{"id":50646583,"url":"https://github.com/open-eid/SiGa","last_synced_at":"2026-07-12T14:00:39.494Z","repository":{"id":44538469,"uuid":"167199653","full_name":"open-eid/SiGa","owner":"open-eid","description":"Signature Gateway","archived":false,"fork":false,"pushed_at":"2026-07-08T13:45:06.000Z","size":33471,"stargazers_count":23,"open_issues_count":6,"forks_count":15,"subscribers_count":12,"default_branch":"develop","last_synced_at":"2026-07-08T14:08:35.762Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"eupl-1.2","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/open-eid.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2019-01-23T14:48:33.000Z","updated_at":"2026-07-02T08:08:47.000Z","dependencies_parsed_at":"2026-05-20T08:02:22.907Z","dependency_job_id":"d22a518c-f351-4729-ae7e-d0af864ebe1d","html_url":"https://github.com/open-eid/SiGa","commit_stats":null,"previous_names":[],"tags_count":30,"template":false,"template_full_name":null,"purl":"pkg:github/open-eid/SiGa","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/open-eid%2FSiGa","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/open-eid%2FSiGa/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/open-eid%2FSiGa/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/open-eid%2FSiGa/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/open-eid","download_url":"https://codeload.github.com/open-eid/SiGa/tar.gz/refs/heads/develop","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/open-eid%2FSiGa/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35393398,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-12T02:00:06.386Z","response_time":87,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-07T13:00:30.180Z","updated_at":"2026-07-12T14:00:39.487Z","avatar_url":"https://github.com/open-eid.png","language":"Java","funding_links":[],"categories":["Interoperability and Digital Infrastructure"],"sub_categories":[],"readme":"\u003cimg src=\"docs/img/Co-funded_by_the_European_Union.jpg\" width=\"350\" height=\"200\" alt=\"Co-funded by the European Union\"\u003e\n\n# SiGa - Signature Gateway\n\nSignature Gateway is a web service for creating and signing ASIC-E containers and validating both ASIC-E and BDOC containers with XAdES signatures.\n\n\u003e [!NOTE]\n\u003e Looking for the [**Digital Signature Gateway service**](https://www.ria.ee/en/state-information-system/electronic-identity-eid-and-trust-services/services-digital-signatures)?  \n\u003e Documentation is available [**here**](https://open-eid.github.io/allkirjastamisteenus/).\n\n## Prerequisites:\nFor building and running SiGa you need Java 17.\n\n## External services used by SiGa\n\n* [Signature Validation Service](http://open-eid.github.io/SiVa/) for validating signatures.\n* [MID REST service](https://github.com/SK-EID/MID/wiki) for signing with Mobile-ID (if enabled in configuration).\n* [Smart-ID service](https://github.com/SK-EID/smart-id-documentation) for signing with Smart-ID (if enabled in configuration).\n* TimeStamping service (based on configuration)\n* (AIA) OCSP service (based on configuration)\n* LOTL and national TSL services\n\n### SiGa component model\n\n![SiGa component model](docs/img/siga_component_model.png)\n\n## How to build\n\nSiGa project compiles into a JAR (Java archive) or WAR (Web application archive) file. The former one includes embedded\nTomcat, while the latter one requires a separate servlet container to run.\n\n### Building JAR with embedded Tomcat\n\n```bash\n./mvnw clean install\n```\n\n### Building WAR for a separate servlet container\n\n```bash\n./mvnw clean install -Pwar\n```\n\n## How to deploy\n\n### SiGa Deployment diagram\n\n![SiGa deployment diagram](docs/img/siga_deployment.png)\n\nIn addition to a JAR or WAR file containing compiled SiGa, [Apache Ignite](https://ignite.apache.org/) version 2.17.0 is\nrequired for session management.\n\n### Running Apache Ignite\n\n**Ignite servers must be up and running prior to SiGa startup.** Ignite servers must be\nconfigured the same way as the Ignite client embedded in SiGa. An example Ignite configuration file can be seen\n[here](docker/siga-ignite/ignite-configuration.xml).\nAdditionally, the following options must be added to the `JVM_OPTS` parameter in Ignite's `setenv.sh` file:\n```bash\n--add-opens=jdk.management/com.sun.management.internal=ALL-UNNAMED\n--add-opens=java.base/jdk.internal.misc=ALL-UNNAMED\n--add-opens=java.base/sun.nio.ch=ALL-UNNAMED\n--add-opens=java.management/com.sun.jmx.mbeanserver=ALL-UNNAMED\n--add-opens=java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED\n--add-opens=java.base/java.io=ALL-UNNAMED\n--add-opens=java.base/java.nio=ALL-UNNAMED\n--add-opens=java.base/java.util=ALL-UNNAMED\n--add-opens=java.base/java.util.concurrent=ALL-UNNAMED\n--add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED\n--add-opens=java.base/java.util.concurrent.locks=ALL-UNNAMED\n--add-opens=java.base/java.lang=ALL-UNNAMED\n--add-opens=java.base/java.time=ALL-UNNAMED\n```\nFor general instructions, refer to [the official documentation](https://ignite.apache.org/docs/latest/quick-start/java) to\nconfigure and run Ignite.\n\n### Running SiGa\n\n#### Running SiGa with embedded Tomcat\n\n* Make [`application.properties`](#applicationproperties) available anywhere in the host system.\n* Set $JAVA_OPTS environment variable with the required options (see more on\n  [Ignite Getting Started guide](https://ignite.apache.org/docs/latest/quick-start/java#running-ignite-with-java-11-or-later)).\n  Replace the path of `application.properties` in the following command to point to your own file.