Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Inji is a verifiable credentialing stack that provides a way to share tamper-proof, instantly verifiable data which is cryptographically signed by a trusted issuer, and users can store them securely on their devices or browsers and share them when needed.
Issuer: The entity that issues the credential and makes claims about the subject (e.g., a university issuing a degree, a government issuing a passport, an employer issuing a work permit). The issuer cryptographically signs the VC. Inji's 'Issuance-module' is called Inji Certify.
Holder: The individual or entity which possesses the credential (e.g., the student with the degree, the citizen with the passport, the employee with the work permit). The holder stores and manages their VCs. Inji's 'Holder-module' is called Inji Wallet.
Verifier: The entity that requests and verifies the credential to confirm a claim (e.g., an employer checking a degree, a border agent checking a passport, a landlord checking a work permit). The verifier checks the cryptographic proofs to ensure the VC's authenticity and integrity. .
Some everyday examples of Verifiable Credentials include:
A national ID issued as a digital credential
A diploma issued by a university
A background verification report from an employer
A subsidy or benefit eligibility certificate from a government agency
VCs allow:
Instant verification, even offline
User control over when and how data is shared
Interoperability across platforms and borders
Reduced fraud and manual checks
For a quick overview of Inji, which primarily includes Inji Wallet, Inji Verify and the Inji Certify as key components, you can watch the video titled "Inji Stack End To End Use Case Demonstration". This video provides a visual walkthrough of the key features and showcases how all modules interact through a persona-based demonstration, highlighting its real-world application. Head to the section titled “What Does Inji Include” for a comprehensive overview of how Inji functions, explaining how each component operates independently, while maintaining the interoperability necessary for seamless and secure credential verification.
Secure Issuance: Issue verifiable credentials with digital signatures, ensuring authenticity. Cross-Platform Accessibility: Available via mobile app or web interface, ensuring inclusivity for all users. Privacy-Preserving Sharing: Users control what they share, with whom, and for how long. Offline Compatibility: Works in low-connectivity or offline environments, critical for inclusion. Fast, Trusted Verification: Credentials can be verified quickly and securely, even by non-technical service providers.
Enables trusted entities to issue digitally signed credentials. Supports:
Multiple formats: JSON-LD, SD-JWT,mDOC and many more. A tool that enables issuers to seamlessly connect with existing data sources to issue verifiable credentials.
Connecting with existing databases and offering configurable credential schemas, it caters to diverse use cases across different sectors and industries.
Revocation management
Ledger and credential status checks
Empowers users to manage their credentials on different devices:
Inji Mobile: Android and iOS app to download, store, and present credentials securely
Inji Web: Browser-based wallet for users without smartphones, offering print and share features
Allows service providers and organizations to:
Scan and validate credentials
Check credential status (validity, expiry, revocation)
Integrate with the existing relying party or service providers
Inji follows widely adopted open standards, ensuring flexibility and long-term sustainability:
W3C Verifiable Credentials Data Model
OpenID for Verifiable Presentation (OpenID4VP)
OpenID for Verifiable Credential Issuance (OpenID4VCI)
Claim 169
This section will contain a clear diagram illustrating the interaction between Inji Certify, Inji Wallet (mobile + web), Inji Verify. The diagram should also show the components involved to build Inji.
Issuance: An issuer creates a digital credential with claims about a subject and cryptographically signs it.
Holding: The signed credential is then given to the holder, who stores it securely in a digital wallet or similar application.
Presentation: When needed, the holder can present the VC (or a verifiable presentation, which can include multiple VCs or selectively disclosed information) to a verifier.
Inji provides a secure, inclusive, and interoperable solution for issuing and managing digital credentials. By enabling individuals to hold their credentials and share them when needed, Inji supports faster access to services while protecting privacy and reducing fraud. Whether you are:
A user needing better control over their identity and credentials,
An issuer needing to deliver secure digital certificates, or
A verifier needing reliable proof of information, Inji offers the tools you need to make digital credentialing simple, trusted, and universal.
Welcome to the "Try It Out" section! Here, we offer you hands-on experience to better understand how our product works and how you can leverage its features. This section will guide you through some simple steps to get started.
If you're a developer or a partner interested in experiencing or integrating with Inji Web, we invite you to explore our designated sandbox environments.
Collab serves as our development integration environment, featuring QA-tested dockers. It's a dedicated space where our partners and contributors can build on the platform or integrate with the latest QA-tested version of the code.
This environment undergoes regular nightly builds from our engineering team, making it a hub for continuous development activities.
Access resources on Collab, our sandbox environment, through the provided link.
Explore the guides of the various Inji Modules from below:
Synergy represents our stable environment, where the most recently released version of the MOSIP platform and applications are deployed for partners to seamlessly integrate and conduct testing.
For quick access to environment related resources, please visit the provided.
If you require any assistance or encounter any issues during the testing and integration process, kindly reach out to us through the support mechanism provided below.
Navigate to .
Provide a detailed description about the support you require or provide detailed information about the issue you have encountered, including steps to reproduce, error messages, logs and any other relevant details.
\
Inji Mobile
Inji Web
Inji Verify



Schema and credential registry management
ISO/IEC 18013-5: mDoc/mDL
IETF SD-JWT-based Verifiable Credentials
W3C based SD-JWT-based Verifiable Credentials
DID (Decentralised Identifiers) support
Healthcare
Immunization records, medical certifications
Education
Degrees, training certificates, learning records
Social Welfare
Benefit eligibility, ration cards
Finance
KYC credentials, account onboarding
Mobility
Driving licenses, transportation passes
Employment
Job credentials, background checks
Others
Many more


The documentation is licensed under a Creative Commons Attribution 4.0 International License.
All Inji's core repositories are licensed under the terms of .
All Inji code is owned and maintained by International Institute of Information Technology, Bangalore, on behalf of Inji.
All trademarks are the property of their respective holders. Other products and company names mentioned herein may be trademarks and/or service marks of their respective owners.
Inji Wallet is a product of the combined efforts of multiple stakeholders. Contributions from the community form the backbone and drive its growth and stability. The contributions have come in multiple ways, ranging from direct code contributions, review of design and architecture, bug fixing, and support for technology evaluation.
For code contributions, refer .
To engage with us on our community forum, visit .
Have a question or feedback? We are here for you!
Reach out to us through the channel that best fits your purpose, as outlined below.
Community Forum Join the conversation at community.mosip.io to ask questions, share ideas, and explore discussions about MOSIP and its solutions.
Feedback We truly value your input. Every suggestion counts in shaping our products and processes. Click here to share your feedback and help us make Inji better. \
Other Queries For anything more specific or direct, feel free to write to us at info@mosip.io — we’re happy to connect!
The Setup section of Inji Documentation will enable you (DevOps, Administrators and Developers) to plan and estimate a minimum requisite infrastructure to deploy the the Inji stack seamlessly.
What all you will find here:
Deployment Architecture
Deploying Inji
Our community strives to deliver major releases as per the designated schedules, while offering minor releases every other month! The roadmap outlines the vision, goals, and planned development milestones of our ongoing projects over a specific period of time. It also provides a high-level overview of the Inji stack's future direction, features, enhancements, and major updates.
Inji's principles, as discussed here, underpin the design and development of the roadmap. The year-wise roadmap details how these principles will be applied and advanced in a step-by-step manner, ensuring that the Inji stack evolves in alignment with the core principles.
Head below to navigate through our year-wise roadmap that provides a strategic overview of the journey ahead and highlights the key milestones & objectives for each year!
The recommended Github workflow here is for developers to submit code and documentation contributions to Inji open-source repositories.
Fork the repository.
Clone the fork to your local machine. E.g.:
Set the upstream project as the original from where you forked. E.g.:
Make sure you never directly push upstream.
$ git remote set-url --push upstream no_pushConfirm the origin and upstream.
$ git remote -vThis should display origin and upstream as below:
origin https://github.com/<your_github_id>/inji.git (fetch)
origin https://github.com/<your_github_id>/inji.git (push)
upstream https://github.com/mosip/inji.git (fetch)
upstream https://github.com/mosip/inji.git (push)1. Create a new issue in GitHub.
Follow the issue template provided.
Please provide as much information as possible.
If you want to develop a new feature, please elaborate on the idea and discuss the design before starting development. 2. In your local repository, fetch the upstream.
3. On your local repo, switch to a branch if you are working on an older release or stay in main/develop branch.
4. Create a new issue branch with the name of the issue.
5. Make sure you are up-to-date with the upstream repo.
6. Now feel free to make the change in the code or documentation. Reach out to our community for any queries. Once done with the work, commit your changes by referring to the Issue ID in the commit message. Eg:
7. Once again ensure that you are up-to-date with the upstream repo as it may have moved forward.
8. Build and test your code. Make sure to follow the coding guidelines. Provide unit test cases for the changes you have built.
9. Push to your forked repo (origin).
10. On your forked remote repository from GitHub, create a pull request using the Contribute button. Direct the pull-request to main or any specific branch upstream.
11. Make sure the automatic tests/checks on GitHub for your pull request pass.
12. Reviewers shall review the pull request. Reach out to the community for a faster response.
$ git clone https://github.com/<your_github_id>/inji.git$ cd inji
$ git remote add upstream https://github.com/mosip/inji.git$ git fetch upstream$ git checkout upstream/<branch> $ git switch -c issue-<issue number>$ git pull upstream <branch> $ git commit -m "[#1234] Adding new feature in inji module"$ git pull upstream <branch> $ git push --set-upstream origin issue-<issue number>Open source projects can have a variety of contributors. This can potentially lead to confusion or conflict. This document sets forth a simple transparent set of guidelines to describe the roles and process to be followed. As part of that it covers:
Process of open source contributions and review of code in this project.
Decision-making process on backlogs and including contributions.
The MOSIP project follows a simple structure with 3 levels.
Level 1 - MOSIP Technology Committee. This committee is responsible for high level roadmap and policy decisions such as licensing, and technology stack.
Level 2 - Project leadership. This is the executive leadership at MOSIP that includes key project roles within MOSIP such as product owner, engineering lead, and architects. These members will be appointed as maintainers and lead in the project by MOSIP.
Level 3 - Members. This is a set of people who are working on the project.
Given below is a list of specific roles and their responsibilities.
Maintainers are individuals who have “Commit” rights; And are the primary caretakers of the code and the strategic vision of the project. They are empowered to make decisions and resolve disputes for all contributions. They are appointed by MOSIP.
Project Lead is the chair of the committee of maintainers. They are appointed by MOSIP.
Contributors are the people or organisations who take part actively in the project and its meetings, code, design, and test and are recognized for their contributions. The contributors are part of the GitHub Members and would be actively involved in the discussion of a PR and review. Members strongly influence the Maintainer's decision.
Scope of Contributions
The whole of the project is open to contributions. The kind of contributions that are welcome include:
Code
Documentation
Design
Raising Bugs
Code, Documentation & Design
All artefacts including the code are maintained in the github repository.Contributions can be made by raising a Pull Request.
Reporting Issues & Feature Request
Issues and backlog are maintained in Jira and members of the project team will have access to Jira to add feature requests and report bugs
We use to track the work associated with the project (account required). That is where issues open for community contribution can be found.
The process to contribute the code is present . Once code is submitted, it is reviewed through the following process:
At least two members should have reviewed the submitted contribution for the pull request to be accepted. The maintainers may request for more reviews of the code from other relevant members.
If the members deem the submitted code to be critical to overall product development, they can seek the inputs of the relevant product owners for the review process.
The maintainers review the two (or more) sets of comments received from the tech leads and the submitted code before taking a decision regarding committing the code to the appropriate branch.
Project Lead initiates the release process. The process can be found .
Attribution is in accordance with the relevant licence. Individual and affiliated contributors will be listed.
The key decisions to be taken are for the following activities
Roadmap and backlog priority
Triaging of bugs and requirements
Accepting a contribution Pull Request)
Releases
Most decisions will be made in periodical meetings where owners of the relevant aspect of work present a case for a decision and the decision will be made either by consensus, or by majority where a quorum exists. The maintainers of the project will be the decision makers. The project lead will have veto power on decisions due to their expertise and commitment to the vision of the project. Contributors can share their views in these meetings for consideration.
Current Challenge: Patients often need to share medical records and test results securely across different healthcare providers. This process is cumbersome, requiring manual handling of paper documents or insecure sharing via email and other communication channels.
Solution with Verifiable Credentials: Healthcare providers can issue VCs for vaccination records, allergies, or medication history. VCs can securely store and share medical records, test results, and vaccination history digitally. Patients can then easily share these credentials with other providers, ensuring continuity of care and faster treatment. Patients can control access to their data, ensuring only authorized healthcare providers can verify and access their information.
