@distrohelena/canton-typescript-sdk 0.1.22 → 0.1.25

package/node/.generated/start-local/compose-extra-participants.yaml

@@ -1,5 +1,7 @@
 volumes:
   postgres-pqs-extra-1:
+  postgres-pqs-extra-2:
+  postgres-pqs-extra-3:
 
 services:
   postgres:
@@ -34,6 +36,54 @@ services:
           }
         }
         
+        canton.participants.extra-2 = $${_participant} {
+          storage.config.properties.databaseName = "participant-extra-2"
+          init {
+            generate-topology-transactions-and-keys = true
+            identity.type = auto
+          }
+          monitoring {
+            http-health-server.port = ${EXTRA_PARTICIPANT_2_HTTP_HEALTHCHECK_PORT}
+            grpc-health-server.port = ${EXTRA_PARTICIPANT_2_GRPC_HEALTHCHECK_PORT}
+          }
+          http-ledger-api.port = ${EXTRA_PARTICIPANT_2_JSON_API_PORT}
+          admin-api.port = ${EXTRA_PARTICIPANT_2_ADMIN_API_PORT}
+          ledger-api.port = ${EXTRA_PARTICIPANT_2_LEDGER_API_PORT}
+          ledger-api {
+            auth-services = [{
+              type = unsafe-jwt-hmac-256
+              target-audience = "${EXTRA_VALIDATOR_2_AUTH_AUDIENCE}"
+              secret = "unsafe"
+            }]
+        
+            user-management-service.additional-admin-user-id = "${EXTRA_VALIDATOR_2_USER_NAME}"
+          }
+        }
+        
+        canton.participants.extra-3 = $${_participant} {
+          storage.config.properties.databaseName = "participant-extra-3"
+          init {
+            generate-topology-transactions-and-keys = true
+            identity.type = auto
+          }
+          monitoring {
+            http-health-server.port = ${EXTRA_PARTICIPANT_3_HTTP_HEALTHCHECK_PORT}
+            grpc-health-server.port = ${EXTRA_PARTICIPANT_3_GRPC_HEALTHCHECK_PORT}
+          }
+          http-ledger-api.port = ${EXTRA_PARTICIPANT_3_JSON_API_PORT}
+          admin-api.port = ${EXTRA_PARTICIPANT_3_ADMIN_API_PORT}
+          ledger-api.port = ${EXTRA_PARTICIPANT_3_LEDGER_API_PORT}
+          ledger-api {
+            auth-services = [{
+              type = unsafe-jwt-hmac-256
+              target-audience = "${EXTRA_VALIDATOR_3_AUTH_AUDIENCE}"
+              secret = "unsafe"
+            }]
+        
+            user-management-service.additional-admin-user-id = "${EXTRA_VALIDATOR_3_USER_NAME}"
+          }
+        }
+        
         canton.participants.extra-1.ledger-api.auth-services = [
           {
             type = unsafe-jwt-hmac-256
@@ -47,10 +97,75 @@ services:
           }
         ]
         