\n  ```bash\n  export JAVA_OPTS=\"-Dspring.config.location=file:/path/to/application.properties\\\n    --add-opens=jdk.management/com.sun.management.internal=ALL-UNNAMED\\\n    --add-opens=java.base/jdk.internal.misc=ALL-UNNAMED\\\n    --add-opens=java.base/sun.nio.ch=ALL-UNNAMED\\\n    --add-opens=java.management/com.sun.jmx.mbeanserver=ALL-UNNAMED\\\n    --add-opens=java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED\\\n    --add-opens=java.base/java.io=ALL-UNNAMED\\\n    --add-opens=java.base/java.nio=ALL-UNNAMED\\\n    --add-opens=java.base/java.util=ALL-UNNAMED\\\n    --add-opens=java.base/java.util.concurrent=ALL-UNNAMED\\\n    --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED\\\n    --add-opens=java.base/java.util.concurrent.locks=ALL-UNNAMED\\\n    --add-opens=java.base/java.lang=ALL-UNNAMED\\\n    --add-opens=java.base/java.time=ALL-UNNAMED\\\n    --add-opens=java.base/sun.security.x509=ALL-UNNAMED\\\n    --add-opens=java.base/java.security.cert=ALL-UNNAMED\\\n    -Djdk.tls.client.protocols=TLSv1.2\"\n  ```\n* Run JAR file with SiGa webapp and embedded Tomcat (X.X.X denotes the version you are using):\n  ```bash\n  java $JAVA_OPTS -jar siga-webapp/target/siga-webapp-X.X.X.jar\n  ```\n\n#### Running SiGa in separate Tomcat installation\n\nAt first, Tomcat web servlet container needs to be downloaded. For example, version 8.5.46 could be downloaded with the\nfollowing command using `wget`:\n```bash\nwget https://www-eu.apache.org/dist/tomcat/tomcat-8/v8.5.46/bin/apache-tomcat-8.5.46.tar.gz\n```\n\nUnpack it somewhere:\n```bash\ntar -xzf apache-tomcat-8.5.46.tar.gz\n```\n\nCopy the built WAR file containing SiGa into Tomcat's `webapps` directory and start the servlet container:\n```bash\ncp SiGa/siga-webapp/target/siga-webapp-2.0.1.war apache-tomcat-8.5.46/webapps\n./apache-tomcat-8.5.46/bin/catalina.sh run\n```\n\n* Make [`application.properties`](#applicationproperties) available anywhere in the host system.\n* Depending on your system, it might be required to set the `JAVA_HOME` environment variable in file `/etc/default/tomcat8`. For example:\n  * `JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64`\n* Create or modify `setenv.sh` placed inside Tomcat `bin` directory:\n  * `export JAVA_OPTS=\"$JAVA_OPTS -Dspring.config.location=file:/path/to/application.properties\"`\n  * `export JAVA_OPTS=\"$JAVA_OPTS -Dspring.profiles.active=list-of-profiles-to-activate\"` (see [available profiles](#available-profiles))\n\nAdditionally, the following options must be added to the `JAVA_OPTS` parameter in the same `setenv.sh` file (see more on\n[Ignite Getting Started guide](https://ignite.apache.org/docs/latest/quick-start/java#running-ignite-with-java-11-or-later)):\n```bash\n--add-opens=jdk.management/com.sun.management.internal=ALL-UNNAMED\n--add-opens=java.base/jdk.internal.misc=ALL-UNNAMED\n--add-opens=java.base/sun.nio.ch=ALL-UNNAMED\n--add-opens=java.management/com.sun.jmx.mbeanserver=ALL-UNNAMED\n--add-opens=java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED\n--add-opens=java.base/java.io=ALL-UNNAMED\n--add-opens=java.base/java.nio=ALL-UNNAMED\n--add-opens=java.base/java.util=ALL-UNNAMED\n--add-opens=java.base/java.util.concurrent=ALL-UNNAMED\n--add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED\n--add-opens=java.base/java.util.concurrent.locks=ALL-UNNAMED\n--add-opens=java.base/java.lang=ALL-UNNAMED\n--add-opens=java.base/java.time=ALL-UNNAMED\n--add-opens=java.base/sun.security.x509=ALL-UNNAMED\n--add-opens=java.base/java.security.cert=ALL-UNNAMED\n-Djdk.tls.client.protocols=TLSv1.2\n```\n\n### Available Spring profiles\n\n| Profile name      | Description                                 |\n|-------------------|---------------------------------------------|\n| digidoc4jProd     | Use DD4J production mode                    |\n| digidoc4jTest     | Use DD4J test mode (prefer AIA-OCSP)        |\n| digidoc4jPerf     | Use DD4J test mode (without AIA-OCSP)       |\n| mobileId          | Enable endpoints for signing with Mobile-ID |\n| smartId           | Enable endpoints for signing with Smart-ID  |\n| datafileContainer | Enable datafile container endpoints*        |\n\n**NB:** exactly one of `digidoc4jProd`, `digidoc4jTest` and `digidoc4jPerf` must be active!\n\n\\* Datafile containers support has not been thoroughly performance tested. Use at your own risk.\n\n## SiGa configuration\n\n### `application.properties`\n\nExample `application.properties` file with DEMO parameters can be seen [here](docker/siga-webapp/application.properties).\n`application.properties` values must be changed for production mode, as default maven profile does not include it in the build.\nCommon Spring Boot properties are described [here](https://docs.spring.io/spring-boot/docs/2.7.7/reference/html/application-properties.html).\n\n#### SiGa Ignite configuration\n\n| Parameter                              | Mandatory | Description                                 | Example                              |\n| -------------------------------------- | --------- | ------------------------------------------- | ------------------------------------ |\n| siga.ignite.configuration-location     | Y         | Location of the ignite configuration file.  | `/path/to/ignite-configuration.xml`  |\n| siga.ignite.application-cache-version  | Y         | Version of Ignite cache.                    | `v1`                                 |\n\nExample `ignite-configuration.xml` file can be seen [here](docker/siga-ignite/ignite-configuration.xml).