
-
name: DefaultAuth
-
name: ExpirationCheck # This filter checks identity x509 certificate expiration
decorators:
-
name: DefaultDecorator
endorsers:
escc:
name: DefaultEndorsement
library:
validators:
vscc:
name: DefaultValidation
library:
# library: /etc/hyperledger/fabric/plugin/escc.so
# Number of goroutines that will execute transaction validation in parallel.
# By default, the peer chooses the number of CPUs on the machine. Set this
# variable to override that choice.
# NOTE: overriding this value might negatively influence the performance of
# the peer so please change this value only if you know what you're doing
validatorPoolSize:
# The discovery service is used by clients to query information about peers,
# such as - which peers have joined a certain channel, what is the latest
# channel config, and most importantly - given a chaincode and a channel,
# what possible sets of peers satisfy the endorsement policy.
discovery:
enabled: true
# Whether the authentication cache is enabled or not.
authCacheEnabled: true
# The maximum size of the cache, after which a purge takes place
authCacheMaxSize: 1000
# The proportion (0 to 1) of entries that remain in the cache after the cache is purged due to overpopulation
authCachePurgeRetentionRatio: 0.75
# Whether to allow non-admins to perform non channel scoped queries.
# When this is false, it means that only peer admins can perform non channel scoped queries.
orgMembersAllowedAccess: false
###############################################################################
#
# VM section
#
###############################################################################
vm:
# Endpoint of the vm management system. For docker can be one of the following in general
# unix:///var/run/docker.sock
# http://localhost:2375
# https://localhost:2376
endpoint: unix:///var//run/docker.sock
# settings for docker vms
docker:
tls:
enabled: false
ca:
file: docker/ca.crt
cert:
file: docker/tls.crt
key:
file: docker/tls.key
# Enables/disables the standard out/err from chaincode containers for
# debugging purposes
attachStdout: false
# Parameters on creating docker container.
# Container may be efficiently created using ipam & dns-server for cluster
# NetworkMode - sets the networking mode for the container. Supported
# standard values are: `host`(default),`bridge`,`ipvlan`,`none`.
# Dns - a list of DNS servers for the container to use.
# Note: `Privileged` `Binds` `Links` and `PortBindings` properties of
# Docker Host Config are not supported and will not be used if set.
# LogConfig - sets the logging driver (Type) and related options
# (Config) for Docker. For more info,
# https://docs.docker.com/engine/admin/logging/overview/
# Note: Set LogConfig using Environment Variables is not supported.
hostConfig:
NetworkMode: host
Dns:
# - 192.168.0.1
LogConfig:
Type: json-file
Config:
max-size: "50m"
max-file: "5"
Memory: 2147483648
###############################################################################
#
# Chaincode section
#
###############################################################################
chaincode:
# The id is used by the Chaincode stub to register the executing Chaincode
# ID with the Peer and is generally supplied through ENV variables
# the `path` form of ID is provided when installing the chaincode.
# The `name` is used for all other requests and can be any string.
id:
path:
name:
# Generic builder environment, suitable for most chaincode types
builder: $(DOCKER_NS)/fabric-ccenv:latest
# Enables/disables force pulling of the base docker images (listed below)
# during user chaincode instantiation.
# Useful when using moving image tags (such as :latest)
pull: false
golang:
# golang will never need more than baseos
runtime: $(BASE_DOCKER_NS)/fabric-baseos:$(ARCH)-$(BASE_VERSION)
# whether or not golang chaincode should be linked dynamically
dynamicLink: false
car:
# car may need more facilities (JVM, etc) in the future as the catalog
# of platforms are expanded. For now, we can just use baseos
runtime: $(BASE_DOCKER_NS)/fabric-baseos:$(ARCH)-$(BASE_VERSION)
java:
# This is an image based on java:openjdk-8 with addition compiler
# tools added for java shim layer packaging.
# This image is packed with shim layer libraries that are necessary
# for Java chaincode runtime.
runtime: $(DOCKER_NS)/fabric-javaenv:$(ARCH)-$(PROJECT_VERSION)
node:
# need node.js engine at runtime, currently available in baseimage
# but not in baseos
runtime: $(BASE_DOCKER_NS)/fabric-baseimage:$(ARCH)-$(BASE_VERSION)
# Timeout duration for starting up a container and waiting for Register
# to come through. 1sec should be plenty for chaincode unit tests
startuptimeout: 300s
# Timeout duration for Invoke and Init calls to prevent runaway.
# This timeout is used by all chaincodes in all the channels, including
# system chaincodes.
# Note that during Invoke, if the image is not available (e.g. being
# cleaned up when in development environment), the peer will automatically
# build the image, which might take more time. In production environment,
# the chaincode image is unlikely to be deleted, so the timeout could be
# reduced accordingly.
executetimeout: 30s
# There are 2 modes: "dev" and "net".
# In dev mode, user runs the chaincode after starting peer from
# command line on local machine.
# In net mode, peer will run chaincode in a docker container.
mode: net
# keepalive in seconds. In situations where the communiction goes through a
# proxy that does not support keep-alive, this parameter will maintain connection
# between peer and chaincode.
# A value <= 0 turns keepalive off
keepalive: 0
# system chaincodes whitelist. To add system chaincode "myscc" to the
# whitelist, add "myscc: enable" to the list below, and register in
# chaincode/importsysccs.go
system:
cscc: enable
lscc: enable
escc: enable
vscc: enable
qscc: enable
# System chaincode plugins:
# System chaincodes can be loaded as shared objects compiled as Go plugins.
# See examples/plugins/scc for an example.
# Plugins must be white listed in the chaincode.system section above.
systemPlugins:
# example configuration:
# - enabled: true
# name: myscc
# path: /opt/lib/myscc.so
# invokableExternal: true
# invokableCC2CC: true
# Logging section for the chaincode container
logging:
# Default level for all loggers within the chaincode container
level: info
# Override default level for the 'shim' logger
shim: warning
# Format for the chaincode container logs
format: '%{color}%{time:2006-01-02 15:04:05.000 MST} [%{module}] %{shortfunc} -> %{level:.4s} %{id:03x}%{color:reset} %{message}'
###############################################################################
#
# Ledger section - ledger configuration encompases both the blockchain
# and the state
#
###############################################################################
ledger:
blockchain:
state:
# stateDatabase - options are "goleveldb", "CouchDB"
# goleveldb - default state database stored in goleveldb.
# CouchDB - store state database in CouchDB
stateDatabase: goleveldb
# Limit on the number of records to return per query
totalQueryLimit: 100000
couchDBConfig:
# It is recommended to run CouchDB on the same server as the peer, and
# not map the CouchDB container port to a server port in docker-compose.
# Otherwise proper security must be provided on the connection between
# CouchDB client (on the peer) and server.
couchDBAddress: 127.0.0.1:5984
# This username must have read and write authority on CouchDB
username:
# The password is recommended to pass as an environment variable
# during start up (eg CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD).
# If it is stored here, the file must be access control protected
# to prevent unintended users from discovering the password.
password:
# Number of retries for CouchDB errors
maxRetries: 3
# Number of retries for CouchDB errors during peer startup
maxRetriesOnStartup: 12
# CouchDB request timeout (unit: duration, e.g. 20s)
requestTimeout: 35s
# Limit on the number of records per each CouchDB query
# Note that chaincode queries are only bound by totalQueryLimit.
# Internally the chaincode may execute multiple CouchDB queries,
# each of size internalQueryLimit.
internalQueryLimit: 1000
# Limit on the number of records per CouchDB bulk update batch
maxBatchUpdateSize: 1000
# Warm indexes after every N blocks.
# This option warms any indexes that have been
# deployed to CouchDB after every N blocks.
# A value of 1 will warm indexes after every block commit,
# to ensure fast selector queries.
# Increasing the value may improve write efficiency of peer and CouchDB,
# but may degrade query response time.
warmIndexesAfterNBlocks: 1
# Create the _global_changes system database
# This is optional. Creating the global changes database will require
# additional system resources to track changes and maintain the database
createGlobalChangesDB: false
history:
# enableHistoryDatabase - options are true or false
# Indicates if the history of key updates should be stored.
# All history 'index' will be stored in goleveldb, regardless if using
# CouchDB or alternate database for the state.
enableHistoryDatabase: true
###############################################################################
#
# Operations section
#
###############################################################################
operations:
# host and port for the operations server
listenAddress: 127.0.0.1:9446
# TLS configuration for the operations endpoint
tls:
# TLS enabled
enabled: false
# path to PEM encoded server certificate for the operations server
cert:
file:
# path to PEM encoded server key for the operations server
key:
file:
# most operations service endpoints require client authentication when TLS
# is enabled. clientAuthRequired requires client certificate authentication
# at the TLS layer to access all resources.
clientAuthRequired: false
# paths to PEM encoded ca certificates to trust for client authentication
clientRootCAs:
files: []
###############################################################################
#
# Metrics section
#
###############################################################################
metrics:
# metrics provider is one of statsd, prometheus, or disabled
provider: disabled
# statsd configuration
statsd:
# network type: tcp or udp
network: udp
# statsd server address
address: 127.0.0.1:8125
# the interval at which locally cached counters and gauges are pushed
# to statsd; timings are pushed immediately
writeInterval: 10s
# prefix is prepended to all emitted statsd metrics
prefix:4.5、创建系统创世块
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/cfg
configtxgen -profile SampleSingleMSPSolo -outputBlock /home/wangcj/workspace/ca_solo/test/data/orderer.genesis.block -channelID sys-security4.6、创建账本创世块
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/cfg
configtxgen -profile SampleSingleMSPSoloChannel -outputCreateChannelTx /home/wangcj/workspace/ca_solo/test/data/securityCheck.channel.tx -channelID securitycheck4.7、创建 NKG 锚节点文件
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/cfg
configtxgen -profile SampleSingleMSPSoloChannel -outputAnchorPeersUpdate /home/wangcj/workspace/ca_solo/test/data/njairportMSPanchors.tx -channelID securitycheck -asOrg njairport4.8、创建 WEH 锚节点文件
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/cfg
configtxgen -profile SampleSingleMSPSoloChannel -outputAnchorPeersUpdate /home/wangcj/workspace/ca_solo/test/data/airwhMSPanchors.tx -channelID securitycheck -asOrg airwh4.8、创建 WEH 锚节点文件
4.9、启动orderer
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/order/
orderer start
4.10、启动 NKG peer0
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/peers/nkg
peer node start4.11、启动 WEH peer0
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/peers/weh
peer node start4.12、创建通道
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/peers/weh
peer channel create -o orderer1.cares.com:7050 -c securitycheck -f /home/wangcj/workspace/ca_solo/test/data/securityCheck.channel.tx --outputBlock /home/wangcj/workspace/ca_solo/test/data/securitycheck.block
4.13、NKG peer0加入通道
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/peers/nkg
peer channel join -b /home/wangcj/workspace/ca_solo/test/data/securitycheck.block
peer channel update -o orderer1.cares.com:7050 -c securitycheck -f /home/wangcj/workspace/ca_solo/test/data/njairportMSPanchors.tx
4.14、WEH peer0加入通道
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/peers/weh
peer channel join -b /home/wangcj/workspace/ca_solo/test/data/securitycheck.block
peer channel update -o orderer1.cares.com:7050 -c securitycheck -f /home/wangcj/workspace/ca_solo/test/data/airwhMSPanchors.tx
4.15、WEH peer0 部署链码
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/peers/weh
peer chaincode install -n test -v 1.0 -p chaincode_example02 -l golang
4.16、NKG peer0 部署链码
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/peers/nkg
peer chaincode install -n test -v 1.0 -p chaincode_example02 -l golang
4.17、NKG peer0 实例化链码
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/peers/nkg
peer chaincode instantiate -o orderer1.cares.com:7050 -C securitycheck -n test -l golang -v 1.0 -c '{"Args":["init","a","200","b","200"]}' -P "OR ('airwh.member','njairport.member')"
4.18、NKG peer0 做转账交易
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/peers/nkg
peer chaincode invoke -o orderer.cares.sh.cn:7050 -C securitycheck -n test -c '{"Args":["invoke","a","b","5"]}'
4.19、NKG peer0 查询 a
export FABRIC_CFG_PATH=/home/wangcj/workspace/ca_solo/config/peers/nkg
peer chaincode query -C securitycheck -n test -c '{"Args":["query","a"]}'
5、自动化脚本
testret(){
if [ $1 -ne 0 ]; then
exit 1;
fi
printf "[\033[36m %s \033[0m]\n" "OK"
}
unsetenv(){
unset FABRIC_CFG_PATH
unset CORE_PEER_LOCALMSPID
unset CORE_PEER_ADDRESS
unset CORE_PEER_MSPCONFIGPATH
}
printf "\n"
TEST_HOME=$(cd $(dirname $0); pwd)
ROOT_MSP=$TEST_HOME/certs/root
mkdir -p $ROOT_MSP
FABRIC_CA=http://admin:admin@orderer.cares.com:5054
printf '%-70s' 'clear certs'
rm -fr $TEST_HOME/certs/*
testret $?