+        canton.participants.extra-2.ledger-api.auth-services = [
+          {
+            type = unsafe-jwt-hmac-256
+            target-audience = "https://canton.network.global"
+            secret = "unsafe"
+          },
+          {
+            type = jwt-es-256-crt
+            certificate = "/app/es256-certificate.pem"
+            target-audience = "https://canton.network.global/es256"
+          }
+        ]
+        
+        canton.participants.extra-3.ledger-api.auth-services = [
+          {
+            type = unsafe-jwt-hmac-256
+            target-audience = "https://canton.network.global"
+            secret = "unsafe"
+          },
+          {
+            type = jwt-es-256-crt
+            certificate = "/app/es256-certificate.pem"
+            target-audience = "https://canton.network.global/es256"
+          }
+        ]
+        
+        canton.participants.extra-1.ledger-api.tls {
+          cert-chain-file = "/app/localnet-tls/server.crt"
+          private-key-file = "/app/localnet-tls/server.key"
+          trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        canton.participants.extra-1.admin-api.tls {
+          cert-chain-file = "/app/localnet-tls/server.crt"
+          private-key-file = "/app/localnet-tls/server.key"
+          trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        
+        canton.participants.extra-2.ledger-api.tls {
+          cert-chain-file = "/app/localnet-tls/server.crt"
+          private-key-file = "/app/localnet-tls/server.key"
+          trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        canton.participants.extra-2.admin-api.tls {
+          cert-chain-file = "/app/localnet-tls/server.crt"
+          private-key-file = "/app/localnet-tls/server.key"
+          trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        
+        canton.participants.extra-3.ledger-api.tls {
+          cert-chain-file = "/app/localnet-tls/server.crt"
+          private-key-file = "/app/localnet-tls/server.key"
+          trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        canton.participants.extra-3.admin-api.tls {
+          cert-chain-file = "/app/localnet-tls/server.crt"
+          private-key-file = "/app/localnet-tls/server.key"
+          trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        
     ports:
       - "${EXTRA_PARTICIPANT_1_LEDGER_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_1_LEDGER_API_PORT}"
       - "${EXTRA_PARTICIPANT_1_ADMIN_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_1_ADMIN_API_PORT}"
       - "${EXTRA_PARTICIPANT_1_JSON_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_1_JSON_API_PORT}"
+      - "${EXTRA_PARTICIPANT_2_LEDGER_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_2_LEDGER_API_PORT}"
+      - "${EXTRA_PARTICIPANT_2_ADMIN_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_2_ADMIN_API_PORT}"
+      - "${EXTRA_PARTICIPANT_2_JSON_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_2_JSON_API_PORT}"
+      - "${EXTRA_PARTICIPANT_3_LEDGER_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_3_LEDGER_API_PORT}"
+      - "${EXTRA_PARTICIPANT_3_ADMIN_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_3_ADMIN_API_PORT}"
+      - "${EXTRA_PARTICIPANT_3_JSON_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_3_JSON_API_PORT}"
   splice:
     env_file:
       - ${START_LOCAL_GENERATED_DIR}/extra-participants.env
@@ -91,8 +206,95 @@ services:
         
         canton.sv-apps.sv.expected-validator-onboardings += { secret = "${EXTRA_VALIDATOR_1_ONBOARDING_SECRET}" }
         