Benefits:
Reduced Friction: Patients can easily share verified medical credentials with healthcare professionals, streamlining the consultation and treatment process
Enhanced Privacy and Security: Verifiable credentials use cryptography to ensure data integrity and protect sensitive medical information
Current Challenge: Students often require verified academic transcripts and certificates when applying for further education or job opportunities, which they often carry physical transcripts or certifications. Requesting and verifying these documents can be time-consuming and prone to fraud.
Solution with Verifiable Credentials: Educational institutions can issue VCs such as digital diplomas, certificates, and transcripts. Students can share these credentials with potential employers or other educational institutions quickly and securely, streamlining verification and reducing wait times.
Benefits:
Efficient Verification: Employers and educational institutions can instantly verify the authenticity of academic credentials without relying on manual checks or third-party verification services
Prevention of Fraud: Verifiable credentials use cryptographic signatures to ensure the integrity and authenticity of educational documents, reducing the risk of forgery
Current Challenge: Customers often need to prove their identity and financial history when applying for loans, opening bank accounts, or accessing other financial services. This process typically involves submitting multiple paper documents and undergoing lengthy identity verification procedures.
Solution with Verifiable Credentials: Financial institutions can issue VCs that include identity information, credit scores, and financial history. Customers can use these credentials to securely and selectively share their information with authorized institutions.
Benefits:
Streamlined Onboarding Process: VCs enable faster and more efficient customer onboarding, reducing paperwork and administrative overhead for financial institutions
Enhanced Data Privacy: Customers have greater control over their personal and financial data, minimizing the risk of identity theft and unauthorized access
Current Challenge: Travelers often face challenges proving their identity and vaccination status when crossing borders. Paper-based documents are prone to loss or damage, leading to delays and disruptions during travel. Travelers juggle multiple documents for border crossings (passports, visas, health certificates) leading to delays and frustration.
Solution with Verifiable Credentials: Governments and health authorities can issue verifiable credentials for vaccination records, identity verification, and travel permissions. Travelers can present these digital credentials at checkpoints or border crossings securely and efficiently. These credentials can be easily accessed via mobile wallets and verified electronically, speeding up border processing and reducing queues.
Benefits:
Facilitated Cross-Border Travel: Verifiable credentials enable seamless verification of identity and vaccination status, reducing wait times and administrative hurdles at immigration checkpoints
Improved Public Health Measures: Authorities can track and verify vaccination records more effectively using digital credentials, supporting efforts to manage public health crises such as pandemics
Challenge: Job seekers often face delays due to lengthy background checks and verification of employment history and skills
Solution: Employers can issue verifiable credentials for past employment and skills acquired. Job seekers can then share these credentials with potential employers, allowing for faster verification and a smoother hiring process
Challenge: Citizens often need to present physical documents (birth certificates, proof of residence) to access government services, leading to inefficiency and potential loss of documents
Solution: Government agencies can issue verifiable credentials for citizen information. These credentials can be securely accessed and shared for various services, reducing administrative burdens and streamlining access
Reduced Friction: Verifiable credentials eliminate the need for physical documents, simplifying processes and speeding up transactions
Enhanced Security: Cryptographic verification ensures the authenticity and integrity of credentials, reducing the risk of fraud
User Control: Individuals control their data, choosing what information to share and with whom
Improved Efficiency
Verifiable credentials offer versatile solutions across various domains by leveraging digital technologies to enhance data security, privacy, and efficiency. By addressing common challenges associated with identity verification and data sharing, verifiable credentials empower individuals and organizations to streamline processes and improve trust in digital interactions.
Members are either individuals or persons affiliated with contributing organisations. All contributions are bound by the licensing of the project.
Product Owner is responsible for the analysis, design, development, and implementation of business solutions to meet the needs of the organisation. He/She must have a strong understanding of the business domain, processes, and software development lifecycle Agile development methodologies).
One off users will not have access for bug reports and feature requests. They can report the same in the community pages
Regular users who do not have access, can request the same and the maintainers can provide access after considerationWe use Jira to track the work associated with the project (account required). That is where issues open for community contribution can be found.Pull Request Review ProcessThe process to contribute the code is present here. Once code is submitted, it is reviewed through the following process:
In exceptional cases such as an emergency or an urgent requirement or a very trivial but time-sensitive correction, a maintainer may - at their discretion - choose to directly review the submitted pull request and take a decision on the commit.
Community was created to foster an open, innovative and inclusive community around open source & open standards. To clarify expected behaviour in our communities we have adopted the Contributor Covenant. This code of conduct has been adopted by many other open-source communities and we feel it expresses our values well.
We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation.
We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
Examples of behaviour that contributes to a positive environment for our community include:
Demonstrating empathy and kindness toward other people
Being respectful of differing opinions, viewpoints, and experiences
Giving and gracefully accepting constructive feedback
Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
Focusing on what is best not just for us as individuals, but for the overall community
Examples of unacceptable behaviour include:
The use of sexualized language or imagery, and sexual attention or advances of any kind
Trolling, insulting or derogatory comments, and personal or political attacks
Public or private harassment
Publishing others' private information, such as a physical or email address, without their explicit permission
Community leaders are responsible for clarifying and enforcing our standards of acceptable behaviour and will take appropriate and fair corrective action in response to any behaviour that they deem inappropriate, threatening, offensive, or harmful.
Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
This Code of Conduct applies within all community spaces and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
Instances of abusive, harassing, or otherwise, unacceptable behaviour may be reported to the community leaders responsible for enforcement at . All complaints will be reviewed and investigated promptly and fairly.
All community leaders are obligated to respect the privacy and security of the reporter of any incident.
Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
Community Impact: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome in the community.
Consequence: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested.
Community Impact: A violation through a single incident or series of actions.
Consequence: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
Community Impact: A serious violation of community standards, including sustained inappropriate behaviour.
Consequence: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
Community Impact: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals.
Consequence: A permanent ban from any sort of public interaction within the community.
This Code of Conduct is adapted from the , version 2.1, available at .
Community Impact Guidelines were inspired by .
For answers to common questions about this code of conduct, see the FAQ at . Translations are available at .
Other conduct which could reasonably be considered inappropriate in a professional setting
The GenderMag Methodology aims to analyze and mitigate gender biases in users’ problem-solving interactions with software. It underscores the importance of accounting for gender differences in human-computer interaction (HCI) during the software design process.
Process
We identified two personas based on their familiarity with technology and their ability to embrace technological progress. The personas are:
Abi, who is either Abigail or Abishek, is 45 years old. She works as a homemaker, is literate, but not very tech- savvy. Her internet connectivity is moderate, and she does not have a personal phone.
Tim, who is either Timothy or Timara, a 24-year-old financial consultant, is literate, tech-savvy, and boasts excellent internet connectivity. Additionally, he owns the latest phone.
Examine the feature, systematically walk through the process, assess their information handling, and pinpoint any problems.
During the walkthrough, we pinpointed inclusivity concerns in the Inji Wallet app’s user interface and experience. Subsequently, we took steps to mitigate these issues, aiming to eliminate digital entry barriers.
As part of Phase1, below P1 items are fixed in the v0.11.0-Inji Wallet release:
As part of Phase2, below P1, P2 items are fixed in the v0.12.0 release of Inji Wallet:
Welcome to the Inji ecosystem, which encompasses the Inji Mobile Wallet, Inji Web Wallet, Inji Verify, and Inji Certify. These tools provide a powerful platform for managing and verifying digital credentials with ease. This document guides you through using mock data to explore the functionalities of each component, allowing you to understand and leverage their capabilities effectively. Read on to discover how you can interact with Inji's ecosystem, using demo credentials and mock data as explained below.
Whether you're a Developer, System Integrator, or an Enthusiast eager to dive into the world of verifiable credentials, use this guide for necessary information to get started with Inji in our environment. Let's begin this journey of seamless setup and exploration.
This guide explains the use of mock data for following:
Inji Mobile Wallet
The resources section provides a comprehensive introduction to the Inji modules — Inji Mobile Wallet, Inji Web Wallet, Inji Verify, and Inji Certify, showcasing how its modules deliver trusted, low-cost, and scalable credential management across sectors.
Each demonstration video explains the product’s purpose, setup, features, and practical applications. Together, they offer an end-to-end understanding of how verifiable credentials can be issued, held, and verified instantly, across both digital and paper-based formats.
Watch the complete series on YouTube:
What you'll learn:
An introduction to the Inji Stack, the open-source suite by MOSIP for verifiable credentials.
On the "Retrieve your ID" screen, instead of using "VID auto population," consider using "Download ID." This change will help avoid confusion for Abi, who might expect an explanation of what VID / UIN IDs are.
On the "Home with cards view," Abi might wonder why her card displays "Activation Pending," while the other card shows Activated for online login".
In the FAQ or Help section, provide information about the various types of IDs, their locations, and instructions on how to download them using different ID methods.
Provide additional information related to "Activation Pending," and ensure clear icon translations for "Activation Done" versus "Activation Pending".
3
When the user clicks on the "Add" button, the options "Generate your card" or "Retrieve your ID" might be confusing.
The description should also include an explanation of why the verification process is necessary.
When the user glances at the screen, the "AID" is not immediately evident.
Update main screen name to "Download your card".
Update main screen description to "Select ID type and enter the MOSIP provided UIN or VID you wish to download." (Also, with a reference to upcoming OTP screen).
Enhance the text to provide a heads up about the upcoming step of OTP verification, so that user is prepared to receive and enter the OTP.
Update bottom line text to "Don't have UIN / VID? Get it now using your AID."
The Resend Code is unclear in the OTP screen.
The Resend Code Text can be more descriptive. “Resend OTP” would be more clear than “Resend code”
The Resend code is confusing as to whether it is clickable or not.
Rename “Resend code” as “Resend OTP”
3
Though Tim is tech savvy, Tim will be sort of puzzled why the app needs location access as well despite a lot of other permissions provided. Tim will be unhappy and question why they are required to provide location access in order to scan a QR code.
Description can be more indicative of the specific purpose of seeking location access.
4
Abi is not so familiar with tech, when the app says share a selfie, they might not know, face auth using her photo, is going in the background. she might think it will break her privacy.
Abi might be confused, as she cannot understand what is the next action to be done, from the instruction. it does not mention whether she has to click on the shutter button or it will take a picture automatically although she would perform the subgoal. Will it automatically click the selfie or do Abi need to click on the button?
For problem statement 1:
Provide assurance wrt Privacy
Terminology update: Face Authentication to Face Verification
Acquaint user with text about "Share with selfie" feature, informing user about face authentication - Through FAQs
Avoid usage of slang jargons like selfie → need confirmation from the product team on the alternative <Sasi>: Let us retain the word as that is more relatable to all.
5
The description in the camera screen is not explaining about the sharing credential. Text near the scanner can mention about the “Hold the phone steady and scan the QR code to share your credential”.
Enhance text in Share page while scanning QR code. Text near the scanner can mention about the “Hold the phone steady and scan the QR code to share your card."
Change CTA from "Scan" to "Share"
6
Unlock App screen:
Abi would be stressed if she doesn’t remember the passcode. As there is nothing on the screen to get help. She might not know what to do because she is risk averse.
Add text: Tap on the button to unlock you app with the PIN or biometrics - Text to be enhanced in the unlock screen to clearly call out on other options.
“To unlock the app securely, you can set up either biometric authentication, such as fingerprint or facial recognition or opt for a 6-digit Passcode for quick access. Choose 'Use Biometrics' to enable biometric authentication or 'I'll Do Later' to set up a 6-digit passcode.”
CTAs:
Use Biometrics
I’ll Do Later
7
During the VC sharing, the successful transfer screen closes in a split second leaving the user clueless on the action status. The transition was quick, and no document is shown after the successful transfer. hence Abi is not clear if the sharing is successful or not.
Consider having an Error screen with CTA, clearly indicating the next expected action > Retry
8
No Information related to the selfie captured process was not conveyed to the users, even in the end screen. Selfie capture process does not relate back to the ID sharing process. No message regarding what happened with the selfie clicked.
Post face capture and before initiating the sharing process, inform users about successful face verification/match - But without any CTA.
1
The term “scan” can be ambiguous because scanning a QR code within an app might result in a money transfer from a bank account. This perception could be influenced by cultural factors. Abi, instead of directly clicking on the “Scan” option, prefers to select her card and then look for a “Share” option. Unless external assistance is available, Abi will avoid using the “Scan” feature.
Without external assistance, unless there are instructions visibly posted on the wall, she might find it challenging to comprehend whether she needs to select the “scan” option.
The Scan Button in the Navigation Bar can now be referred to as “Share”.
1
Screen name: Retrieve your UIN/VID on clicking Get it now using your AID link
It is confusing for Abi as she has to walk through a lot of steps to get her card. Though it is mentioned as AID, she would be happy but may / may not move forward as it is going to get UIN but not a card.
Update screen name to "Get your UIN/VID." instead of Retrieve your UIN/VID
2
2
Inji Verify
What would you need?
