Migrate to Podman (Podman compose)

This article is new for Nexus OCSP Responder 6.2.7-1.

This article describes how to migrate an existing Nexus OCSP Responder installation to Podman using Podman compose.

Prerequisites

• Nexus OCSP Responder (OCSP) is installed with version OCSP 6.2.7.

• Podman version 4.9.4 or later is installed.

• A valid OCSP license file.

Earlier OCSP versions are not supported for migration and must be updated the regular way before a migration can be performed.

Step-by-step instructions

Deployment directory setup

When deploying using podman-compose, the name of the directory in which the distributable deployment files are located will dictate the prefix of the names of each container deployed using the docker-compose.yml file. In general, most parameters in the docker-compose.yml files can be changed to suit special needs, such as for example ports that are exposed by the containers can be changed to different ports if so required.

In this guide it is assumed that the name of this directory is ocsp, and each container name will hence be prefixed with:

ocsp_

This will also be the directory from which the deployment will be done from and all configuration for the containers is placed inside it.

Load Podman image

The Podman image for OCSP are located in the image directory within the distributable package.

Load the image using the following command:

podman image load -i image-6.2.7-1/ocsp_6.2.7-1.tar

Stop existing Nexus OCSP responder service

Stop the currently running Nexus OCSP Responder service.

Modify docker compose file

Update the docker-compose file with any none default ports you might require for your .configuration to work.

Place existing license file

Place the existing license file in the license directory within the OCSP deployment directory.

Initialize the OCSP deployment

Create the container and volumes by using the following command:

podman-compose up --no-start

Now the containers and volumes required by the OCSP responder are ready to be configured.

Migrate OCSP configuration

The content of the following five directories needs to be copied from your current OCSP server installation:

<ocsp-home>/bin
<ocsp-home>/certs
<ocsp-home>/config
<ocsp-home>/cils
<ocsp-home>/crls

The following volumes exists for the above listed directories:

• bin:
  /var/lib/containers/storage/volumes/ocsp_ocsp-bin/_data/
  Only HSM library .dll/.so files need to be copied.

• certs:
  /var/lib/containers/storage/volumes/ocsp_ocsp-certs/_data/

• config:
  /var/lib/containers/storage/volumes/ocsp_ocsp-config/_data/

• cils:
  /var/lib/containers/storage/volumes/ocsp_ocsp-cils/_data/

• crls:
  /var/lib/containers/storage/volumes/ocsp_ocsp-crls/_data/

Start OCSP container

Start the OCSP container using the following command:

podman-compose start ocsp

Enable HSM configuration

For more information, see OSCP deployment using Podman compose.

Recommendations

Configuration files and libraries/addons (such as HSM) can be added as volumes to the containers.