+        canton.validator-apps.extra-2-validator_backend = $${_validator_backend} {
+          onboarding.secret = "${EXTRA_VALIDATOR_2_ONBOARDING_SECRET}"
+          domain-migration-dump-path = "/domain-upgrade-dump/domain_migration_dump-extra-2.json"
+          storage.config.properties.databaseName = "${EXTRA_VALIDATOR_2_DB}"
+          admin-api.port = ${EXTRA_VALIDATOR_2_ADMIN_API_PORT}
+          canton-identifier-config.participant = extra-2
+          participant-client {
+            admin-api.port = ${EXTRA_PARTICIPANT_2_ADMIN_API_PORT}
+            ledger-api {
+              client-config.port = ${EXTRA_PARTICIPANT_2_LEDGER_API_PORT}
+              auth-config = {
+                type = "self-signed"
+                user = "${EXTRA_VALIDATOR_2_USER_NAME}"
+                audience = "${EXTRA_VALIDATOR_2_AUTH_AUDIENCE}"
+                secret = "unsafe"
+              }
+            }
+          }
+          auth = {
+            algorithm = "hs-256-unsafe"
+            audience = "${EXTRA_VALIDATOR_2_AUTH_AUDIENCE}"
+            secret = "unsafe"
+          }
+          ledger-api-user = "${EXTRA_VALIDATOR_2_USER_NAME}"
+          validator-wallet-users.0 = "${EXTRA_VALIDATOR_2_WALLET_ADMIN_USER_NAME}"
+          validator-party-hint = "${EXTRA_VALIDATOR_2_PARTY_HINT}"
+        
+          domains.global.buy-extra-traffic {
+            min-topup-interval = $${?MIN_TRAFFIC_TOPUP_INTERVAL}
+            target-throughput = $${?TARGET_TRAFFIC_THROUGHPUT}
+          }
+        }
+        
+        canton.sv-apps.sv.expected-validator-onboardings += { secret = "${EXTRA_VALIDATOR_2_ONBOARDING_SECRET}" }
+        
+        canton.validator-apps.extra-3-validator_backend = $${_validator_backend} {
+          onboarding.secret = "${EXTRA_VALIDATOR_3_ONBOARDING_SECRET}"
+          domain-migration-dump-path = "/domain-upgrade-dump/domain_migration_dump-extra-3.json"
+          storage.config.properties.databaseName = "${EXTRA_VALIDATOR_3_DB}"
+          admin-api.port = ${EXTRA_VALIDATOR_3_ADMIN_API_PORT}
+          canton-identifier-config.participant = extra-3
+          participant-client {
+            admin-api.port = ${EXTRA_PARTICIPANT_3_ADMIN_API_PORT}
+            ledger-api {
+              client-config.port = ${EXTRA_PARTICIPANT_3_LEDGER_API_PORT}
+              auth-config = {
+                type = "self-signed"
+                user = "${EXTRA_VALIDATOR_3_USER_NAME}"
+                audience = "${EXTRA_VALIDATOR_3_AUTH_AUDIENCE}"
+                secret = "unsafe"
+              }
+            }
+          }
+          auth = {
+            algorithm = "hs-256-unsafe"
+            audience = "${EXTRA_VALIDATOR_3_AUTH_AUDIENCE}"
+            secret = "unsafe"
+          }
+          ledger-api-user = "${EXTRA_VALIDATOR_3_USER_NAME}"
+          validator-wallet-users.0 = "${EXTRA_VALIDATOR_3_WALLET_ADMIN_USER_NAME}"
+          validator-party-hint = "${EXTRA_VALIDATOR_3_PARTY_HINT}"
+        
+          domains.global.buy-extra-traffic {
+            min-topup-interval = $${?MIN_TRAFFIC_TOPUP_INTERVAL}
+            target-throughput = $${?TARGET_TRAFFIC_THROUGHPUT}
+          }
+        }
+        
+        canton.sv-apps.sv.expected-validator-onboardings += { secret = "${EXTRA_VALIDATOR_3_ONBOARDING_SECRET}" }
+        
+        canton.validator-apps.extra-1-validator_backend.participant-client {
+          admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        
+        canton.validator-apps.extra-2-validator_backend.participant-client {
+          admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        
+        canton.validator-apps.extra-3-validator_backend.participant-client {
+          admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        
     ports:
       - "${EXTRA_VALIDATOR_1_ADMIN_API_PUBLISHED_PORT}:${EXTRA_VALIDATOR_1_ADMIN_API_PORT}"
+      - "${EXTRA_VALIDATOR_2_ADMIN_API_PUBLISHED_PORT}:${EXTRA_VALIDATOR_2_ADMIN_API_PORT}"
+      - "${EXTRA_VALIDATOR_3_ADMIN_API_PUBLISHED_PORT}:${EXTRA_VALIDATOR_3_ADMIN_API_PORT}"
   postgres-pqs-extra-1:
     image: "postgres:${POSTGRES_VERSION}"
     container_name: postgres-pqs-extra-1
@@ -131,8 +333,10 @@ services:
       SCRIBE_TARGET_POSTGRES_USERNAME: ${DB_USER}