You will need UIN (Unique identification number) as a demo credential whic will allow you to explore Inji's capabilities and experience seamless VC sharing. You can also try this with 'Sample Insurance Credentials'.
Issuance of UIN (Unique identification number) as a demo credential will allow you to explore Inji's capabilities and experience seamless VC sharing firsthand.
Now you can self generate your own UIN Credential using the Collab environment.
Click on the Get UIN button located at the top-right corner of the page. This will open the Self Registration Form, Alternatively, you can simply click on this link to self register. You need to duly fill the self registration form.
On successful registration the UIN is sent to you over the email you used for registration, For more details you follow the .
Note: You can use 111111 as the OTP, for any OTP based feature in Collab environment.
For sample Insurance Credentials, please provide the below details in the eSignet authentication page:
Policy Name: insuranceCredentials
DOB: 2000-01-01
Policy Number: 12345
The mock data you will need for Inji Web Wallet is same as that of Inji Mobile Wallet (Explained above).
Follow the procedure to try out Inji Verify in our collab environment:
To obtain sample verifiable credentials embedded in a QR code, please initiate the process by following the steps to generate the QR code, click here!
To use the QR code with verifiable credentials and test out the Inji Verify application, exploring the scan and upload features, please use the QR codes provided below:
{
"credential": {
"credentialSubject": {
"gender": "Male",
"primaryCropType": "Maize",
"mobileNumber": "9876543210",
"postalCode": "453000",
"landArea": "3 hectares",
"fullName": "John Doe",
"secondaryCropType": "Rice",
"dateOfBirth": "25-05-1990",
"face": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABwAAAAFCAYAAABW1IzHAAAAHklEQVQokWNgGPaAkZHxPyMj439sYrSQo51PBgsAALa0ECF30JSdAAAAAElFTkSuQmCC",
"farmerID": "987654321",
"villageOrTown": "Koramangala",
"district": "Bangalore",
"id": "did:jwk:eyJrdHkiOiJSU0EiLCJlIjoiQVFBQiIsInVzZSI6InNpZyIsImtpZCI6Iml3Qkl1Q2QzaFU1NlBWM3VTc3gzekhMc1E4SXdYckdHdmh6YkE1VlJuQkEiLCJhbGciOiJSUzI1NiIsIm4iOiJtMWlMQ0prNzA5VkpIbUF2MURsWUxsblA0UDEtLXFfU3Q3aVo3WjhWbXk0d0Mxb2FTQWxXdjFXZjlKQXg2YmQ3OXdMbDhINEkwa25GeG9FbkktTUhvOUtGRXpFcGdJNXZIUHY2X0M2dWI4RmUwaXphRVFXTlY3VEpVRG54MVZ5OU5UZS15ekFVd2dfWk91Y0pFb3hyQW54VXM5OFcyTWpyUmtZdHVQcTlKRUxVTzRJM0wxX1B5S21hRG8zN0xCR3NVamhLVmQ0X0VzTkVPQ3AwQTZwbnBaUUd1S1RteXVhMUVYSDhLWUVTSEZ4alA4NGVCaGk0YmZPSWMwQjQ2VlZrVG81WG9TeUtnRi1xemRyTGFQRGJwZGxBaVNKMEJ5Vk5jaUE3Z2ctWEJLQkV0QVd1b19EQ3pYZUsxREJKT2txMXlkWEJzeWdjeGtpVmdobnFtUTFsVHcifQ==",
"state": "Karnataka",
"landOwnershipType": "Owner"
},
"validUntil": "2027-10-09T03:08:19.711Z",
"validFrom": "2025-10-09T03:08:19.711Z",
"type": [
"VerifiableCredential",
"FarmerCredential"
],
"@context": [
"https://www.w3.org/ns/credentials/v2",
"https://piyush7034.github.io/my-files/farmer.json",
"https://w3id.org/security/suites/ed25519-2020/v1"
],
"issuer": "did:web:piyush7034.github.io:my-files:sample-ed25519",
"credentialStatus": {
"statusPurpose": "revocation",
"statusListIndex": "7",
"id": "http://localhost:8090/v1/certify/credentials/status-list/649d3d36-2719-42eb-9f00-ac479a906059#7",
"type": "BitstringStatusListEntry",
"statusListCredential": "http://localhost:8090/v1/certify/credentials/status-list/649d3d36-2719-42eb-9f00-ac479a906059"
},
"proof": {
"type": "Ed25519Signature2020",
"created": "2025-10-08T21:38:19Z",
"proofPurpose": "assertionMethod",
"verificationMethod": "did:web:piyush7034.github.io:my-files:sample-ed25519#LYs95rEHKsqm1_TIFJxffLUXHZL1rM_h-UuwRi6PtN4",
"proofValue": "z5Z3Rj9rhV5b6whiq4EgZaD8gmtsBtfMEqwNXAgasCxtBRCpc35DkiGFyRfy8NYDtXBDX6RjAUpWfgNGn94t2ywgm"
}
}
}{
"credential": {
"issuanceDate": "2025-10-09T03:05:40.782Z",
"credentialSubject": {
"gender": "Male",
"primaryCropType": "Maize",
"mobileNumber": "9876543210",
"postalCode": "453000",
"landArea": "3 hectares",
"fullName": "John Doe",
"secondaryCropType": "Rice",
"dateOfBirth": "25-05-1990",
"face": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABwAAAAFCAYAAABW1IzHAAAAHklEQVQokWNgGPaAkZHxPyMj439sYrSQo51PBgsAALa0ECF30JSdAAAAAElFTkSuQmCC",
"farmerID": "987654321",
"villageOrTown": "Koramangala",
"district": "Bangalore",
"id": "did:jwk:eyJrdHkiOiJSU0EiLCJlIjoiQVFBQiIsInVzZSI6InNpZyIsImtpZCI6IkVIdXU5eU5MN1VFcnFDd0hWOUdPTk5KWWdxQmVvMVhUTmY0OU95Tk1LN0EiLCJhbGciOiJSUzI1NiIsIm4iOiJ2VmF1dFFYa3JMUXVaU2hGWWFDNkRMNEZOcnMzcm5meTVkVjhyWVJRQnhyOW1oZllfdGxwTzc5QzRiZnplS1BzaVBXN0c4NEMtZGt4QlNOR3RXV0wwdy1oX3JOd3Y2eUFMT1VZaGdtcnZVeGhWakhCRzFMdTFtTUhERF9JZlpJb0lpV1JRZkpvMGZYMFBzZ2FrRWhIZmxjWHdPNk1DaVItNGVNTUdhNU0zR2ViTVQtUHlsQVVKYzJiN2NoaGFvTlJYQWNWbTBsZTFmUG5RRGJfQ21XMENxOW9kOHFjQUwtellqc0F3MnJzMWxhZ3RDcTdsSXVIWkszUnF2U0NQb2lmSG1ZZEZvdzZnNkF5eTlyNzhxc2VwYkU3d3JDYS1aRF92TkxHblpTbXVac3RicmxxZkxfelFfdnlwNjM1NTMtRmNPNGlKNW1Md0w4Z2pwTWRrVmVMRFEifQ==",
"state": "Karnataka",
"landOwnershipType": "Owner"
},
"type": [
"VerifiableCredential",
"FarmerCredential"
],
"@context": [
"https://www.w3.org/2018/credentials/v1",
"https://piyush7034.github.io/my-files/farmer.json",
"https://w3id.org/security/suites/ed25519-2020/v1"
],
"issuer": "did:web:piyush7034.github.io:my-files:sample-ed25519",
"expirationDate": "2027-10-09T03:05:40.782Z",
"proof": {
"type": "Ed25519Signature2020",
"created": "2025-10-08T21:35:40Z",
"proofPurpose": "assertionMethod",
"verificationMethod": "did:web:piyush7034.github.io:my-files:sample-ed25519#LYs95rEHKsqm1_TIFJxffLUXHZL1rM_h-UuwRi6PtN4",
"proofValue": "z3BW5Tx6ZHJ53rriixAwkrbjGEurLP5eNWwZQQkmEMEEWtLK5qJRThA6wyuyaiin7ucfaUDk4H2BKVBLpSAqcDPcu"
}
}
}{
"id": "did:rcw:ab01ec3f-9f67-4ce8-ade1-8fce82a9bee1",
"type": [
"VerifiableCredential",
"LifeInsuranceCredential",
"InsuranceCredential"
],
"proof": {
"type": "Ed25519Signature2020",
"created": "2024-05-03T12:53:39Z",
"proofValue": "z4GVSorSVms65uTSLHRdqJB7Km7UuyzGzYbu9uKuwBPRLgHLmBMa8YnBczVh4id2PMsrB31kjCbe6NVLdA9jThURs",
"proofPurpose": "assertionMethod",
"verificationMethod": "did:web:challabeehyv.github.io:DID-Resolve:3313e611-d08a-49c8-b478-7f55eafe62f2#key-0"
},
"issuer": "did:web:challabeehyv.github.io:DID-Resolve:3313e611-d08a-49c8-b478-7f55eafe62f2",
"@context": [
"https://www.w3.org/2018/credentials/v1",
"https://holashchand.github.io/test_project/insurance-context.json",
{
"LifeInsuranceCredential": {
"@id": "InsuranceCredential"
}
},
"https://w3id.org/security/suites/ed25519-2020/v1"
],
"issuanceDate": "2024-05-03T12:53:39.113Z",
"expirationDate": "2024-06-02T12:53:39.110Z",
"credentialSubject": {
"id": "did:jwk:eyJrdHkiOiJFQyIsInVzZSI6InNpZyIsImNydiI6IlAtMjU2Iiwia2lkIjoic3pGa2cyOVFFalpiQ1VheFRfbFdiZElEU1ZQNWhlREhTeGR6UlhTOW1WZyIsIngiOiJzeVZ2Y2pEX1k0Y0xFS2NUTGR3a1dEWnR1RGpGWGxwcUtLZ2l5TDB2ZUY0IiwieSI6Ii13eGZIMDZRclRCZGljOG1yRDRBM2E0alhGREx1RnlBa0NPMm56Z3BNUGMiLCJhbGciOiJFUzI1NiJ9",
"dob": "1991-08-13",
"email": "challarao@beehyv.com",
"gender": "Male",
"mobile": "0123456789",
"benefits": [
"Critical Surgery",
"Full body checkup"
],
"fullName": "Challarao V",
"policyName": "Start Insurance Gold Premium",
"policyNumber": "1234567",
"policyIssuedOn": "2023-04-20T20:48:17.684Z",
"policyExpiresOn": "2033-04-20T20:48:17.684Z"
}
}{
"id": "did:cbse:327b6c3f-ce17-4c00-ae4f-7fb2313b0626",
"type": [
"VerifiableCredential",
"UniversityDegreeCredential"
],
"proof": {
"type": "Ed25519Signature2020",
"created": "2024-05-16T07:27:43Z",
"proofValue": "z56crqnnjmvDa46FqmAnVhEttqKtFMTQ1et1mM5dA3WSHtb5ncQ36sS8fG3fxw6dpvtqbqvaE5FzaqwJTBX6dGH3P",
"proofPurpose": "assertionMethod",
"verificationMethod": "did:web:Sreejit-K.github.io:VCTest:d40bdb68-6a8d-4b71-9c2a-f3002513ae0e#key-0"
},
"issuer": "did:web:Sreejit-K.github.io:VCTest:d40bdb68-6a8d-4b71-9c2a-f3002513ae0e",
"@context": [
"https://www.w3.org/2018/credentials/v1",
"https://sreejit-k.github.io/VCTest/udc-context2.json",
"https://w3id.org/security/suites/ed25519-2020/v1"
],
"issuanceDate": "2023-02-06T11:56:27.259Z",
"expirationDate": "2025-02-08T11:56:27.259Z",
"credentialSubject": {
"id": "did:example:2002-AR-015678",
"type": "UniversityDegreeCredential",
"ChildFullName": "Alex Jameson Taylor",
"ChildDob": "January 15, 2003",
"ChildGender": "Male",
"ChildNationality": "Arandian",
"ChildPlaceOfBirth": "Central Hospital, New Valera, Arandia",
"FatherFullName": "Michael David Taylor",
"FatherDob": "April 22, 1988",
"FatherNationality": "Arandian",
"MotherFullName": "Emma Louise Taylor",
"MotherDob": "June 5, 1990",
"MotherNationality": "Arandian",
"RegistrationNumber": "2002-AR-015678",
"DateOfRegistration": "January 20, 2002",
"DateOfIssuance": "January 22, 2002"
}
}Explanation of how the core modules like Inji Certify, Inji Wallet, and Inji Verify work together to create a trusted digital credential ecosystem.
Overview of Inji's role in enabling secure, interoperable, and privacy-preserving data exchange.
Demonstrates the potential of verifiable credentials in sectors like education, healthcare, governance and many more.
What you'll learn:
Introduction to Inji Certify, the credential issuance module of the Inji Stack.