if [ -d "$TEST_HOME/logs" ];then
rm -fr $TEST_HOME/logs/*
else
mkdir -p $TEST_HOME/logs
fi
printf '%-70s' 'start FABRIC-CA'
$TEST_HOME/server/start
testret $?
delaffiliation(){
fabric-ca-client affiliation list --affiliation $1 -H $ROOT_MSP -u $FABRIC_CA > /dev/null 2>&1
if [ $? -eq 0 ];then
printf '\t%-62s' " delete org $1"
fabric-ca-client affiliation remove $1 --force -H $ROOT_MSP -u $FABRIC_CA > /dev/null 2>&1
testret $?
fi
}
printf '%-70s' ' wait FABRIC-CA process to be startup'
LISTENSTATUS=1
while [ $LISTENSTATUS -ne 0 ]
do
sleep 0.1s
netstat -an|grep 5054|grep LISTEN > /dev/null 2>&1
LISTENSTATUS=$?
done
testret 0
mkdir -p $ROOT_MSP
printf '%-70s' 'register MSP ROOT'
fabric-ca-client enroll -u $FABRIC_CA -H $ROOT_MSP > /dev/null 2>&1
testret $?
printf '%-70s\n' 'delete orgs affiliations'
delaffiliation com
printf '%-70s' "WORK DIR:$TEST_HOME"
testret 0
PEER_PIDS=$(ps -ef|grep 'peer node start'|grep -v grep|awk '{print $2}')
if [ -n "$PEER_PIDS" ]; then
printf '%-70s' 'stop peers processes'
kill -9 $PEER_PIDS
testret $?
fi
sleep 1s
ORDER_PID=$(ps -ef|grep 'orderer start'|grep -v grep|awk '{print $2}')
if [ -n "$ORDER_PID" ]; then
printf '%-70s' 'stop orderer process'
kill -9 $ORDER_PID
testret $?
fi
sleep 1s
EXPLORE_PID=$(ps -ef|grep 'node main.js name - hyperledger-explorer'|grep -v grep|awk '{print $2}')
if [ -n "$EXPLORE_PID" ]; then
printf '%-70s' 'stop FABRIC EXPPLORER'
cd $TEST_HOME/blockchain-explorer
nohup ./stop.sh > /dev/null 2>&1 &
testret $?
fi
sleep 2s
printf '%-70s' 'clear data files'
rm -rf rm -fr $TEST_HOME/test/data/*
testret $?