\n\n#### SiGa DD4J configuration\n\n| Parameter                         | Mandatory | Description                                                           | Example                    |\n| --------------------------------- | --------- | --------------------------------------------------------------------- | -------------------------- |\n| siga.dd4j.configuration-location  | Y         | Location of the DD4J configuration file.                              | `/path/to/digidoc4j.yaml`  |\n| siga.dd4j.tsl-refresh-job-cron    | Y         | Cron expression for the scheduled job that refreshes DD4J TSL cache.  | `0 0 3 * * *`              |\n\nMore about configuring DD4J [here](https://github.com/open-eid/digidoc4j/wiki/Questions-\u0026-Answers#using-a-yaml-file-for-configuration).\n\n#### SiGa SiVa configuration\n\n| Parameter                      | Mandatory | Description                                                                                                                                                                          | Example                                                                |\n|--------------------------------|-----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------|\n| siga.siva.url                  | Y         | Signature validation service URL.                                                                                                                                                    | `https://siva-arendus.eesti.ee/V3`                                     |\n| siga.siva.trust-store          | Y         | SiVa service truststore path.                                                                                                                                                        | `file:/path/to/trust-store.p12` or `classpath:path/to/trust-store.p12` |\n| siga.siva.trust-store-password | Y         | SiVa service truststore password.                                                                                                                                                    | `changeit`                                                             |\n| siga.siva.connection-timeout   | N         | Connection timeout for regular connections in ISO-8601 duration format `PnDTnHnMn.nS`. The input is truncated to millisecond precision. If not provided, defaults to system default. | `PT10S`                                                                |\n| siga.siva.write-timeout        | N         | Write timeout for regular connections in ISO-8601 duration format `PnDTnHnMn.nS`. The input is truncated to millisecond precision. If not provided, defaults to system default.      | `PT10S`                                                                |\n| siga.siva.read-timeout         | N         | Read timeout for regular connections in ISO-8601 duration format `PnDTnHnMn.nS`. The input is truncated to millisecond precision. If not provided, defaults to system default.       | `PT10S`                                                                |\n| siga.siva.max-in-memory-size   | N         | Maximum size of data to be sent to SiVa. If not provided, defaults to 256KB. Note that the default size may not be enough for containers with dozens of signatures.                  | `5MB`                                                                  |\n\n#### SiGa MID REST configuration\n\nApplicable if `mobileId` profile is active.\n\n| Parameter                         | Mandatory | Description                                                                                                                                                                                                                                                                                                               | Example                          |\n|-----------------------------------| --------- |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------|\n| siga.midrest.url                  | Y         | MID REST service URL.                                                                                                                                                                                                                                                                                                     | `https://tsp.demo.sk.ee/mid-api` |\n| siga.midrest.allowed-countries    | N         | MID REST allowed countries.                                                                                                                                                                                                                                                                                               | `EE, LT`                         |\n| siga.midrest.truststore-path      | Y         | MID REST PKCS12 truststore path.                                                                                                                                                                                                                                                                                          | `mid_truststore.p12`             |\n| siga.midrest.truststore-password  | Y         | MID REST PKCS12 truststore password.                                                                                                                                                                                                                                                                                      | `changeIt`                       |\n| siga.midrest.long-polling-timeout | N         | MID REST [session status request](https://github.com/SK-EID/MID#334-long-polling) long poll value in milliseconds. Defaults to `30000`. [Supports ISO 8601 Duration format.](https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config-conversion-duration)  | `30000`                          |\n| siga.midrest.connect-timeout      | N         | MID REST client connection timeout in milliseconds. Defaults to `5000`. [Supports ISO 8601 Duration format.](https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config-conversion-duration)                                                                  | `5000`                           |\n| siga.midrest.status-polling-delay | N         | Delay before polling status in milliseconds. Defaults to `6000`. [Supports ISO 8601 Duration format.](https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config-conversion-duration)                                                                         | `6000`                           |\n\n**NB:** MID REST relying party name and UUID are registered per [service](#siga_service).\n\n#### SiGa Smart-ID configuration\n\nApplicable if `smartId` profile is active.\n\n| Parameter                                         | Mandatory | Description                                                                                                                                                                                                                                                                                                                                                        | Example                                  |\n|---------------------------------------------------| --------- |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------|\n| siga.sid.url                                      | Y         | Smart-ID service URL.                                                                                                                                                                                                                                                                                                                                              | `https://sid.demo.sk.ee/smart-id-rp/v2/` |\n| siga.sid.session-status-response-socket-open-time | N         | Smart-ID [session status request](https://github.com/SK-EID/smart-id-documentation/blob/master/README.md#46-session-status) long poll value in milliseconds. Defaults to `30000`. [Supports ISO 8601 Duration format.](https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config-conversion-duration) | `30000`                                  |\n| siga.sid.connect-timeout                          | N         | Smart-ID client connection timeout in milliseconds. Defaults to `5000`. [Supports ISO 8601 Duration format.](https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config-conversion-duration)                                                                                                           | `5000`                                   |\n| siga.sid.status-polling-delay                     | N         | Delay before polling status in milliseconds. Defaults to `6000`. [Supports ISO 8601 Duration format.](https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config-conversion-duration)                                                                                                                  | `6000`                                   |\n| siga.sid.allowed-countries                        | N         | Smart-ID allowed countries. Defaults to `EE, LT, LV`.                                                                                                                                                                                                                                                                                                              | `EE, LV, LT`                             |\n| siga.sid.interaction-type                         | N         | Smart-ID [interaction](https://github.com/SK-EID/smart-id-documentation#31-uc-x-interaction-choice-realization) to be requested to be performed by the Smart-ID app. Supported options: `DISPLAY_TEXT_AND_PIN`, `VERIFICATION_CODE_CHOICE`. Defaults to `DISPLAY_TEXT_AND_PIN`.                                                                                    | `VERIFICATION_CODE_CHOICE`               |\n| siga.sid.truststore-path                          | Y         | Smart-ID PKCS12 truststore path                                                                                                                                                                                                                                                                                                                                    | `sid_truststore.p12`                     |\n| siga.sid.truststore-password                      | Y         | Smart-ID PKCS12 truststore password                                                                                                                                                                                                                                                                                                                                | `changeIt`                               |\n\n**NB:** Smart-ID relying party name and UUID are registered per [service](#siga_service).