Demonstrates how authorized entities can issue, manage, and revoke verifiable digital credentials.
Explains interoperability with OpenID4VC, W3C VC, and other standards.
What you'll learn:
Step-by-step local deployment of Inji Certify using Docker Compose.
Explains configuration of plug-ins, environment variables, and credential templates.
Demonstrates issuance and revocation flows in a local testing environment.
What you'll learn:
In-depth look at Inji Certify's credential issuance architecture.
Explains credential templates, signing algorithms, revocation APIs, and integration with data sources.
Details plug-in architecture for flexible issuance from multiple registries or databases.
What you'll learn:
Comprehensive walkthrough of the Inji Mobile Wallet app.
Demonstrates secure storage, management, and sharing of verifiable credentials.
Covers key features:
Selective disclosure for privacy-preserving data sharing.
Offline verification via Bluetooth Low Energy (BLE).
OpenID4VP-based interoperability with verifiers.
Multi-issuer and multi-credential handling.
Highlights use cases in travel, employment, public service delivery and many more.
What you'll learn:
Introduction to the Inji Web Wallet, a browser-based wallet that complements the mobile app.
Demonstrates credential management and secure sharing using QR codes in both digital and printed form.
Explains how the web wallet supports W3C VC, OpenID4VP, and ISO standards for global interoperability.
Showcases accessibility for users without smartphones or in assisted-use environments.
What you'll learn:
Step-by-step guide to setting up the Inji Web Wallet locally using IntelliJ instead of Docker for faster iteration.
Walkthrough of dependencies, configuration steps, and environment setup.
Demonstrates how to load and test credentials within the local environment.
What you'll learn:
Configuration of Mimoto backend for Inji Wallet integration using Docker Compose.
This setup provides a ready-to-run local Docker environment for Mimoto, which acts as the backend for Inji Web and the BFF (Backend-for-Frontend) for Inji Mobile, enabling secure OIDC-based authentication and credential exchange.
It helps developers quickly configure, test, and integrate Mimoto with Inji services in a non-production environment.
What you'll learn:
Overview of Inji Verify, the verifier module for digital and paper-based credential verification.
Demonstrates secure, instant QR-based verification workflows.
Highlights modular SDK integration, interoperability with OpenID4VP, and verifier backend service.
What you'll learn:
Detailed explanation of Inji Verify's architecture, including backend services, SDKs, and UI components.
Covers OpenID4VP flows, handling of verifiable presentations, and data validation.
Shows how to run Verify locally using Docker Compose and how to integrate SDK components into React-based applications.
The workshop aims to provide a comprehensive understanding of the Inji ecosystem, focusing on its various components, configuration, and practical usage. It covered essential topics to help participants effectively use and integrate Inji's features.
Understanding DID Methods: The workshop explains the different Decentralized Identifier (DID) methods supported by Inji, helping participants grasp how digital identities are managed.
OIDC Client and p12 File Creation: Participants learn how to create an OIDC client and generate a p12 file, ensuring secure key storage and authentication processes.
Configuring Mimoto in Inji Web: Detailed steps are provided to configure Mimoto within the Inji Web application, addressing common issues and ensuring seamless integration.
Credential Management: The workshop covers how credentials are stored, secured, and validated in both Web and Wallets, emphasizing security and compliance with standards.
Real-World Deployment and Integration: It discusses the roles of issuers and service providers in real-world deployments, the use of blockchain for security, and the potential for running AI agents for selective disclosure.
The Workshop demonstrates how to integrate Inji Certify, a credential issuance platform, with a custom data provider plugin to issue 'Verifiable Credentials'. The specific use case covered is issuing farmer IDs based on official land registry data.
Data Setup: A sample farmer registry is created in a database with details like National ID, Name, Phone Number, and Land Ownership Information.
Configuration: A velocity template is defined to format the data, issuer information and verification keys are configured, and a "well-known" property is set up.
Plugin Development: A data provider plugin is created to fetch farmer data from the registry based on the national ID.
Docker Compose Setup: A Docker environment is set up to run the database, Inji Certify, Nginx, and Inji Web.
Demonstration: A farmer ID is entered, authenticated, and a verifiable credential is issued based on the retrieved data.
The webinar delves into the technical architecture and implementation details of the Inji Stack, specifically focusing on the Inji Wallet and its integration with other stacks/components like eSignet and Inji Certify. The webinar offers a comprehensive overview of the technical intricacies involved in building a decentralized credential issuance and verification system using the MOSIP's Inji platform.
Inji Wallet: A mobile application that acts as both a digital wallet for storing verifiable credentials (VCs) and a verifier of VCs.
Integration with eSignet and Inji Certify: eSignat is used for authentication and authorization, while Inji Certify is responsible for issuing VCs.
Technical Architecture: The webinar covers the high-level architecture, including the use of Mimoto as a backend for frontend (BFF), the role of the Tuvali library for secure VC transfer, and the integration of native modules for specific functionalities.
API Interactions: The session explains how Inji Wallet interacts with various APIs, including those for fetching issuer lists, obtaining access tokens, and binding wallets to relying parties.
Configuration: The webinar discusses the configuration aspects, such as setting up issuer information, defining VC templates, and configuring the connection to eSignet.
Development and Integration: The presentation provides insights into the development process, including the use of React Native for the mobile app, the integration of native modules, and the management of data storage.
The webinar delves into MOSIP's solutions for identity verification and credential management also to see how national IDs empower citizens in the digital age.
National ID as an Enabler: Learn how national IDs can be used to access various services.
Digital Transformation: Explore how IDs can streamline processes for citizens and governments.
eSignet: An online authentication solution supporting multiple methods like OTP, digital wallets, and biometrics.
Inji: A platform for managing the lifecycle of verifiable credentials.
Real-World Impact: Understand how eSignet and Inji provide secure and efficient digital experiences.
Note: The video resources listed below are earlier recordings from webinars held in 2024. While they are not being archived at this time, they remain available as they provide useful context and practical demonstrations that may still benefit viewers.
For problem statement 2:
Enhance text: In the Face Verification screen, the text should be enhanced as "Hold the phone steady, keep your face focused in the centre and click on Capture" below the camera placeholder.


Q1: Jan24 - Mar24
Q2: Apr24 - Jun24
Q3: Jul24 - Sep24
Q4: Oct24 - Dec24
Quarter
Feature
Status
Q1: Jan24 - Mar24
Q2: Apr24 - Jun24
Q3: Jul24 - Sep24
Q4: Oct24 - Dec24
Q1: Jan24 - Mar24
Q2: Apr24 - Jun24
Q3: Jul24 - Sep24
Q4: Oct24 - Dec24
Q1: Jan24 - Mar24
Q2: Apr24 - Jun24
Q3: Jul24 - Sep24
Q4: Oct24 - Dec24
Feature Details
Release Details
Q1-Q4
Threat modelling.
Deprioritised
Q1
Abstract INJI features (Tuvali, Secure-keystore) in to SDK/NPM libraries
🟢 Completed
Q1
Sunbird RC - Issuer integration
🟢 Completed
Q1
User data backup
🟢 Completed
Q1-Q2
INJI new UI - Gendermag (P1, P2, P3)
🟢 Completed
Q2
Different Views of Cards
🟢 Completed
Q2
VC Sharing Flow Optimisation
🟢 Completed
Q2
Credential Type Selection
🟢 Completed
Q2
VC Verification
🟢 Completed
Q2
QR Code Generation (PixelPass)
🟢 Completed
Q3
Native artefacts:
inji-vci-client
Secure keystore
Tuvali
PixelPass
🟢 Completed
Q3
Ease of Deployment
🟢 Completed
Q3
Inji Certify Integration
🟢 Completed
v0.14.0
Q3
Draft 13 changes of OpenID4VCI spec
🟢 Completed
v0.14.0
Q3
Java upgrade to 21
🟢 Completed
v0.14.0_Mimoto:
Q4
OpenID4VP
🟢 Completed
v0.15.0
Q4
VC render spec based wallet rendering
Moved to 2025
NA
Q4
OpenID4VP for BLE: Implementation of non QR based sharing as per OpenID for BLE specification
Deprioritised
NA
Q4
Support for different VC formats and proof types
Moved to 2025
NA
Q4
Data Model 2.0
Moved to 2025
NA
Q4
Performance Testing
Deprioritised
NA
Q4
Security Testing
Moved to 2025
NA
Q4
OpenID4VCI enhancements
Moved to 2025
NA
Q4
Wallet Login
Moved to 2026 & Beyond
NA
Q4
BBS+ support
Moved to 2026 & Beyond
NA
Quarter
Feature
Status
Feature Details
Release Details
Q2
Fetch & download credentials in PDF format
Issuer and credential type selection
Quarter
Feature
Status
Feature Details
Release Details
Q2
Easy deployment of Inji Certify v0.8
Docker compose for Sunbird and eSignet for Verifiable Credential Issuance
Helm charts for Sunbird and eSignet.
Quarter
Feature
Status
Feature Details
Release Details
Q2
Web-based VC Verification functionality
🟢 Completed
Q2
Localization
🟢 Completed
Q2
Responsive View
🟢 Completed
Q2
Theme customization
🟢 Completed
Q2
Tech Upgrades:
Movement from Material UI to Tailwind
Conversion of JS to TS
🟢 Completed
Q2
QR Code in PDF
🟢 Completed
v0.10.0
Q2
Online Sharing
🟢 Completed
v0.10.0
Q3
Secure time bound storage
🟢 Completed
v1.0.0
Q3
Performance Testing
Moved to 2025
NA
Q3
Security Testing
Moved to 2025
NA
Q3
Web UI enhancements:
Home Page
svg template in PDF
Moved to 2025
NA
Q4
User login, VC management, profile management (profile menu)
Moved to 2025
NA
Q4
VC Validation & Verification
Moved to 2025
NA
Q4
OpenID4VCI enhancements
Moved to 2025
NA
Q4
Categorization of issuers
Moved to 2026 & Beyond
NA
Q4
mDoc/mDL & CBOR VC download
Moved to 2026 & Beyond
NA
Completed
Q2
Inji Certify - Base code v0.9
Publish as an independent module (VCI + C)
VCI segregation from eSignet and moving to Inji Certify.
Plugin Support :
MOSIP Identity Plugin
Sunbird Plugin
Mock Identity Plugin
Implementors Draft 13 OpenIDVCI
Completed
Q3
Movement to Data Model 2.0
Completed
v0.10.0
Q3
OpenID for Verifiable Credential Issuance - draft 13 Spec
Pre-Authorized Code Flow
Credential Offer End Point
Completed
v0.10.0
Q3
VC Generation: Create Credentials from the Request Payload
W3C VC Issuance API
Moved to 2025
v0.10.0
Q3
Simplify the process of onboarding an issuer for a single entity
Moved to 2025
v0.11.0
Q3
Multi-tenancy: Onboarding of multiple issuers
Moved to 2025
v0.11.0
Q3
Persistent store for credentials
Pre-generated credentials
Credentials Registry (Hosted Infra)
moved to 2025
v0.11.0
Q4
Issue a physical credential (PDF / Printable)
Support PDF or other formats of presentation based on plugins - PDF, PCF, PKPASS
Moved to 2025
v0.11.0
Q4
Vault Integration - Key manager support
Moved to 2025
v0.12.0
Q4
Vault - Key management
Moved to 2025
v0.12.0
Q4
Revocation Mechanism
Moved to 2025
v0.12.0
Q4
Discovery and Metadata
DNS based Well Known specifications for publishing PK, Schema, credential types and other meta data (Proposed by MOSIP and included in standards)
Moved to 2025
v0.12.0
Q4
Allow Bulk/Batch Issuance
Issue certificates from an existing database
Moved to 2025
v0.12.0
Q4
Deferred Credential Endpoint
OpenIDVCI - Draft 13
Moved to 2025
v0.12.0
Q4
Inji Certify - Beta 1 - LTS
Deprioritised
v1.0
Q1-Q4
Extend Credentials
Ability to issue extension on existing credential
Moved to 2025
Depriortized
Q1-Q4
Credential Correction
Support to retire the old credential and issue the new credential
Moved to 2025
Depriortized
Q1-Q4
Credential Formats Support - Selective Disclosure - Support SD JWT
Moved to 2025
Depriortized
Q1-Q4
[Credential Formats Support - Support mDocs
Moved to 2025
Depriortized
Q1-Q4
Business models (central, third-party SaaS, self-hosted)
Moved to 2025
Depriortized
Completed
Q2
UI/UX Enhancements based on GenderMag
Completed
Q2
Mobile Responsive Version - Upload and Scan feature
Completed
Q2
Material UI to Tailwind
Completed
Q2
Bug Fixes
Completed
Q3
Request Credential - OpenIDVP - OVP Flow
Completed
Q3
Docker Compose
Completed
Q4
Support for Country QR code - CWT Format
Completed
Q4
Verification SDK
Completed
Q4
Displaying Issuer Details post validation on UI
Completed
Q4
Multi-lingual UI Support - Localization
Completed
2025
Templatizing post-VC verification on Inji Verify(Render)
Moved to 2025
Depritoritized
2025
Receive Credentials
(QR-based Verifiable Presentation)
Moved to 2025
Depritoritized
2025
VP requestor SDK
Moved to 2025
Depritoritized
2025
Consume Data from credential
Moved to 2025
Depritoritized
2025
Production Ready - Inji Verify - LTS Release 1.0.0
Moved to 2025
Depritoritized
2025
BLE based verifiable presentation
Moved to 2025
Depritoritized
2025
Credential Correction
Moved to 2025
Depritoritized
2025
Revoked Credentials
Moved to 2025
Depritoritized
2025
VC Reciever SDK
Moved to 2025
Depritoritized
2025
Upload document(pdf) with multiple QR Codes
Moved to 2025
Depritoritized
2025
Verify mDoc and mDL
Moved to 2025
Depritoritized
2025
Mobile App (Login with Inbox & Logout)
Moved to 2025
Depritoritized
2025
Offline Verification SDK
Moved to 2025
Depritoritized
Here we present the Inji-Stack product roadmap for 2026 and our strategic horizon forward. This roadmap outlines the planned features, progress, and release details for Inji Stack.