IMG_IDS=$(docker ps -a|grep -E 'dev-peer|devairwh-peer'|awk '{print $1}')
if [ -n "$IMG_IDS" ]; then
printf '%-70s' 'stop chaincode containers'
docker stop $(docker ps -a|grep -E 'dev-peer|devairwh-peer'|awk '{print $1}') > /dev/null 2>&1
testret $?
fi
IMG_IDS=$(docker ps -a|grep -E 'dev-peer|devairwh-peer'|awk '{print $1}')
if [ -n "$IMG_IDS" ]; then
printf '%-70s' 'remove chaincode containers'
docker rm $(docker ps -a|grep -E 'dev-peer|devairwh-peer'|awk '{print $1}') > /dev/null 2>&1
testret $?
fi
IMG_IDS=$(docker images -a|grep -E 'dev-peer|devairwh-peer'|awk '{print $3}')
if [ -n "$IMG_IDS" ]; then
printf '%-70s' 'remove chaincode images'
docker rmi $(docker images -a|grep -E 'dev-peer|devairwh-peer'|awk '{print $3}') > /dev/null 2>&1
testret $?
fi
mkdir -p $ROOT_MSP
printf '%-70s\n' 'register org affiliations'
printf '\t%-62s' 'register affiliations com'
fabric-ca-client affiliation add com -H $ROOT_MSP -u $FABRIC_CA > /dev/null 2>&1
testret $?
printf '%-70s\n' 'register org affiliations'
printf '\t%-62s' 'register affiliations com.cares'
fabric-ca-client affiliation add com.cares -H $ROOT_MSP -u $FABRIC_CA > /dev/null 2>&1
testret $?
printf '%-70s\n' 'register org affiliations'
printf '\t%-62s' 'register affiliations com.cares.orderer'
fabric-ca-client affiliation add com.cares.orderer -H $ROOT_MSP -u $FABRIC_CA > /dev/null 2>&1
testret $?
printf '\t%-62s' 'register affiliations com.cares.nkg'
fabric-ca-client affiliation add com.cares.nkg -H $ROOT_MSP -u $FABRIC_CA > /dev/null 2>&1
testret $?
printf '\t%-62s' 'register affiliations com.cares.weh'
fabric-ca-client affiliation add com.cares.weh -H $ROOT_MSP -u $FABRIC_CA > /dev/null 2>&1
testret $?
reqcerts(){
name=$1
type=$2
CERT_DIR=ordererOrgs
NODE_DIR=orderers
if [ "$type" = "peer" ]; then
CERT_DIR="peerOrgs"
NODE_DIR="peers"
fi
printf "\t%-62s" "get cacert of $name"
mkdir -p $TEST_HOME/certs/$CERT_DIR/$name/msp/
fabric-ca-client getcacert -M $TEST_HOME/certs/$CERT_DIR/$name/msp/ -H $TEST_HOME/certs/root/ -u $FABRIC_CA > /dev/null 2>&1
testret $?
printf '\t%-62s' "register orgAdmin of $name"
fabric-ca-client register --id.name Admin@$name.cares.com \
--id.secret 111111 \
--id.type client \
--id.affiliation com.cares.$name \
--id.attrs '"hf.Registrar.Roles=client,orderer,peer,user","hf.Registrar.DelegateRoles=client,orderer,peer,user",hf.Registrar.Attributes=*,hf.GenCRL=true,hf.Revoker=true,hf.AffiliationMgr=true,role=admin:ecert' \
-H $TEST_HOME/certs/root/ \
-u $FABRIC_CA > /dev/null 2>&1
testret $?
sleep 1s
printf '\t%-62s' "enroll orgAdmin of $name"
fabric-ca-client enroll -u http://Admin@$name.cares.com:111111@localhost:5054 -H $TEST_HOME/certs/$CERT_DIR/$name/users/Admin@$name.cares.com -u $FABRIC_CA > /dev/null 2>&1
testret $?
printf '\t%-62s' "copy admin certs of $name"
mkdir -p $TEST_HOME/certs/$CERT_DIR/$name/msp/admincerts
ADMINCERTFROM=$TEST_HOME/certs/$CERT_DIR/$name/users/Admin@$name.cares.com/msp/signcerts/*
ADMINCERTTO=$TEST_HOME/certs/$CERT_DIR/$name/msp/admincerts/
cp $ADMINCERTFROM $ADMINCERTTO
testret $?