\n\n#### SiGa MID/SID signature/certificate status request re-processing configuration\n\nMID/SID signature/certificate status requests and signature finalization steps are performed in background process. Following configuration parameters define how these steps are re-processed if exception occurs.\n\n| Parameter                                        | Mandatory | Description                                                                                                                                                                                                                                                                                                                                                                                                                          | Example  |\n|--------------------------------------------------|-----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|\n| siga.status-reprocessing.fixed-rate              |  N        | Failed signature/certificate status re-processing interval in milliseconds. Default value in milliseconds: `5000`                                                                                                                                                                                                                                                                                                                    | `5000`   |\n| siga.status-reprocessing.initial-delay           |  N        | Initial delay on startup before re-processing signature/certificate status requests. Default value in milliseconds: `5000`                                                                                                                                                                                                                                                                                                           | `5000`   |\n| siga.status-reprocessing.max-processing-attempts |  N        | Maximum failed processing attempts. Default value: `10`                                                                                                                                                                                                                                                                                                                                                                              | `10`     |\n| siga.status-reprocessing.processing-timeout      |  N        | Maximum processing time, before request is considered failed and can be re-processed by other SiGa nodes. Used when request processing SiGa node fails or leaves Ignite topology. Default value in milliseconds: `30000` [Supports ISO 8601 Duration format.](https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config-conversion-duration)                            | `30000`  |\n| siga.status-reprocessing.exception-timout        |  N        | Maximum time from last exception, before request is considered failed and can be re-processed by other SiGa nodes. Used when recoverable exception (e.g. networking) occurs and request can be re-processed. Default value in milliseconds: `5000`  [Supports ISO 8601 Duration format.](https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-features.html#boot-features-external-config-conversion-duration) | `5000`   |\n\n#### SiGa security configuration\n\n| Parameter                                            | Mandatory | Description                                                                                                                                                                                | Example                                         |\n| ---------------------------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------- |\n| siga.security.hmac.expiration                        | Y         | Maximum amount of time from signing timestamp after which the request is considered expired, in seconds. Validation takes into account clock skew. Must be greater than or equal to `-1`.  | `5`                                             |\n| siga.security.hmac.clock-skew                        | Y         | Maximum clock skew between SiGa server and service provider machines, in seconds. Must be greater than or equal to `0`.                                                                    | `2`                                             |\n| siga.security.jasypt.encryption-algo                 | Y         | Algorithm that is used to encrypt service signing key values in service database.                                                                                                          | `PBEWITHSHA-256AND256BITAES-CBC-BC`             |\n| siga.security.jasypt.encryption-key                  | Y         | Secret key that is used to encrypt/decrypt service signing key values in service database.                                                                                                 | `encryptorKey`                                  |\n| siga.security.prohibited-policies-for-remote-signing | N         | Prohibited certificate policy OIDs for remote signing endpoint. Default values: 1.3.6.1.4.1.10015.1.3, 1.3.6.1.4.1.10015.18.1, 1.3.6.1.4.1.10015.17.2, 1.3.6.1.4.1.10015.17.1              | `1.3.6.1.4.1.10015.1.3, 1.3.6.1.4.1.10015.17.2` |\n\n#### SiGa database configuration\n\nExample changelogs and changesets are provided under `siga-auth/src/main/resources/db`. To apply a changelog to the database on the application startup, `spring.liquibase.change-log` property must be set, e.g.:\n\n```\nspring.liquibase.change-log=classpath:db/changelog/db.changelog-master.yaml\n```\n\nUse `classpath:db/changelog/db.changelog-master-dev.yaml` only for test/dev purposes. This changeset inserts default testing values into services database.