The annual product cycle for the Inji Stack begins in January and concludes in December.
For detailed module-wise roadmaps, please refer to the respective sections; Inji Wallet (Mobile, Web), Inji Certify and Inji Verify.
Acronyms and Legends:
TBA: 'Github Issues Link - To Be Added'
P1
Presentation During Issuance.
P1
W3C Data Model 2.0 & SVG Render Method.
TBA
P1
Presentation During Issuance with JSON LD VC Format.
P1
Ability to verify Claim 169 QR Code.
🟢 Completed
P1
Claim 169 QR Code Support.
🟢 Completed
P1
Wallet Login & Common Key Management.
🟠 In-Progress
P1
Upgrade to OpenIDVCI final version 1.0
TBA
🟠 In-Progress
P1
Upgrade to OpenIDVP final version 1.0
TBA
🟠 In-Progress
P1
Support for ECC R1.
TBA
🟠 In-Progress
P1
Create Profile - Profiling with Single VC.
TBA
🔵 Planned
P1
Credential Refresh Support.
TBA
🔵 Planned
P1
DC API Support.
TBA
🔵 Planned
P1
W3C Data Model 2.0-based SD-JWT & JWT VC Support.
TBA
🔵 Planned
P1
IETF based SD-JWT & JWT SVG Rendering.
TBA
🔵 Planned
P1
Delegated Access Support from Issuer.
TBA
🔵 Planned
P1
Revocation of mDoc/mDL VC Format.
TBA
🔵 Planned
P2
Shamir’s secret open standard Implementation.
TBA
Moved to 2027
🟢 Completed
P1
Claim 169 QR Code Support.
TBA
🟢 Completed
P1
SD-JWT via OpenIDVP Flow.
TBA
🟠 In-Progress
P1
Upgrade to OpenIDVP final version 1.0
TBA
🟠 In-Progress
P1
Upgrade to OpenIDVCI final version 1.0
TBA
🟠 In-Progress
P1
Create Profile - Profiling with Single VC (Profile Management
Multi-profile).
TBA
🔵 Planned
P1
Revocation of Data Model 2.0 VC.
TBA
🔵 Planned
P1
Presentation During Issuance.
TBA
🔵 Planned
P1
mDoc/mDL VC Support.
TBA
🔵 Planned
P1
Pre-Auth Code Flow.
TBA
🔵 Planned
P2
Credential refresh.
TBA
🔵 Planned
P2
USSD Support - Offline VC sharing via a feature phone
USSD Wallet.
TBA
🔵 Planned
P2
W3C Data Model 2.0 SD-JWT & JWT VC Support.
TBA
🔵 Planned
P2
Delegated Access Support from Issuer.
TBA
Moved to 2027
P2
Enhancement to Inji Web Login: Support other ID provider login like eSignet.
TBA
Moved to 2027
P2
BBS + Support:
Improve user privacy
1 secret, and a domain-specific public key
TBA
Moved to 2027
P3
Recovery of Web Wallet.
TBA
Moved to 2027
P3
Enhancement to Inji Web Login: Audit Mechanism with Inji web login.
TBA
Moved to 2027
🟢 Completed
P1
VC Issuance with mDoc/mso VC format.
🟢 Completed
P1
Pre Auth Code Issuance for JSON-LD Format.
🟢 Completed
P1
Embedding Multiple QR code in VC.
🟢 Completed
P1
Adoption of OpenIDVCI v1.0.
🟢 Completed
P1
SVG Rendering - support for multiple templates rendering.
🔵 Planned
P1
Support JWT VC Format.
🔵 Planned
P1
Multiple issuer.
🔵 Planned
P1
Support for adoption of external key manager system to Certify.
TBA
🔵 Planned
Moved to 2027
P1
Multi-lingual support for credential data (Enhancement).
TBA
🔵 Planned
P1
Credential Refreshing.
TBA
🔵 Planned
Moved to 2027
P1
Support for wallet attestation client auth.
TBA
🔵 Planned
Moved to 2027
P1
Revocation of Credentials.
TBA
🔵 Planned
P1
Presentation during Issuance for sd_jwt.
TBA
🔵 Planned
P1
Support for VC Issuance in PDF format.
TBA
🔵 Planned
P1
Pre-Auth Code for sd_jwt format.
🔵 Planned
P2
Trust registry and verifiable data registry/
Support for keri protocol.
TBA
🔵 Planned
P2
Trust registry and verifiable data registry/
Support for dedi protocol.
TBA
🔵 Planned
P2
VC issuance with mutiple VC formats.
TBA
🔵 Planned
Moved to 2027
P2
Multiple QR Codes embedded in VC.
TBA
🔵 Planned
P2
BBS Support.
TBA
🔵 Planned
P2
Multi-proof support for single credentials. Inji Certify all have to be enhanced with multi-proof - ED, EC & BBS+.
TBA
🔵 Planned
P2
VC Generation: Create Credentials from the Request Payload.
TBA
🔵 Planned
P3
Subject Holder relationship VC.
TBA
🔵 Planned
P4
VC multiple status List support.
TBA
🔵 Planned
GA Release.
TBA
🔵 Planned
P4
Plug-ins for commonly used databases and data exchange.
TBA
🔵 Planned
P4
Allow bulk generation of onetime credentials.
TBA
🔵 Planned
P4
Support for PDF Template and rendering (Credential Issuance).
TBA
🔵 Planned
P4
Support for WebVH (Verified History).
TBA
🔵 Planned
🟢 Completed
P1
OpenID4VP - Same device flows alongside Web wallets.
🟢 Completed
P1
Support Server Side VC Verification: ECC- R1.
🟢 Completed
P1
Upgrade to OpenIDVP final version 1.0.
🟢Completed
P1
OpenIDVP: Same Device Flow (via DC API).
🟠 In-Progress
P1
W3C Data Model 2.0-based JWT VC.
🔵 Planned
P1
Multi language for SVG Template rendering.
🔵 Planned
P1
Ability to verify JSON (W3C) VC.
🔵 Planned
P2
Offline Verification SDK.
🔵 Planned
P2
BLE based verifiable presentation.
🔵 Planned
P2
Multi-Lingual Support.
🔵 Planned
P2
BBS+ Support.
🔵 Planned
P2
VC Label translation with well known.
🔵 Planned
P3
Inji Verify SDK Support apart from React applications for Wider Framework Compatibility.
🔵 Planned
P3
Ability to verify mDoc and mDL.
🔵 Planned
P3
Support for philisys QR code.
🔵 Planned
P3
Revocation for SD-JWT and JWT.
🔵 Planned
P3
Trust registry and verifiable data registry/
Support for:
keri protocol
dedi protocol
🔵 Planned
P4
IETF JWT VC Support.
🔵 Planned
P4
Native App for Inji Verify - Android device.
🔵 Planned
P4
Native App for Inji Verify - iOS device
🔵 Planned
P4
Revocation for mDoc/ mDL.
🔵 Planned
P4
Multiple QR Codes embedded in VC in a single PDF.
🔵 Planned
P4
SVG Rendering for IETF based SD-JWT & JWT.
🔵 Planned
P4
PDF Template Support.
🔵 Planned
P4
VC multiple status List support.
🔵 Planned
P4
Support for WebVH (Verified History).
🔵 Planned
Here we present the product roadmap for the entire Inji Stack for the calendar year 2025. The annual product cycle for the Inji Stack begins in January and concludes in December.
For detailed module-wise roadmaps, please refer to the following:
🟢 Completed
Q1
OpenIDVP : Cross-Device Flow
🟢 Completed
Q1
Support of mDL/mDoc Credentials
🟢 Completed
Q2
Cross-Device Enhancements for Credential Sharing
( OpenIDVP :Verifier Metadata Management)
🟢 Completed
Moved to Q2
Q2➕
VC Verifier SDK (Kotlin): ECC K1 Verification Support
🟢 Complete
Added to Q2
Q2➕
Sharing of mDL/mDoc via OpenIDVP
🟢 Complete
Added to Q2
Q2➕
Complaint to of OpenIDVP Spec
🟢 Complete
Added to Q2
Q2➕
WLA login through deep link in iOS
🟢 Complete
Added to Q2
Q2↑
Same Device Flow: Multiple credential requests during the presentation (OpenIDVP)
🟢 Complete
Moved to Q2 to Q3
Q3
OpenID4VCI Support for credential offer endpoint and pre-authorised code flow
🟢 Complete
Q3↓
Support for SD-JWT Credentials Format
🟢 Complete
Moved to Q3 from Q2
Q4↓
W3C Data Model 2.0 & SVG Render Method
&
🟢 Complete
Moved to Q4 from Q2
Q4➕
Selective Disclosure via OpenIDVP
🟢 Complete
Added to Q4
Q4↓
Credential Revocation
🟢 Complete
Moved to Q4 from Q3
2026↓
Presentation During Issuance
Moved to 2026 & Beyond
v0.22.0
Q4 Moved to 2026
2026↓
Support for Advanced Cryptographic Keys (ECC R1)
Moved to 2026 & Beyond
NA
Q4
Moved to 2026
2026↓
Support for JWT Credentials Format
Moved to 2026 & Beyond
NA
Q4
Moved to 2026
2026↓
Wallet Login with Unified Key Management
Moved to 2026 & Beyond
NA
Q3
Moved to 2026
2026↓
Profile Creation Using a Single Credential
Moved to 2026 & Beyond
NA
Q3
Moved to 2026
2026↓
Secure Key Recovery with Shamir’s Secret Sharing
Moved to 2026 & Beyond
NA
Q3
Moved to 2026
2027↓
Advanced Privacy Features with BBS+
Moved to 2026 & Beyond
NA
Q3
Moved to 2026
2027↓
Android App Security with Play Integrity
Moved to 2026 & Beyond
NA
Q3
Moved to 2027
2027↓
Multi-User Family Credentials
Moved to 2026 & Beyond
NA
Q4
Moved to 2027
2027↓
One-Time Use Credentials for Privacy
Moved to 2026 & Beyond
NA
Q4
Moved to 2027
2027↓
Secure Wallet Setup with Key Binding
(SIOP)
Moved to 2026 & Beyond
NA
Q1
Moved to 2027
🟢 Complete
Q1
Enable RSA256 Signature Suites for Guest Login(without login)
🟢 Complete
Q2
Enabling customisation of PDF Template
🟢 Complete
Q3+
User Login with IDP
🟢 Complete
Added to Q3
Q3+
Enable RSA256 Signature Suites for Login Flow
🟢 Complete
Q3↓
Enable Ed25519 2018 and 2020 Signature Suites for Login Flow
🟢 Complete
Q3↓
Enable ECC K1 Signature Suites for Login Flow
🟢 Complete
Q4↓
SD-JWT Credential Support
🟢 Complete
Moved to Q4 from Q3
Q4+
Enable Ed25519 2018 and 2020 Signature Suites for Guest Login (Without Login)
🟢 Complete
Added to Q4
Q4+
Enable ECC K1 Signature Suites for Guest Login (Without Login)
🟢 Complete
Added to Q4
Q4+
OpenIDVP Support for JSON-LD(W3C) VCs
🟢 Complete
Added to Q4
2026↓
Credential Revocation
Moved to 2026 & Beyond
v0.16.0
Q4
Moved to 2026
2026↓
W3C Data Model 2.0 & SVG Render Method
Moved to 2026 & Beyond
v0.16.0
Q4
Moved to 2026
2026↓
OpenIDVP Support for SD-JWT
Moved to 2026 & Beyond
NA
Q4
Moved to 2026
2026↓
Support for Advanced Cryptographic Keys (ECC R1)
Moved to 2026 & Beyond
NA
Q4
Moved to 2026
2026↓
Secure Key Recovery Using Shamir’s Secret Sharing
Moved to 2026 & Beyond
NA
Q2
Moved to 2026
2026↓
Support for mDoc/mDL Credentials
Moved to 2026 & Beyond
NA
Q2
Moved to 2026
2026↓
CBOR Credential Format Support
Moved to 2026 & Beyond
NA
Q2
Moved to 2026
2026↓
OpenID4VCI Support for credential offer endpoint and pre-authorised code flow
Moved to 2026 & Beyond
NA
Q3
Moved to 2026
2026↓
Advanced Privacy with BBS+ Support
Moved to 2026 & Beyond
NA
Q3
Moved to 2026
2026↓
Support for JWT Credentials
Moved to 2026 & Beyond
NA
Q3
Moved to 2026
2026↓
Unified Key Management for Web & Mobile
Moved to 2026 & Beyond
NA
Q1
Moved to 2026
2027↓
One-Time-Use Credentials for Privacy
Moved to 2026 & Beyond
NA
Q3
Moved to 2027
2027↓
Multi-User Family Credentials
Moved to 2026 & Beyond
NA
Q3
Moved to 2027
🟢 Completed
Q1
Support for VC data model 2.0
🟢 Completed
Q1
Implementation of Data Provider Plugin
🟢 Completed
Q1
ED25519 (2018 & 2020) VC Signing
🟢 Completed
Q2
Support for ECC K1
🟢 Completed
Moved to Q2 from Q1
Q2+
Support for ED25519 (2018 & 2020)
🟢 Completed
Added to Q1
Q2+
OAuth Support with external authentication
🟢 Completed
Added to Q1
Q3↓
Add New Credential Type to Issuer
🟢 Completed
Moved to Q3 from Q2
Q3↓
Support for ECC R1
🟢 Completed
Moved to Q3 from Q1
Q3+
Support for Data Integrity
🟢 Completed
Added to Q3
Q3↓
Credential Revocation Mechanism
🟢 Completed
&
Moved to Q3 from Q1
Q3↓
Credential Formats Support for - SD JWT
🟢 Completed
&
Moved to Q3 from Q1
Q3↓
Credential Formats Support for -mDoc
🟢 Completed
Moved to Q3 from Q2
Q3↓
Pre-authorized Code Flow
Moved to 2026 & Beyond
0.14.0
Moved to Q2 from Q1
Q3↓
Presentation during issuance of Credential
Moved to 2026 & Beyond
0.14.0
Moved to Q3 from Q2
Q3+
Claim 169 Support with QR Code Generation
Moved to 2026 & Beyond
0.14.0
Added to Q3
Q3↓
Anon Credential
Deprioritised
TBD
Moved to Q3 from Q2
Q3
VC Generation: Create Credentials from the Request Payload