mkdir -p $TEST_HOME/certs/$CERT_DIR/$name/users/Admin@$name.cares.com/msp/admincerts
cp $ADMINCERTFROM $TEST_HOME/certs/$CERT_DIR/$name/users/Admin@$name.cares.com/msp/admincerts
printf '\t%-62s\n' "register subAccount using admin of $2"
accounts=$3
if [ ! -n "$accounts" ];then
accounts=1
fi
for((i=0;i<$accounts;i++));
do
fabric-ca-client register -u http://localhost:5054 --id.name $type$i@$name.cares.com --id.secret 111111 --id.type $type \
--id.affiliation com.cares.$name --id.attrs "role=$type:ecert" --id.attrs "role=admin:ecert" -H $TEST_HOME/certs/$CERT_DIR/$name/users/Admin@$name.cares.com -u $FABRIC_CA > /dev/null 2>&1
fabric-ca-client enroll -u http://orderer1@orderer.cares.com:111111@localhost:5054 -H $TEST_HOME/certs/$CERT_DIR/$name/$NODE_DIR/$type$i@$name.cares.com -u $FABRIC_CA > /dev/null 2>&1
mkdir -p $TEST_HOME/certs/$CERT_DIR/$name/$NODE_DIR/$type$i@$name.cares.com/msp/admincerts
cp $TEST_HOME/certs/$CERT_DIR/$name/users/Admin@$name.cares.com/msp/signcerts/cert.pem $TEST_HOME/certs/$CERT_DIR/$name/$NODE_DIR/$type$i@$name.cares.com/msp/admincerts
done
}
mkdir -p $TEST_HOME/certs/{peerOrgs,ordererOrgs}
printf '%-70s\n' "get cert of orderer"
reqcerts orderer orderer
printf '%-70s\n' "get cert of nkg"
reqcerts nkg peer
printf '%-70s\n' "get cert of weh"
reqcerts weh peer
if [ "$1" = "down" ];then
exit 0
fi
printf '%-70s' '1,create system genesis'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/cfg
configtxgen -profile SampleSingleMSPSolo -outputBlock $TEST_HOME/test/data/orderer.genesis.block -channelID sys-security > /dev/null 2>&1
testret $?
printf '%-70s' '2,create channel genesis'
configtxgen -profile SampleSingleMSPSoloChannel -outputCreateChannelTx $TEST_HOME/test/data/securityCheck.channel.tx -channelID securitycheck > /dev/null 2>&1
testret $?
printf '%-70s' '3,create anchor njairport'
configtxgen -profile SampleSingleMSPSoloChannel -outputAnchorPeersUpdate $TEST_HOME/test/data/njairportMSPanchors.tx -channelID securitycheck -asOrg njairport > /dev/null 2>&1
testret $?
printf '%-70s' '4,create anchor airwh'
configtxgen -profile SampleSingleMSPSoloChannel -outputAnchorPeersUpdate $TEST_HOME/test/data/airwhMSPanchors.tx -channelID securitycheck -asOrg airwh > /dev/null 2>&1
testret $?
printf '%-70s' '5,start orderer'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/order
nohup orderer start > $TEST_HOME/logs/orderer.log 2>&1 &
testret $?
printf '%-70s' '6,start peer0 njairport'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/nkg/
nohup peer node start > $TEST_HOME/logs/njairport-peer0.log 2>&1 &
testret $?
printf '%-70s' '7,start peer0 airwh'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/weh
nohup peer node start > $TEST_HOME/logs/airwh-peer0.log 2>&1 &
testret $?
printf '%-70s\n\t%-62s' '8,create ledger channel ' 'wait orderer process'
LISTENSTATUS=1
while [ $LISTENSTATUS -ne 0 ]
do
sleep 1s
netstat -an|grep 7050|grep LISTEN > /dev/null 2>&1
LISTENSTATUS=$?
done
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/weh
peer channel create -o orderer.cares.com:7050 -c securitycheck -f $TEST_HOME/test/data/securityCheck.channel.tx --outputBlock $TEST_HOME/test/data/securitycheck.block > /dev/null 2>&1
testret $?
printf '%-70s' '9,nkg peer0 join channel'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/nkg
peer channel join -b $TEST_HOME/test/data/securitycheck.block > /dev/null 2>&1
testret $?
printf '%-70s' '10,weh peer0 join channel'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/weh
peer channel join -b $TEST_HOME/test/data/securitycheck.block > /dev/null 2>&1
testret $?
printf '%-70s' '11,update anchor njairport'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/nkg
peer channel update -o orderer.cares.com:7050 -c securitycheck -f $TEST_HOME/test/data/njairportMSPanchors.tx > /dev/null 2>&1
testret $?
printf '%-70s' '12,update anchor airwh'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/weh
peer channel update -o orderer.cares.com:7050 -c securitycheck -f $TEST_HOME/test/data/airwhMSPanchors.tx > /dev/null 2>&1
testret $?