\n\nOut-of-the-box, SiGa supports **H2** and **PostgreSQL** databases. **H2** is good for development and testing, but in production using **PostgreSQL** is recommended.\nAn example for configuring SiGa to use PostgreSQL:\n\n```\nspring.sql.init.continue-on-error=false\nspring.sql.init.platform=postgresql\nspring.datasource.driver-class-name=org.postgresql.Driver\nspring.datasource.url=jdbc:postgresql://127.0.0.1:5432/database\nspring.datasource.username=user\nspring.datasource.password=password\n```\n\n#### SiGa monitoring configuration\n\nSiGa exposes monitoring endpoints via [Spring Boot Actuator](https://docs.spring.io/spring-boot/reference/actuator/endpoints.html). An example configuration for monitoring-related properties used in the Docker-based demo setup can be found in [docker/siga-webapp/application.properties](docker/siga-webapp/application.properties). If SiGa is configured without the example configuration, [Spring Boot default values](https://docs.spring.io/spring-boot/appendix/application-properties/index.html) will apply.\n\n**Heartbeat endpoint**\n\nThe heartbeat endpoint returns a simple aggregate health status. Since it delegates to the Spring Boot [health endpoint](https://docs.spring.io/spring-boot/reference/actuator/endpoints.html#actuator.endpoints.health) internally, `health` must also be included for the heartbeat to function. The following configuration should be added to `application.properties`:\n```\nmanagement.endpoints.web.exposure.include=health,heartbeat\nmanagement.endpoint.heartbeat.enabled=true\n```\nBy default, the heartbeat endpoint can be accessed at `{host}/actuator/heartbeat`. Subject to configured servlet context path and actuator configuration.\n\n**Version endpoint**\n\nTo add the version information endpoint, the following configuration should be added to `application.properties`:\n```\nmanagement.endpoints.web.exposure.include=version\nmanagement.endpoint.version.enabled=true\n```\nBy default, the version information endpoint can be accessed at `{host}/actuator/version`. Subject to configured servlet context path and actuator configuration.\n\n**Prometheus endpoint**\n\nSiGa supports metrics collection via [Prometheus](https://docs.spring.io/spring-boot/reference/actuator/metrics.html#actuator.metrics.export.prometheus). To enable the Prometheus metrics endpoint, the following configuration should be added to `application.properties`:\n```\nmanagement.endpoints.web.exposure.include=prometheus\n```\nBy default, the Prometheus metrics endpoint can be accessed at `{host}/actuator/prometheus`. Subject to configured servlet context path and actuator configuration.\n\n## SiGa database\n\n### Data model\n\n#### SIGA_CLIENT\n\nA table holding all the registered clients that are allowed to use SiGa.\n\n| Column name    | Type                                | Description                 |\n| -------------- | ----------------------------------- | --------------------------- |\n| id             | SERIAL (autoincrement primary key)  | Entry ID                    |\n| name           | VARCHAR(100)                        | Client name                 |\n| contact_name   | VARCHAR(100)                        | Client contact person name  |\n| contact_email  | VARCHAR(256)                        | Client contact e-mail       |\n| contact_phone  | VARCHAR(30)                         | Client contact phone        |\n| uuid           | VARCHAR(36)                         | Client UUID                 |\n| created_at     | TIMESTAMP                           | Client creation date        |\n| updated_at     | TIMESTAMP                           | Client update date          |\n\n#### SIGA_SERVICE\n\nA table holding all the registered services that are allowed to use SiGa.\n\n| Column name                  | Type                                | Description                                                                                                   |\n| ---------------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------- |\n| id                           | SERIAL (autoincrement primary key)  | Entry ID                                                                                                      |\n| uuid                         | VARCHAR(36)                         | Service UUID                                                                                                  |\n| signing_secret               | VARCHAR(128)                        | A previously agreed secret that is used to sign all requests sent to SiGa by this service                     |\n| client_id                    | INTEGER                             | Client ID (foreign key to SIGA_CLIENT)                                                                        |\n| name                         | VARCHAR(100)                        | Service name                                                                                                  |\n| sk_relying_party_name        | VARCHAR(100)                        | [MID REST relying party name](https://github.com/SK-EID/MID#21-relyingpartyname)                              |\n| sk_relying_party_uuid        | VARCHAR(100)                        | [MID REST relying party UUID](https://github.com/SK-EID/MID#22-relyingpartyuuid)                              |\n| smart_id_relying_party_name  | VARCHAR(100)                        | [Smart-ID relying party