Moved to 2026 & Beyond
TBD
Q3
Multi-issuers: Onboarding of multiple issuers
Moved to 2026 & Beyond
TBD
Q3
Subject Holder relationship for VC
Moved to 2026 & Beyond
TBD
Q3
Allow bulk generation of onetime credentials
Moved to 2026 & Beyond
TBD
Q4
Deferred Credential Endpoint
Deprioritised
TBD
Q4
Multi-User Credentials
Deprioritised
TBD
Q4
Issue a physical credential (PDF / Printable)
Deprioritised
TBD
🟢 Completed
, ,
Q1
Upgrades in OpenID4VP - Draft 21 specification
🟢 Completed
Q1
Inji Verify SDK: OpenID4VP- VP Verification component (cross device flow) and publish as an NPM module
🟢 Completed
Q1
Migration of Inji Verify backend from H2 in memory DB to PostgreSQL DB
🟢 Completed
Q2
Inji Verify SDK: Scan/ Upload Component and publish as an NPM module
🟢 Completed
Q2
Server Setup for VC and VP Proof Verification in vc-verifier library
🟢 Completed
Q3
OpenIDVP Same Device Flow (via deeplink): Integrate to Inji Verify SDK
🟢 Completed
Q3
OpenID4VP Draft 23: Implement DID-based client_id Scheme
🟢 Completed
Q3
OpenID4VP: Authorization Request via request_uri for did client id
🟢 Completed
Q3
OpenIDVP: Same Device Flow in Inji Verify SDK (mobile device)
🟢 Completed
Q4
Ability to verify SD-JWT VC
🟢 Completed
Q4
Templatizing post-VC verification (SVG Rendering)
🟢 Completed
Q4
Revoked Credentials
🟢 Completed
Q4
Multi lingual support
🟢 Completed
Q4
MOSIP UIN VC Verification
🟢 Completed
2026↓
Support Server Side VC Verification: ECC- K1 and R1
Moved to 2026 & beyond
TBD
2026↓
Inji Verify SDK Support apart from React applications for Wider Framework Compatibility
I
Moved to 2026 & beyond
TBD
2026↓
Claim 169 QR Code
Moved to 2026 & beyond
TBD
2026↓
Verify SD- JWT (W3C) VC
Moved to 2026 & beyond
TBD
2026↓
Verify mDoc and mDL
Moved to 2026 & beyond
TBD
2026↓
OpenID4VP - Cross device and same device flows alongside Web wallets
Moved to 2026 & beyond
TBD
2026↓
Support for Country QR code - CWT Format
Moved to 2026 & beyond
TBD
2026↓
Multi-language Support for VC during verification
Moved to 2026 & beyond
TBD
2026↓
Verify document(pdf) with multiple QR Codes
Moved to 2026 & beyond
TBD
2026↓
Support for multi proof: Single credential should support multiple proofs
Moved to 2026 & beyond
TBD
2026↓
GA Release
Moved to 2026 & beyond
TBD
2026↓
Credential Correction
Moved to 2026 & beyond
TBD
2026↓
Offline Verification SDK
Moved to 2026 & beyond
TBD
2026↓
BLE based verifiable presentation
Moved to 2026 & beyond
TBD
Q1
iOS Keystore: RSA, ECC R1/K1, Ed25519 Key Generation Support
Q1
Enabling VC Validity for Verification
Q1
Local deployment using docker compose
Q1
OpenIDVP: Cross Device Flow (QR code based Verifiable Presentation)
Prioritization: Through this roadmap the startegic or adaptive prioritization, if there is, has been indicated as below:
Add [ ➕ ]: Added new.
Strategic priortization [ ↑ ] : Brought ahead in schedule.
Adaptive reschedule [ ↓ ]: Is moved to approaching quarters.
Inji is a digital credentialing stack that enables users to securely download, store, share, and verify credentials. This guide is structured to provide a comprehensive approach for deploying the Inji stack (Inji Certify, Mimoto, Inji Web and Inji Verify). Not only the Inji Stack, this deployment guide has taken an approach to cover everything from deploying Wireguard to Base Infrastructure setup, Core Infra setup to configurations and finally the Inji Stack deployment.
This is the first question you could ask and the answer is No! If you have the Infrastructure ready and you just want to deploy the Inji stack you can directly jump to the Inji Stack Deployment section.
Introduction: Provides an overview of the Inji stack, deployment scenarios, required skill sets, system architecture, and key considerations for on-premise deployments.
Prerequisites: Outlines infrastructure details, hardware/software/network requirements, and initial setup steps.
: Guides you through setting up the foundational infrastructure for Inji, including Kubernetes provisioning, NGINX configuration, networking, and optionally, the observability cluster and monitoring module.
: Explains the external services required—such as the database, artifactory, etc.,—and provides steps for their installation and configuration.
: Offers step-by-step instructions to deploy Inji modules (Certify, Wallet, Verify) along with configuration guidance.
: Highlights how you can contribute code, share feedback, or reach out for support while working with the application.
Each section provides direct steps and references to external resources for a streamlined deployment experience.
The scenarios listed below are only a few examples. Inji Stack can support many more deployment possibilities depending on the country, organization, or individual requirements.
Deploying Inji Stack is easier while you have Base Infrastructure ready, still, if you want to deploy it 'On-Premise' and from scratch, this guide helps you with the instructions to achieve this.
Linux System Administration: Proficiency in Linux command-line operations, user and permission management, and basic networking.
Networking Fundamentals: Knowledge of firewalls, load balancers, DNS, and secure network configuration.
Containerisation: Experience with Docker or similar container technologies for building and managing service containers.
Kubernetes Administration
Links to the deployment architecture diagrams below take you to respective sections of this guide and illustrate the high-level deployment architecture for Inji Stack, showing how core components interact within the Kubernetes cluster, including ingress, services, and external integrations.
Inji Wallet
For a smooth and error-free setup of the Inji Stack, it is recommended to follow the deployment order starting with Inji Certify, followed by mimoto backend for Inji Wallet(Mobile+Web), next the Inji Web Wallet, and finally Inji Verify. This sequence ensures that foundational services and dependencies are available before deploying modules that rely on them, leading to a more stable and seamless deployment experience.
The section helps you to have a quick understanding of what you should expect when you go about deploying Inji-Stack, especially if you are deploying it 'On-Premise' and from scratch.
Inji modules are deployed as microservices in a Kubernetes cluster.
Wireguard is used as a trust network extension to access the admin, control, and observation panes.
Inji uses Nginx server for:
SSL termination
While we have placed the Prerequisites specific to a section under respective sections itself, here, this 'Prerequisites' lists the common ones which you will need no matter which component you are deploying such as Wireguard, PC - Tools and Utilities etc.
Follow the steps mentioned here to install the required tools on your personal computer to create and manage the k8's cluster.
The Inji stack can be deployed with a PC having one of the following operating systems, however for this guide we have considered a linux machine with Ubuntu 22.04 LTS.
Linux (Ubuntu 22.04 LTS - recommended for production deployments)
Windows
macOS (OSX)
You should have these tools installed on your local machine from where you will be running the ansible playbooks to create and manage the k8 cluster using RKE1.
- version > 2.12.4
Command line utilities:
- version 2.12.4 or higher
- any client version above 3.0.0 and add below repos as well
: version:
: version: 1.15.0
Create a directory as mosip in your PC and:
clone k8’s infra repo with tag : 1.2.0.2 (whichever is the latest version) inside mosip directory. git clone https://github.com/mosip/k8s-infra -b v1.2.0.2
Wireguard bastian server provides secure private channel to access Inji cluster. Bastian server restricts public access, and enables access to only those clients who have their public key listed in Wireguard server.
WireGuard is a modern, fast, and secure VPN (Virtual Private Network) protocol and software that creates encrypted tunnels between devices.
Wireguard bastian server provides secure private channel to access Inji cluster.
Bastian server restricts public access, and enables access to only those clients who have their public key listed in Wireguard server.
Bastion server listens on UDP port 51820.
Wireguard Bastion Host
VMs and Hardware Specifications
1 VM (ensure to set up active-passive for HA)
Specification - 2 vCPUs, 4 GB RAM, 8 GB Storage (HDD)
Server Network Interfaces
Before proceeding, Create a Wireguard server VM with the mentioned specification under 'Prerequisites' above. This VM will be used to set up the Wireguard server. Once the VM is ready, open the required ports on the Bastion server VM.
Open required ports in the Bastian server VM
Configure the firewall on the Bastion server virtual machine to allow network traffic through specific ports needed for your application or remote access.
cd $K8_ROOT/wireguard/
Create copy of hosts.ini.sample as hosts.ini and update the required details for wireguard VM
cp hosts.ini.sample hosts.ini
Execute ports.yml to enable ports on VM level using ufw:ansible-playbook -i hosts.ini ports.yaml
Install docker
execute docker.yml to install docker and add user to docker group:
Setup Wireguard server
SSH to wireguard VM
ssh -i <path to .pem> ubuntu@<Wireguard server public ip>
Create directory for storing wireguard config files.
mkdir -p wireguard/config
Install Wireguard client on your PC using .
Assign wireguard.conf:
SSH to the wireguard server VM.
cd /home/ubuntu/wireguard/config
Once connected to wireguard, you should be now able to login using private IP’s.
"Base Infrastructure Setup" refers to preparing all foundational resources and configurations needed before deploying the Inji stack. This includes provisioning servers/VMs, configuring networks and firewalls, setting up SSL certificates, installing Kubernetes clusters and required tools (Docker, kubectl, Helm, etc.), establishing secure access (e.g., Wireguard VPN), and deploying essential services like NGINX, storage, monitoring, and logging. It ensures the environment is ready for Inji stack installation.
Provisioning foundational resources required for the Inji stack, including:
Virtual machines (VMs) or servers as per hardware requirements.
Network configuration (internal connectivity, firewall rules, DNS).
SSL certificate setup for secure communications.
Before deploying any Inji Stack module, ensure that the following common prerequisites are met. These requirements apply to all modules and must be fulfilled to guarantee a smooth and successful deployment process.