       SCRIBE_TARGET_POSTGRES_PASSWORD: ${DB_PASSWORD}
       SCRIBE_CONFIG: /onboarding/extra-1-pqs.conf
+      SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt
     volumes:
       - onboarding:/onboarding
+      - "/home/helena/env/daml/typescript-sdk/.generated/localnet-tls/ca.crt:/app/localnet-tls/ca.crt:ro"
     command:
       - pipeline
       - ledger
@@ -145,3 +349,111 @@ services:
       postgres-pqs-extra-1:
         condition: service_healthy
     restart: on-failure:100
+  postgres-pqs-extra-2:
+    image: "postgres:${POSTGRES_VERSION}"
+    container_name: postgres-pqs-extra-2
+    volumes:
+      - postgres-pqs-extra-2:/var/lib/postgresql/data
+      - ${LOCALNET_DIR}/docker/postgres/postgres-entrypoint.sh:/postgres-entrypoint.sh
+    environment:
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_DB: postgres
+      CREATE_DATABASE_EXTRA_PQS_2: ${EXTRA_PQS_2_POSTGRES_DB}
+    ports:
+      - "${EXTRA_PQS_2_POSTGRES_PUBLISHED_PORT}:5432"
+    entrypoint: /postgres-entrypoint.sh
+    healthcheck:
+      test: "pg_isready -U ${DB_USER} -d postgres"
+      interval: 10s
+      timeout: 3s
+      retries: 3
+      start_period: 30s
+    user: "postgres"
+    command:
+      - postgres
+      - -c
+      - max_connections=1000
+  pqs-extra-2:
+    image: ${SCRIBE_IMAGE}:${SCRIBE_VERSION}
+    container_name: pqs-extra-2
+    environment:
+      SCRIBE_SOURCE_LEDGER_HOST: canton
+      SCRIBE_SOURCE_LEDGER_PORT: ${EXTRA_PARTICIPANT_2_LEDGER_API_PORT}
+      SCRIBE_SOURCE_LEDGER_AUTH: OAuth
+      SCRIBE_TARGET_POSTGRES_HOST: postgres-pqs-extra-2
+      SCRIBE_TARGET_POSTGRES_PORT: 5432
+      SCRIBE_TARGET_POSTGRES_DATABASE: ${EXTRA_PQS_2_POSTGRES_DB}
+      SCRIBE_TARGET_POSTGRES_USERNAME: ${DB_USER}
+      SCRIBE_TARGET_POSTGRES_PASSWORD: ${DB_PASSWORD}
+      SCRIBE_CONFIG: /onboarding/extra-2-pqs.conf
+      SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt
+    volumes:
+      - onboarding:/onboarding
+      - "/home/helena/env/daml/typescript-sdk/.generated/localnet-tls/ca.crt:/app/localnet-tls/ca.crt:ro"
+    command:
+      - pipeline
+      - ledger
+      - postgres-document
+    depends_on:
+      canton:
+        condition: service_healthy
+      splice-onboarding:
+        condition: service_healthy
+      postgres-pqs-extra-2:
+        condition: service_healthy
+    restart: on-failure:100
+  postgres-pqs-extra-3:
+    image: "postgres:${POSTGRES_VERSION}"
+    container_name: postgres-pqs-extra-3
+    volumes:
+      - postgres-pqs-extra-3:/var/lib/postgresql/data
+      - ${LOCALNET_DIR}/docker/postgres/postgres-entrypoint.sh:/postgres-entrypoint.sh
+    environment:
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_DB: postgres
+      CREATE_DATABASE_EXTRA_PQS_3: ${EXTRA_PQS_3_POSTGRES_DB}
+    ports:
+      - "${EXTRA_PQS_3_POSTGRES_PUBLISHED_PORT}:5432"
+    entrypoint: /postgres-entrypoint.sh
+    healthcheck:
+      test: "pg_isready -U ${DB_USER} -d postgres"
+      interval: 10s
+      timeout: 3s
+      retries: 3
+      start_period: 30s
+    user: "postgres"
+    command:
+      - postgres
+      - -c
+      - max_connections=1000
+  pqs-extra-3:
+    image: ${SCRIBE_IMAGE}:${SCRIBE_VERSION}
+    container_name: pqs-extra-3
+    environment:
+      SCRIBE_SOURCE_LEDGER_HOST: canton
+      SCRIBE_SOURCE_LEDGER_PORT: ${EXTRA_PARTICIPANT_3_LEDGER_API_PORT}
+      SCRIBE_SOURCE_LEDGER_AUTH: OAuth
+      SCRIBE_TARGET_POSTGRES_HOST: postgres-pqs-extra-3
+      SCRIBE_TARGET_POSTGRES_PORT: 5432
+      SCRIBE_TARGET_POSTGRES_DATABASE: ${EXTRA_PQS_3_POSTGRES_DB}
+      SCRIBE_TARGET_POSTGRES_USERNAME: ${DB_USER}
+      SCRIBE_TARGET_POSTGRES_PASSWORD: ${DB_PASSWORD}
+      SCRIBE_CONFIG: /onboarding/extra-3-pqs.conf
+      SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt
+    volumes:
+      - onboarding:/onboarding
+      - "/home/helena/env/daml/typescript-sdk/.generated/localnet-tls/ca.crt:/app/localnet-tls/ca.crt:ro"
+    command:
+      - pipeline
+      - ledger
+      - postgres-document
+    depends_on:
+      canton:
+        condition: service_healthy
+      splice-onboarding:
+        condition: service_healthy
+      postgres-pqs-extra-3:
+        condition: service_healthy
+    restart: on-failure:100

