Prerequisites - Updated July 2026

• Ubuntu Server LTS 26.04.x (server install, basic - no GUI or other options), 16GB RAM, 120GB HDD
• Latest postgreSQL 18, Adoptium JDK 25, Latest Tomcat 11

RDAP requires redis cache, SRS does not.

RDAP requires the rdap.properties tomcat config file - SRS does not.

The RDAP context.xml file references the rdap.proerties file - SRS context.xml does not.

The ngnix config files are different for RDAP and the SRS.

Template nginx and tomcat files available below.

Basics:

• sudo apt update && sudo apt upgrade -y
• sudo apt install zip unzip
• sudo touch /etc/cloud/cloud-init.disabled
• sudo apt purge cloud-init -y
• sudo rm -Rf /etc/cloud
• sudo systemctl disable --now unattended-upgrades
• sudo apt remove unattended-upgrades
• sudo apt install yamllint
• sudo apt install whois
• sudo timedatectl set-timezone UTC
• sudo timedatectl set-ntp on
• sudo apt update && sudo apt upgrade -y
• sudo apt autoremove

Basic Security

Ubunutu firewall basic configuration, handy commands:

• sudo ufw enable | disable
• sudo ufw status numbered ( see rules )
• sudo ufw delete X ( delete a rule by number )
• sudo ufw reload ( after rule changes )

Use fail2ban to protect against brute force/dictionary ssh attacks and mal-formed http requests. - tutorial

Basic sshd refinements. (we recommend using ssh keys tutorial)

PostgreSQL

Installation Instructions: https://www.postgresql.org/download/linux/ubuntu/

Create the file repository configuration:

Update the package lists:

File to edit when tuning PG:

Set password for user "postgres"

Edit pg_hba.conf to force password confirmation for postgres commands
Look for --- "Database administrative login by Unix domain socket", replace "peer" with "md5"

Restart PG for changes to take effect:

See Replication page to setup db replication between the registry and the rdap server.

https://cocca.org.nz/srs/replication.html

Java 25

Install Java JDK 25 LTS

Append the following command to open the environment variables file.

Run from command line.

Check Version

Tomcat 11

For security purposes, Tomcat should run under a separate, unprivileged user. Run the following command to create a user called tomcat:

To install Tomcat, you’ll need the latest Core Linux build for Tomcat 10

Since you have already created a user, you can now grant tomcat ownership over the extracted installation by running:

The systemd service that you will now create will keep Tomcat quietly running in the background. The systemd service will also restart Tomcat automatically in case of an error or failure.

Paste the content bellow in the new tomcat.service file.

Run systemctl daemon-reload to reload units.

RDAP Download the default CoCCA tomcat config files. (server.xml & context.xml).

Edit the context.xml file and update db name, username, password postgres IP & port

To configure Tomcat to launch on reboot automatically, enable the service with:

RDAP Server Only

Edit the rdap.properties file and change host name.

Redis Cache 8

RDAP Server Only

To install Redis, either follow the instruction here https://redis.io/docs/latest/operate/oss_and_stack/install/archive/install-redis/install-redis-on-linux or run the following commands one by one.

After install, run this command to verify the installation:

You should see 0. The above command shows how many domain records are currently cached in Redis.

Edit /opt/tomcat/rdap/rdap.properties add the following properties:

redis.whois.ttl-minutes=1440
# DataLoader behaviour
whois.dataloader.enabled=true
whois.dataloader.page-size=500
# Reload interval in ms (default 15 minutes); must be less than redis.whois.ttl-minutes
whois.dataloader.interval-ms=900000

During bootstrap, the system will populate Redis cache by querying data in Registry database.
You can run this command to see how many domains cached so far:
redis-cli --scan --pattern 'WHOIS_DOMAIN_CACHE::*' | wc -l

The system works by fetching all domain records from Registry database and load into Redis, and then refresh the full dataset every 15 mins by default.

Both API and port 43 query uses cached data by default. Full dataset refresh happens in backend, both API and port 43 continue to work during refresh.

letsencrypt

If you want to get started with a free https certificate to match your host name, we suggest https://letsencrypt.org

If using nginx as a reverse proxy it is not nessesary to use a jks. The SSL .pem certs can be in refferences in the nginx config file. In the recomended setup Tomcat listens on port 127.0.0.1:8080, the TLS is configured in nginx.

Using nginx as a reversr proxy is the recommnded configuration.

Stop nginx webserver temporarily.

Request a new certificate

Make note of the path and .pem files created by letsencrypt to add to the nginx config file.

Enable letsencrypt Auto-Renew, in root's crontab.

NGINX proxy

Next, enable this configuration file by creating a link from it to the sites-enabled directory that Nginx reads at startup:

or for rdap

NGINX uses the default linked configuration file. Creating a reverse proxy requires creating and linking a custom file. To avoid any potential conflicts, use the following command:

Test the Configuration

To configure NGINX to launch on reboot automatically, enable the service with:

Create a Non-Root User

Grant nginxuser Necessary Permissions

Check the process using the following command to ensure that Nginx is running with the non-root user.

SRS-Notes

SRS Server Only

If upgrading from resin

Intial copy of keys.

The above script will run every time the certificate is renewed, copying the new certificate files to the Tomcat directory. Make sure to replace "domain" with your actual registry domain name.

Once tomcat is loaded, go to Configuration > EPP and select "Use Let's Encrypt Certificate" as the EPP Server Certificate option.

Put /opt/tomcat/srs/epp-certs in the EPP Server Certificate Path field.

Save the changes to take effect.

Tomcat is not running as the root user, so in order for the CoCCA SRS to write zone files, backups, escrow files and reload bind, certain folder permissions must be set. Adjust commands below to suit your install & file locations.

WHOIS p43

RDAP Server Only

OPTIONAL - By default CoCCA runs a whois server on port 4300 of the RDAP server. If you want to run a port 43 service you need to setup port forwarding in UFW.