Note: You can deploy Inji on an environment and operating system that supports Kubernetes-based deployments. Ensure your chosen OS and infrastructure meet the prerequisites and compatibility requirements. Note: This guide references using Ubuntu Server 22.04 LTS. Note: For large-scale deployments or environments with strict security requirements, an on-premises setup is recommended. For pilot projects, demonstrations, or rapid prototyping, a cloud-based deployment may be more suitable.
Note: Virtual Machines (VMs) can use any operating system as per convenience. For this installation guide, Ubuntu OS is referenced throughout.
VMs and Hardware Specifications
3 VMs (allocate etcd, control plane, and worker nodes accordingly for HA)
Specification - 8 vCPUs, 32 GB RAM, 64 GB Storage (HDD)
Network Interfaces
Below is a sample mapping of domain names to their respective IP addresses and purposes for a typical Inji deployment. Update these as per your environment.
rancher.xyz.net
Maps to: Private IP of Nginx server or load balancer (Observation cluster)
Purpose: Rancher dashboard for monitoring and managing the Kubernetes cluster.
keycloak.xyz.net
Note: Ensure all DNS records are created and point to the correct IP addresses (public or private) as per your network design. For private domains, access is typically restricted via Wireguard VPN.
See the section for common prerequisites required for all deployments.
Note: For detailed VM provisioning steps and hardware/network prerequisites, see the above for VM - Hardware specification and more.
Find the kubernetes infrastructure repository which contains the scripts to install and configure Kubernetes cluster with required monitoring, logging and alerting tools.
After reviewing the k8s-infra repository and ensuring that you also have all the required tools and utilities installed on your local machine, the next step is to provision and configure your Kubernetes cluster nodes (VMs or servers) according to the hardware and network requirements specified under 'Prerequisites' above. Once your nodes are ready and accessible, proceed to run the provided Ansible playbooks and scripts from the k8s-infra repository to set up the Kubernetes cluster, networking, and essential infrastructure components.
Ingress setup
It is a service mesh for the MOSIP K8 cluster which provides transparent layers on top of existing microservices along with powerful features enabling a uniform and more efficient way to secure, connect, and monitor services.
cd $K8_ROOT/mosip/on-prem/istio
./install.sh
This will bring up all the Istio components and the Ingress Gateways.
Check Ingress Gateway services:
Storage classes (NFS)
Multiple storage classes options are available for onprem K8's cluster. In this reference deployment will continue to use NFS as a storage class.
Move to nfs directory in your personel computer.
Create a copy of hosts.ini.sample as hosts.ini.
Update the NFS machine details in hosts.ini file.
Note :
Add below mentioned details:
ansible_host : internal IP of NFS server. eg. 10.12.23.21. In our reference implementation using nginx server
SSH to the nfs node:
Clone k8s-infra repo in nginx VM:
Move to the nfs directory:
Execute script to install nfs server:
Note: > * Script prompts for below mentioned user inputs: > >
> ..... > Please Enter Environment Name: <envName> > ..... > ..... > ..... > [ Export the NFS Share Directory ] > exporting *:/srv/nfs/mosip/<envName> > NFS Server Path: /srv/nfs/mosip/<envName> >> > * envName: env name eg. dev/qa/uat...
Switch to your personel computer and excute below mentioned commands:
Post installation check:
Check status of NFS Client Provisioner from your PC, make sure pointing to right kubeconfig file.
Check status of nfs-client storage class.
SSL certificate creation
For Nginx server setup, we need ssl certificate, add the same into Nginx server.
Incase valid ssl certificate is not there generate one using letsencrypt:
SSH into the nginx server
Install Pre-requisites:
Generate wildcard SSL certificates for your domain name.
sudo certbot certonly --agree-tos --manual --preferred-challenges=dns -d *.sandbox.mosip.net -d sandbox.mosip.net
replace sanbox.mosip.net with your domain.
Nginx server setup for Inji K8's cluster
Move to nginx directory in your local:
cd $K8_ROOT/mosip/on-prem/nginx/
Open required ports :
Use any editor to create new hosts.ini
Add below mentioned lines with updated details of nginx server to the hosts.ini and save.
Execute below mentoned command to open required ports:
Login to the nginx server node.
Clone k8s-infra
Provide below mentioned inputs as and when prompted
MOSIP nginx server internal ip
MOSIP nginx server public ip
Publically accessible domains (comma seperated with no whitespaces)
Check Overall nginx and istio wiring
Install httpbin: This utility docker returns http headers received inside the cluster.
httpbin can be used for general debugging - to check ingress, headers etc.
Make sure pointing to right kubeconfig file.
To see what is reaching the httpbin (example, replace with your domain name):
Note :
Monitoring in the sandbox environment is optional and can be deployed if required.
For production environments, alternative monitoring tools can be used.
These steps can also be skipped in development environments if monitoring is not needed.
Prometheus and Grafana and Alertmanager tools are used for cluster monitoring.
Select 'Monitoring' App from Rancher console -> Apps & Marketplaces.
In Helm options, open the YAML file and disable Nginx Ingress.
Click on Install
Note:
Alerting in the sandbox environment is optional and can be deployed if required.
For production environments, alternative alerting tools can be used.
These steps can also be skipped in development environments if alerting is not needed.
Alerting is part of cluster monitoring, where alert notifications are sent to the configured email or slack channel.
Install Default alerts along some of the defined custom alerts:
Alerting is installed.
Note :
Logging in the sandbox environment is optional and can be deployed if required.
For production environments, alternative logging tools can be used.
These steps can also be skipped in development environments if logging is not needed.
Inji uses and elasticsearch to collect logs from all services and reflect the same in Kibana Dashboard.
Install Rancher FluentD system : Required for screpping logs outs of all the microservices from Inji k8 cluster.
Install Logging from Apps and marketplace within the Rancher UI.
Select Chart Version 100.1.3+up3.17.7 from Rancher console -> Apps & Marketplaces.
Open kibana dashboard from https://kibana.sandbox.xyz.net.
Kibana --> Menu (on top left) --> Dashboard --> Select the dashboard.
This section covers the installation and configuration of essential infrastructure components required for the Inji stack, including configmaps, databases, object storage, secrets management, configuration server, and artifactory.
inji-stack-config configmap: For inji K8's env, inji-stack-config configmap in default namespace contains Domain related information. Follow below steps to add domain details for inji-stack-config configmap.
Update the domain names in inji-stack-cm.yaml correctly for your environment.
Create values.yaml
This ensures that values.yaml is available for your Helm install command and can be referenced directly during the config-server deployment.
Create a values.yaml file that will contain the configuration for the chart and send it to your config-server installation.
Review values.yaml and make sure git repository parameters are as per your installation and enable only the required environment variables.
Open the file and paste the following content into it in the same directory where values.yaml is created.
Run the Script
Once Prerequisites, Base Infrastructure, and the Core Infrastructure Setup and Configuration are complete, now you can proceed with the deployment of the Inji stack components.
For detailed deployment steps, architecture, and module-level instructions, refer to the following:
Inji Wallet
While you have a deployment environment ready, you can now proceed with the installation of Inji Certify by following the steps explained here.
Note: Before deploying Inji Certify, it is recommended to always use the latest . Each release includes enhancements, technical upgrades, and new features to ensure the best experience.
Inji Certify is deployed as containerized microservices in your Kubernetes cluster.
Where Will it Run?
Target Environment: Your main Kubernetes cluster
Deployment Method: Helm charts that pull Docker images from container registries
Access Point: Through your configured NGINX ingress at https://injicertify.sandbox.xyz.net
What Gets Installed?
Kubernetes Pods: Running Inji Certify microservices
Services: For internal communication
Ingress Rules: For external access via NGINX
ConfigMaps & Secrets: For configuration and credentials
Step 1: Pre-Deployment Checklist
Before deploying Inji Certify, ensure the following infrastructure components and configurations are in place as mentioned
Step 2: Prepare Your Deployment Environment
From your local machine, you'll run deployment scripts that:
Connect to your Kubernetes cluster via kubectl
Deploy containerized services using Helm charts
Configure ingress rules through Istio
Step 3: Clone and Navigate to Deployment Scripts
Step 4: Deploy Redis (if not already deployed)
Step 5: Initialize Database
Step 6: Deploy Inji Certify Microservices
Helm Charts Execution: Downloads and deploys Docker containers
Service Registration: Services register with config-server for configuration
Database Initialization: Creates required tables and seed data
Ingress Configuration: Configures routes through Istio gateway
###3 Verification Steps
Check Pod Status
Verify Service Endpoints
Test External Access
Deployment Scripts Executed Successfully
All deployment scripts (install.sh) for Redis and Inji Certify microservices complete without errors.
No failed Helm releases or container pull issues during deployment.
Remote Deployment: You deploy from your local machine to the remote K8s cluster
Container Registry: Docker images are pulled from public/private registries during deployment
Configuration: All configuration comes from your config-server and configmaps
If deployment fails, check:
Cluster Connectivity: kubectl cluster-info
Prerequisites: Ensure config-server, postgres, redis are running
Resources: Verify cluster has sufficient CPU/memory
Network
You can also refer to the file for deployment steps given in individual module repositories.
Need help or have questions? In case you encounter any issues or have queries while using or deploying the application, please post them in the . The community and maintainers are available to assist you.
This section provides a structured, step-by-step guide to deploy Mimoto, which serves as the backend for Inji Mobile Wallet and Inji Web Wallet. Follow these instructions to ensure a successful and reproducible deployment.
Note: Before deploying mimoto, it is recommended to always use the latest released version. Each release includes enhancements, technical upgrades, and new features to ensure the best experience.
Mimoto is deployed as containerized microservices in your Kubernetes cluster.
Where Will it Run?
Target Environment: Your main Kubernetes cluster
Deployment Method: Helm charts and shell scripts that pull Docker images from container registries
Access Point: Through your configured NGINX ingress (domain as configured)
What Gets Installed?
Kubernetes Pods: Running Mimoto microservices
Services: For internal communication
Ingress Rules: For external access via NGINX/Istio
ConfigMaps & Secrets: For configuration and credentials
Step 1: Pre-Deployment Checklist
Before deploying the mimoto (backend for Inji Wallet), ensure the following infrastructure components and configurations are in place as mentioned below:
Note: Before running the Postgres install script, update the POSTGRES_HOST value in install.sh with the correct PostgreSQL host.
Step 2: Clone and Navigate to Deployment Scripts
Step 3: Install Redis (If Not Already Installed)
To install Redis, run:
Step 4: Initialize Database
Update the values file for PostgreSQL initialization as needed, then run:
Step 5: Install Partner Onboarder
To install the Partner Onboarder module:
During the execution of the install.sh script, you will be prompted to provide information for the S3 bucket, including its name and URL.
Once the job completes, log in to your S3 or NFS storage and verify the reports. There should be no failures.
Step 6: Install Mimoto
Before installing Mimoto, ensure that the database host and port are correctly configured in the values.yaml file.
To install Mimoto:
During the execution of the install.sh script, you will be prompted to specify whether a public domain and a valid SSL certificate are present on the server.
If the server does not have a public domain and valid SSL certificate, select n.
This will enable an init-container with an emptyDir volume, which will download the server's self-signed SSL certificate and mount it to the Java keystore (cacerts) within the container.
This is useful for deployments using self-signed SSL certificates.
Step 6: Onboarding a New Issuer for VCI
To onboard a new issuer for VCI:
Create a folder named certs in the root directory.
Inside certs, create a file named oidckeystore.p12.
Store the keys as different aliases for each issuer in this file.
For more details, refer to the official documentation or the relevant section in the repository.
Check Pod Status:
Check Service Endpoints:
Test External Access:
Remote Deployment: You deploy from your local machine to the remote K8s cluster.
Container Registry: Docker images are pulled from public/private registries during deployment.
Configuration: All configuration comes from your config-server and configmaps.
Note: Screenshots for each success criteria step will be added shortly to provide a visual reference.
Deployment Scripts Executed Successfully
All installation scripts (install.sh) for Redis, Partner Onboarder, and Mimoto complete without errors.
No failed Helm releases or container pull issues during deployment.
If deployment fails, check:
Cluster Connectivity: kubectl cluster-info
This command checks if your local kubectl is properly configured and can communicate with the Kubernetes cluster.
It displays information about the cluster's master and services, confirming that your connection is active and functional.
Prerequisites: Ensure config-server, postgres, redis are running
Resources: Verify cluster has sufficient CPU/memory
Network: Ensure ingress and DNS are properly configured
Logs: Check pod logs for errors: kubectl logs <pod-name> -n mimoto
You can also refer to the file for deployment steps given in individual module repositories.
Need help or have questions? In case you encounter any issues or have queries while using or deploying the application, please post them in the . The community and maintainers are available to assist you.
This section explains how to deploy the Inji Web Wallet, which comes with a reference web UI and DataShare. This web UI serves as a sample implementation to help integrators and countries build their own customized user interface.