package/node/.generated/start-local/extra-participants.env

@@ -28,3 +28,61 @@ EXTRA_PQS_1_POSTGRES_NAME=postgres-pqs-extra-1
 EXTRA_PQS_1_POSTGRES_DB=pqs-extra-1
 EXTRA_PQS_1_POSTGRES_PUBLISHED_PORT=5541
 EXTRA_PQS_1_CONFIG_FILE=extra-1-pqs.conf
+CREATE_DATABASE_EXTRA_2=participant-extra-2
+CREATE_DATABASE_EXTRA_VALIDATOR_2=validator-extra-2
+CREATE_DATABASE_EXTRA_PQS_2=pqs-extra-2
+EXTRA_PARTICIPANT_2_NAME=extra-2
+EXTRA_PARTICIPANT_2_DB=participant-extra-2
+EXTRA_PARTICIPANT_2_PARTY_HINT=extra_2_quickstart-helena-1
+EXTRA_PARTICIPANT_2_LEDGER_API_PORT=6901
+EXTRA_PARTICIPANT_2_ADMIN_API_PORT=6902
+EXTRA_PARTICIPANT_2_JSON_API_PORT=6975
+EXTRA_PARTICIPANT_2_HTTP_HEALTHCHECK_PORT=6900
+EXTRA_PARTICIPANT_2_GRPC_HEALTHCHECK_PORT=6961
+EXTRA_PARTICIPANT_2_LEDGER_API_PUBLISHED_PORT=6901
+EXTRA_PARTICIPANT_2_ADMIN_API_PUBLISHED_PORT=6902
+EXTRA_PARTICIPANT_2_JSON_API_PUBLISHED_PORT=6975
+EXTRA_VALIDATOR_2_DB=validator-extra-2
+EXTRA_VALIDATOR_2_PARTY_HINT=validator_2_quickstart-helena-1
+EXTRA_VALIDATOR_2_ONBOARDING_SECRET=extra-2-validator-onboarding-secret
+EXTRA_VALIDATOR_2_ADMIN_API_PORT=6903
+EXTRA_VALIDATOR_2_ADMIN_API_PUBLISHED_PORT=6903
+EXTRA_VALIDATOR_2_USER_NAME=ledger-api-user
+EXTRA_VALIDATOR_2_WALLET_ADMIN_USER_NAME=extra-2
+EXTRA_VALIDATOR_2_AUTH_AUDIENCE=https://canton.network.global
+EXTRA_VALIDATOR_2_AUTH_MODE=shared-secret
+EXTRA_PQS_2_NAME=pqs-extra-2
+EXTRA_PQS_2_USER_NAME=extra-2-pqs-user
+EXTRA_PQS_2_POSTGRES_NAME=postgres-pqs-extra-2
+EXTRA_PQS_2_POSTGRES_DB=pqs-extra-2
+EXTRA_PQS_2_POSTGRES_PUBLISHED_PORT=5542
+EXTRA_PQS_2_CONFIG_FILE=extra-2-pqs.conf
+CREATE_DATABASE_EXTRA_3=participant-extra-3
+CREATE_DATABASE_EXTRA_VALIDATOR_3=validator-extra-3
+CREATE_DATABASE_EXTRA_PQS_3=pqs-extra-3
+EXTRA_PARTICIPANT_3_NAME=extra-3
+EXTRA_PARTICIPANT_3_DB=participant-extra-3
+EXTRA_PARTICIPANT_3_PARTY_HINT=extra_3_quickstart-helena-1
+EXTRA_PARTICIPANT_3_LEDGER_API_PORT=7901
+EXTRA_PARTICIPANT_3_ADMIN_API_PORT=7902
+EXTRA_PARTICIPANT_3_JSON_API_PORT=7975
+EXTRA_PARTICIPANT_3_HTTP_HEALTHCHECK_PORT=7900
+EXTRA_PARTICIPANT_3_GRPC_HEALTHCHECK_PORT=7961
+EXTRA_PARTICIPANT_3_LEDGER_API_PUBLISHED_PORT=7901
+EXTRA_PARTICIPANT_3_ADMIN_API_PUBLISHED_PORT=7902
+EXTRA_PARTICIPANT_3_JSON_API_PUBLISHED_PORT=7975
+EXTRA_VALIDATOR_3_DB=validator-extra-3
+EXTRA_VALIDATOR_3_PARTY_HINT=validator_3_quickstart-helena-1
+EXTRA_VALIDATOR_3_ONBOARDING_SECRET=extra-3-validator-onboarding-secret
+EXTRA_VALIDATOR_3_ADMIN_API_PORT=7903
+EXTRA_VALIDATOR_3_ADMIN_API_PUBLISHED_PORT=7903
+EXTRA_VALIDATOR_3_USER_NAME=ledger-api-user
+EXTRA_VALIDATOR_3_WALLET_ADMIN_USER_NAME=extra-3
+EXTRA_VALIDATOR_3_AUTH_AUDIENCE=https://canton.network.global
+EXTRA_VALIDATOR_3_AUTH_MODE=shared-secret
+EXTRA_PQS_3_NAME=pqs-extra-3
+EXTRA_PQS_3_USER_NAME=extra-3-pqs-user
+EXTRA_PQS_3_POSTGRES_NAME=postgres-pqs-extra-3
+EXTRA_PQS_3_POSTGRES_DB=pqs-extra-3
+EXTRA_PQS_3_POSTGRES_PUBLISHED_PORT=5543
+EXTRA_PQS_3_CONFIG_FILE=extra-3-pqs.conf