## java 链码部署需要下载依赖，编译较慢 这里用go链码快速演示 go链码依赖于 $GOPATH
printf '%-70s' '13,install chaincode peer0 njairport'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/nkg
peer chaincode install -n test -v 1.0 -p chaincode_example02 -l golang > /dev/null 2>&1
testret $?
printf '%-70s' '14, instantiate chaincode peer0 njairport a=200,b=200'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/nkg
peer chaincode instantiate -o orderer.cares.com:7050 -C securitycheck -n test -l golang -v 1.0 -c '{"Args":["init","a","200","b","200"]}' -P "OR ('airwh.member','njairport.member')" > /dev/null 2>&1
testret $?
printf '%-70s\n' '15, peer0 njairport a transfer 5 to b'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/nkg
IMGSTATUS=1
printf '\t%-62s' 'wait chaincode container up'
while [ $IMGSTATUS -ne 0 ]
do
ps -ef|grep 'chaincode -peer.address='|grep -v grep > /dev/null 2>&1
IMGSTATUS=$?
done
sleep 5s
peer chaincode invoke -o orderer.cares.com:7050 -C securitycheck -n test -c '{"Args":["invoke","a","b","5"]}' > /dev/null 2>&1
testret $?
printf '%-70s' '21,peer0 njairport query value of a'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/nkg
sleep 3s
peer chaincode query -C securitycheck -n test -c '{"Args":["query","a"]}'
printf '%-70s' '22,peer0 njairport query value of b'
peer chaincode query -C securitycheck -n test -c '{"Args":["query","b"]}'
printf '%-70s' '13,install chaincode peer0 airwh'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/weh
peer chaincode install -n test -v 1.0 -p chaincode_example02 -l golang > /dev/null 2>&1
testret $?
printf '%-70s' '23,peer0 airwh query value of a'
unsetenv
export FABRIC_CFG_PATH=$TEST_HOME/config/peers/weh
peer chaincode query -C securitycheck -n test -c '{"Args":["query","a"]}'
printf '%-70s' '24,peer0 airwh query value of b'
peer chaincode query -C securitycheck -n test -c '{"Args":["query","b"]}'
docker ps|grep 'hyperledger/explorer-db' > /dev/null
if [ $? -eq 0 ]; then
docker exec -it -u postgres postgresql dropdb fabricexplorer > /dev/null
sleep 1s
docker exec -it -u postgres postgresql /opt/createdb.sh > /dev/null
sleep 1s
rm -fr $TEST_HOME/blockchain-explorer/wallet/*
rm -fr $TEST_HOME/blockchain-explorer/logs/*
PRE_KEY=`cat $TEST_HOME/blockchain-explorer/app/platform/fabric/connection-profile/first-network.json|grep -o 'keystore/.*sk'|awk -F / '{print $2}'`
if [ -n "$PRE_KEY" ]; then
CUR_KEY=`ls $TEST_HOME/certs/peerOrgs/nkg/users/Admin@nkg.cares.com/msp/keystore/`
sed -i "s#$PRE_KEY#$CUR_KEY#g" $TEST_HOME/blockchain-explorer/app/platform/fabric/connection-profile/first-network.json
cd $TEST_HOME/blockchain-explorer
nohup ./start.sh > /dev/null 2>&1 &
fi
fi
printf '%-70s\n' 'Hyperledger Fabric CA 简易网络 搭建成功'
本博客所有文章除特别声明外，均采用 CC BY-SA 3.0协议 。转载请注明出处！