name](https://github.com/SK-EID/smart-id-documentation#32-relyingpartyname-handling)  |\n| smart_id_relying_party_uuid  | VARCHAR(100)                        | [Smart-ID relying party UUID](https://github.com/SK-EID/smart-id-documentation#31-uuid-encoding)              |\n| billing_email                | VARCHAR(128)                        | (currently not used by SiGa)                                                                                  |\n| max_connection_count         | INTEGER                             | Allowed maximum number of active sessions for this service. A value of `-1` indicates no limit                |\n| max_connections_size         | BIGINT                              | Allowed cumulative maximum data volume* for all active sessions. A value of `-1` indicates no limit           |\n| max_connection_size          | BIGINT                              | Allowed maximum data volume* for a single session. A value of `-1` indicates no limit                         |\n| inactive                     | BOOLEAN                             | Indicates if the service is active or not                                                                     |\n| created_at                   | TIMESTAMP                           | Service creation date                                                                                         |\n| updated_at                   | TIMESTAMP                           | Service update date                                                                                           |\n\n\\* data volume is based on the content length of HTTP POST requests.\n\n#### SIGA_CONNECTION\n\nA table holding cumulative data volume* per active session.\n\n| Column name   | Type                                | Description                                                                  |\n| ------------- | ----------------------------------- | ---------------------------------------------------------------------------- |\n| id            | SERIAL (autoincrement primary key)  | Entry ID                                                                     |\n| container_id  | VARCHAR(36)                         | Container ID (an internal identifier identifying a currently active session) |\n| service_id    | INTEGER                             | Service ID (foreign key to SIGA_SERVICE)                                     |\n| size          | BIGINT                              | Cumulative data volume* for this session                                     |\n| created_at    | TIMESTAMP                           | Connection creation date                                                     |\n| updated_at    | TIMESTAMP                           | Connection update date                                                       |\n\n\\* data volume is based on the content length of HTTP POST requests.\n\n#### SIGA_IP_PERMISSION\n\nA table holding ip permissions for external Siga service (SOAP PROXY)\n\n| Column name   | Type                                | Description                                           |\n| ------------- | ----------------------------------- | ----------------------------------------------------- |\n| id            | SERIAL (autoincrement primary key)  | Entry ID                                              |\n| service_id    | INTEGER                             | Service ID (foreign key to SIGA_SERVICE)              |\n| ip_address    | VARCHAR(36)                         | Allowed ip address                                    |\n| created_at    | TIMESTAMP                           | Ip permission creation date                           |\n| updated_at    | TIMESTAMP                           | Ip permission update date                             |\n\n## Running SiGa with Docker\n\n### For development and testing purposes only!\n\n#### Preconditions\n1. Java 17\n2. Docker must be installed and running.\n3. The [siga-demo-application](https://github.com/open-eid/SiGa-demo-application) docker image must be built and available on Docker as `siga-demo-application:latest`.\n\n#### First time setup: \n1. Build this project\n```bash\n./mvnw clean install\n```\n\n2. Build SiGa webapp docker image \n```bash\n./mvnw spring-boot:build-image -pl siga-webapp -DskipTests\n```\n\n3. Generate application keystores/truststores\n```bash\n./docker/tls/generate-certificates.sh\n```\n\n4. From your project directory, start up your applications in test mode by running\n```bash\ndocker-compose up --build\n```\n\nNow SiGa itself is accessible https://localhost:8443/siga and siga-demo-application https://siga-demo.localhost:9443/ .\nYou can view the logs for all the running containers at http://localhost:11080 .\n\n#### For updating software:\n\n1. Build the project with changes\n```bash\n./mvnw clean install\n```\n\n2. Build SiGa webapp docker image\n```bash\n./mvnw spring-boot:build-image -pl siga-webapp -DskipTests\n```\n\n3. Run the image\n```bash\ndocker-compose up\n```\n\n### Using SID mock\nBy default, dockerized SiGa is using SK Smart-ID DEMO service. \nTo use [SID-mock](https://github.com/Test-Government/SID-mock) instead run:\n```bash\ndocker compose -f docker-compose.yaml -f docker-compose-sid-mock.yaml up -d \n```\n\n\n## Integration tests\n\nIntegration tests for SiGa are available in the following repository: https://github.com/open-eid/SiGa-Tests\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopen-eid%2FSiGa","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopen-eid%2FSiGa","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopen-eid%2FSiGa/lists"}