package/node/start-local.sh

@@ -153,14 +153,18 @@ prepare_tls_runtime_files() {
   [[ -n "${LOCALNET_TLS_CA_CERT_PATH:-}" ]] && ((supplied_count += 1))
 
   mkdir -p "$runtime_dir"
+  chmod 700 "$runtime_dir"
   if (( supplied_count > 0 )); then
     if (( supplied_count != 3 )); then
       echo "LOCALNET_TLS_CERT_CHAIN_PATH, LOCALNET_TLS_PRIVATE_KEY_PATH, and LOCALNET_TLS_CA_CERT_PATH must be set together." >&2
       return 1
     fi
-    server_certificate_path="$LOCALNET_TLS_CERT_CHAIN_PATH"
-    server_key_path="$LOCALNET_TLS_PRIVATE_KEY_PATH"
-    ca_certificate_path="$LOCALNET_TLS_CA_CERT_PATH"
+    local supplied_server_certificate_path="$LOCALNET_TLS_CERT_CHAIN_PATH"
+    local supplied_server_key_path="$LOCALNET_TLS_PRIVATE_KEY_PATH"
+    local supplied_ca_certificate_path="$LOCALNET_TLS_CA_CERT_PATH"
+    server_certificate_path="$supplied_server_certificate_path"
+    server_key_path="$supplied_server_key_path"
+    ca_certificate_path="$supplied_ca_certificate_path"
     if [[ ! -r "$server_certificate_path" || ! -r "$server_key_path" || ! -r "$ca_certificate_path" ]]; then
       echo "Supplied TLS certificate, private key, or CA certificate is not readable." >&2
       return 1
@@ -179,6 +183,19 @@ prepare_tls_runtime_files() {
       echo "Supplied TLS private key does not match the server certificate." >&2
       return 1
     fi
+    if [[ "$supplied_server_certificate_path" != "$runtime_dir/server.crt" ]]; then
+      cp "$supplied_server_certificate_path" "$runtime_dir/server.crt"
+    fi
+    if [[ "$supplied_server_key_path" != "$runtime_dir/server.key" ]]; then
+      cp "$supplied_server_key_path" "$runtime_dir/server.key"
+    fi
+    if [[ "$supplied_ca_certificate_path" != "$runtime_dir/ca.crt" ]]; then
+      cp "$supplied_ca_certificate_path" "$runtime_dir/ca.crt"
+    fi
+    chmod 644 "$runtime_dir/server.crt" "$runtime_dir/server.key" "$runtime_dir/ca.crt"
+    server_certificate_path="$runtime_dir/server.crt"
+    server_key_path="$runtime_dir/server.key"
+    ca_certificate_path="$runtime_dir/ca.crt"
   else
     if [[ "$(resolve_tls_rotate)" == "1" ]]; then
       rm -f "$ca_key_path" "$ca_certificate_path" "$server_key_path" "$server_certificate_path"
@@ -214,6 +231,7 @@ EOF
         -out "$server_certificate_path" -extfile "$extensions_path" -extensions server_ext >/dev/null 2>&1
       rm -f "$csr_path" "$extensions_path" "$ca_certificate_path.srl"
     fi
+    chmod 644 "$server_key_path" "$server_certificate_path" "$ca_certificate_path"
     if ! openssl x509 -in "$server_certificate_path" -noout >/dev/null 2>&1 \
       || ! openssl pkey -in "$server_key_path" -noout >/dev/null 2>&1 \
       || ! openssl x509 -in "$ca_certificate_path" -noout >/dev/null 2>&1; then
@@ -272,15 +290,8 @@ services:
     volumes:
       - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
     environment:
-      - |
-        ADDITIONAL_CONFIG_LOCALNET_TLS=
-  splice-onboarding:
-    volumes:
-      - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
-      - "$onboarding_utils_file:/app/utils.sh:ro"
-    environment:
-      - LOCALNET_HTTP_SCHEME=https
-      - CURL_CA_BUNDLE=/app/localnet-tls/ca.crt
+      ADDITIONAL_CONFIG_LOCALNET_TLS: |
+        # Trust the localnet CA for Splice's Canton clients.
 EOF
   for participant in app-provider app-user sv; do
     case "$participant" in
@@ -293,29 +304,36 @@ EOF
     fi
     if [[ "$participant" == "sv" ]]; then
       cat >> "$compose_file" <<'EOF'
-          canton.validator-apps.sv-validator_backend.participant-client {
-            admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
-            ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
-          }
-          canton.scan-apps.scan-app.participant-client {
-            admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
-            ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
-          }
-          canton.sv-apps.sv.participant-client {
-            admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
-            ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
-          }
+        canton.validator-apps.sv-validator_backend.participant-client {
+          admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        canton.scan-apps.scan-app.participant-client {
+          admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
+        canton.sv-apps.sv.participant-client {
+          admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
 EOF
     else
       cat >> "$compose_file" <<EOF
-          canton.validator-apps.${participant}-validator_backend.participant-client {
-            admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
-            ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
-          }
+        canton.validator-apps.${participant}-validator_backend.participant-client {
+          admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+        }
 EOF
     fi
   done
   cat >> "$compose_file" <<EOF
+  splice-onboarding:
+    volumes:
+      - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
+      - "$onboarding_utils_file:/app/utils.sh:ro"
+    environment:
+      - LOCALNET_HTTP_SCHEME=https
+      - CURL_CA_BUNDLE=/app/localnet-tls/ca.crt
   pqs-app-provider:
     environment:
       SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt
@@ -912,7 +930,24 @@ prerequisite_services() {
 }
 
 dependent_services() {
-  printf '%s\n' splice splice-onboarding pqs-app-provider pqs-sv
+  printf '%s\n' pqs-app-provider pqs-sv
+}
+
+start_splice_services() {
+  local -n compose_args_ref="$1"
+  local onboarding_container
+
+  # Start the combined Splice process without waiting for its own healthcheck.
+  # Compose still applies splice-onboarding's service_healthy dependency even
+  # with --no-deps when both services are passed to the same `up` invocation.
+  docker_compose "${compose_args_ref[@]}" up -d --no-recreate --no-deps splice
+  docker_compose "${compose_args_ref[@]}" create splice-onboarding
+  onboarding_container="$(docker_compose "${compose_args_ref[@]}" ps -a -q splice-onboarding | tail -n 1)"
+  if [[ -z "$onboarding_container" ]]; then
+    echo "Unable to resolve the splice-onboarding container." >&2
+    return 1
+  fi
+  docker start "$onboarding_container" >/dev/null
 }
 
 extra_pqs_services() {
@@ -1147,6 +1182,11 @@ start_ledger_stack() {
   docker_compose "${compose_args[@]}" up -d --no-recreate "${startup_services[@]}"
   wait_for_canton_health "$extra_participants"
 
+  # SV initialization waits for onboarding contracts, while splice health waits
+  # for SV and scan initialization. Start onboarding without Compose dependency
+  # gating so its healthcheck can retry until those apps are ready; PQS still
+  # starts afterward and retains its onboarding health dependency.
+  start_splice_services compose_args
   docker_compose "${compose_args[@]}" up -d --no-recreate "${followup_services[@]}"
 
   if (( extra_participants > 0 )); then