Note: Before deploying Inji Web Wallet, it is recommended to always use the latest . Each release includes enhancements, technical upgrades, and new features to ensure the best experience.
Inji Web UI and dataShare are deployed as containerized microservices in your Kubernetes cluster.
Where Will It Run?
Target Environment: Your main Kubernetes cluster
Deployment Method: Helm charts that pull Docker images from container registries
Access Point: Through your configured NGINX ingress at https://injiweb.sandbox.xyz.net (and DataShare endpoints as configured)
What Gets Installed?
Kubernetes Pods: Running Inji Web UI and DataShare microservices
Services: For internal communication
Ingress Rules: For external access via NGINX/Istio
ConfigMaps & Secrets: For configuration and credentials
Step 1: Pre-Deployment Checklist
Before deploying Inji Web Wallet, ensure the following infrastructure components and configurations are in place as mentioned below:
Step 2: Prepare Your Deployment Environment
From your local machine, you'll run deployment scripts that:
Connect to your Kubernetes cluster via kubectl
Deploy containerized services using Helm charts
Configure ingress rules through Istio/NGINX
Step 4: Clone and Navigate to Deployment Scripts
Step 5: Prepare Configuration
Review and update the values.yaml file for your environment (domain names, DB connection, object store endpoints, etc.).
Ensure the active_profile_env parameter in the config map of the config-server-share is set to:
Step 6: Deploy DataShare (if required)
If DataShare is a separate module, deploy it first:
Step 6: Deploy Inji Web UI
From the deploy directory:
Step 7: Verification Steps
Check pod status:
Check service endpoints:
Test external access:
Step 8: Post-Installation Configuration
Confirm that the active_profile_env in the config-server-share config map is set as described above.
Ensure DNS records for injiweb.sandbox.xyz.net and any DataShare endpoints are correctly mapped to your ingress controller.
Remote Deployment: You deploy from your local machine to the remote K8s cluster
Container Registry: Docker images are pulled from public/private registries during deployment
Configuration: All configuration comes from your config-server and configmaps
Note: Screenshots for each success criteria step will be added shortly to provide a visual reference.
Your deployment is successful if:
Pods are Running and Healthy
All pods in the injiweb namespace show STATUS = Running and READY counts match.
kubectl get pods -n injiweb shows no CrashLoopBackOff or Error.
Services are Registered and Reachable
kubectl get services -n injiweb lists expected Inji Web and DataShare services.
Each service has a valid ClusterIP or LoadBalancer.
Configuration is Applied Correctly
Ensure the active_profile_env parameter in the config map of the config-server-share is set to: default,inji-default, standalone
No config fetch errors appear in Inji Web pod logs.
Ingress/DNS is Working
DNS entries (e.g., injiweb.sandbox.xyz.net) point correctly to your ingress controller.
Running curl k https://injiweb.sandbox.xyz.net/health returns HTTP 200 with a healthy response.
DataShare Module (if deployed) is Accessible
DataShare pods are up and healthy.
DataShare endpoints are reachable and registered in Kubernetes.
No Critical Errors in Logs
Reviewing logs (kubectl logs <pod-name> -n injiweb) shows no failures during startup or runtime.
If deployment fails, check:
Cluster Connectivity: kubectl cluster-info
This command checks if your local kubectl is properly configured and can communicate with the Kubernetes cluster.
It displays information about the cluster's master and services, confirming that your connection is active and functional.
Prerequisites: Ensure config-server, postgres, redis are running
Resources: Verify cluster has sufficient CPU/memory
Network: Ensure ingress and DNS are properly configured
Logs: Check pod logs for errors: kubectl logs <pod-name> -n injiweb
You can also refer to the file for deployment steps given in individual module repositories.
Need help or have questions? In case you encounter any issues or have queries while using or deploying the application, please post them in the . The community and maintainers are available to assist you.
This section provides step-by-step instructions to install Inji Verify. Please follow these guidelines to make sure a successful setup in your environment.
Note: Before deploying Inji Verify, it is recommended to always use the latest . Each release includes enhancements, technical upgrades, and new features to ensure the best experience.
Inji Verify is deployed as containerized microservices in your Kubernetes cluster.
Where Will It Run??
Target Environment: Your main Kubernetes cluster
Deployment Method: Helm charts that pull Docker images from container registries
Access Point: Through your configured NGINX ingress at https://injiverify.sandbox.xyz.net
What Gets Installed?
Kubernetes Pods: Running Inji Verify microservices
Services: For internal communication
Ingress Rules: For external access via NGINX
ConfigMaps & Secrets: For configuration and credentials
Step 1: Pre-Deployment Checklist
Before deploying Inji Verify, ensure the following infrastructure components and configurations are in place as mentioned
Step 2: Prepare Your Deployment Environment
From your local machine, you'll run deployment scripts that:
Connect to your Kubernetes cluster via kubectl
Deploy containerized services using Helm charts
Configure ingress rules through Istio
Step 3: Clone and Navigate to Deployment Scripts
Step 4: Initialize Database
Update the values file for PostgreSQL initialization as needed.
Step 5: Deploy Inji Verify Microservices
Helm Charts Execution: Downloads and deploys Docker containers
Service Registration: Services register with config-server for configuration
Database Initialization: Creates required tables and seed data
Ingress Configuration: Configures routes through Istio gateway
Check Pod Status
Verify Service Endpoints
Test External Access
Delete all services:
Restart all services:
Remote Deployment: You deploy from your local machine to the remote K8s cluster
Container Registry: Docker images are pulled from public/private registries during deployment
Configuration: All configuration comes from your config-server and configmaps
Note: Screenshots for each success criteria step will be added shortly to provide a visual reference.
Deployment Scripts Executed Successfully
Deployment scripts (install-all.sh) complete without errors.
No failed Helm releases or container pull issues during deployment.
If deployment fails, check:
Cluster Connectivity: kubectl cluster-info
This command checks if your local kubectl is properly configured and can communicate with the Kubernetes cluster.
It displays information about the cluster's master and services, confirming that your connection is active and functional.
Prerequisites: Ensure config-server, postgres, redis are running
Resources: Verify cluster has sufficient CPU/memory
Network: Ensure ingress and DNS are properly configured
Logs: Check pod logs for errors: kubectl logs <pod-name> -n inji-verify
You can also refer to the file for deployment steps given in individual module repositories.
We welcome contributions from everyone!
Check to learn how you can contribute code to this application. If you have any questions or run into issues while trying out the application, feel free to post them in the — we’ll be happy to help you out.
Module-Specific Deployment (with eSignet)
Selected modules based on requirement
Certify + Verify: Issuance & verification focus
Module-Specific Deployment (without eSignet)
Selected modules based on requirement
Web Wallet + Mobile Wallet: Credential holding/presentation
Hybrid Deployment
Some modules on-premise, some on cloud
Countries with regulatory/data residency constraints, for example issuer to be on-prem while the inji wallet is deployed on cloud
Phased Rollout Deployment
Gradual deployment of modules/regions
Pilot projects or regional rollouts
Helm: Familiarity with Helm for managing Kubernetes manifests and deployments.
Database Management: Basic skills in managing PostgreSQL or similar databases, including initialization and schema setup.
Configuration Management: Ability to manage application configuration files, secrets, and certificates securely.
Monitoring and Logging: Understanding of logging and monitoring tools to observe system health and troubleshoot issues.
Security Best Practices: Awareness of secure credential handling, certificate management, and access control.
Scripting: Basic scripting skills (e.g., Bash, Python) for automation and operational tasks.
Familiarity with CI/CD Pipelines: Understanding of continuous integration and deployment processes is a plus.
Reverse Proxy
CDN/Cache management
Load balancing
Kubernetes (k8's) cluster is administered using the rke tools and kubectl commands.
We have two k8's clusters:
Observation cluster [Optional] - This cluster is part of the observation plane and assists with administrative tasks. By design, this is kept independent from the actual cluster as a good security practice and to ensure clear segregation of roles and responsibilities. As a best practice, this cluster or its services should be internal and should never be exposed to the external world.
Rancher is used for managing the Inji cluster.
Keycloak in this cluster is used to manage user access and rights for the observation plane.
It is recommended to configure log monitoring and network monitoring in this cluster during production deployment.
In case you have an internal container registry, then it should run here.
Inji cluster - This cluster runs all the Inji components and core infrastructure components like kafka, Postgres, minio, etc.
Inji Services are deployed in this cluster.
clone mosip-infra with tag : 1.2.0.2 (whichever is the latest version) inside mosip directory. git clone https://github.com/mosip/mosip-infra -b v1.2.0.2
Set below mentioned variables in bashrc and excute command source .bashrc
Note: Above mentioned environment variables will be used throughout the installation to move between one directory to other to run install scripts.
Wireguard Client - Refer to the Setup Wireguard Client on your PC section for the instructions.
Private interface: On the same internal network as all other nodes (e.g., local NAT network).
Public interface: Either a direct public IP or a firewall/NAT rule forwarding UDP port 51820 to this interface's IP address.
Install and start wireguard server using docker as given below:
sudo docker run -d \
--name=wireguard \
--cap-add=NET_ADMIN \
--cap-add=SYS_MODULE \
-e PUID=1000 \
-e PGID=1000 \
-e TZ=Asia/Calcutta \
-e PEERS=30 \
-p 51820:51820/udp \
-v /home/ubuntu/wireguard/config:/config \
-v /lib/modules:/lib/modules \
--sysctl="net.ipv4.conf.all.src_valid_mark=1" \
--restart unless-stopped \
ghcr.io/linuxserver/wireguardassign one of the PR for yourself and use the same from the PC to connect to the server.
create assigned.txt file to assign the keep track of peer files allocated and update everytime some peer is allocated to someone.
peer1 : peername
peer2 : xyzuse ls cmd to see the list of peers.
get inside your selected peer directory, and add mentioned changes in peer.conf:
cd peer1
nano peer1.conf
add peer.conf in your PC’s /etc/wireguard directory as wg0.conf.
start the wireguard client and check the status:
Setting up Kubernetes clusters:
Installing and configuring Kubernetes (using RKE, Rancher, etc.).
Ensuring cluster nodes are accessible and properly networked.
Configuring supporting infrastructure:
Installing Docker and required CLI tools (kubectl, helm, ansible, istioctl).
Setting up passwordless SSH access to all nodes.
Preparing configuration files (hosts.ini, values.yaml, etc.).
Deploying essential services:
Setting up NGINX for SSL termination, reverse proxy, and load balancing.
Configuring storage classes (e.g., NFS) for persistent storage.
Setting up monitoring, logging, and alerting tools (Prometheus, Grafana, Fluentd, etc.).
Establishing secure access:
Installing and configuring Wireguard VPN for secure cluster access.
Ensuring only authorized users can access the infrastructure.
Importing clusters into management tools (e.g., Rancher) for centralized administration.
Internal interface: On the same internal network as all other nodes, with internet access.
Wildcard SSL Certificate for the Inji K8s Cluster
A valid wildcard SSL certificate for the domain used to access the inji Kubernetes cluster.
This certificate must be stored inside the Nginx server VM for the inji cluster.
For example, a domain like *.sandbox.xyz.net could serve as the corresponding example.
Maps to: Private IP of Nginx server (Observation cluster)
Purpose: Administrative IAM tool (Keycloak) for Kubernetes administration.
sandbox.xyz.net
Maps to: Private IP of Nginx server (MOSIP cluster)
Purpose: Index page for links to MOSIP environment dashboards (not for production/UAT use).
api-internal.sandbox.xyz.net
Maps to: Private IP of Nginx server (MOSIP cluster)
Purpose: Internal APIs, accessible privately over Wireguard.
api.sandbox.xyz.net
Maps to: Public IP of Nginx server (MOSIP cluster)
Purpose: Publicly exposed APIs.
iam.sandbox.xyz.net
Maps to: Private IP of Nginx server (MOSIP cluster)
Purpose: OpenID Connect server (default: Keycloak) for service access, accessible over Wireguard.
postgres.sandbox.xyz.net
Maps to: Private IP of Nginx server (MOSIP cluster)
Purpose: Points to Postgres server, connect via port forwarding over Wireguard.
injiweb.sandbox.xyz.net
Maps to: Public IP of Nginx server (MOSIP cluster)
Purpose: Public access to Inji Web portal.
injicertify.sandbox.xyz.net
Maps to: Public IP of Nginx server (MOSIP cluster)
Purpose: Public access to Inji Certify portal.
injiverify.sandbox.xyz.net
Maps to: Public IP of Nginx server (MOSIP cluster)
Purpose: Public access to Inji Verify portal.
env-check-setup.yaml to check if cluster nodes are fine and doesn't have known issues in it.cd $K8_ROOT/rancher/on-prem
Create copy of hosts.ini.sample as hosts.ini and update the required details for MOSIP k8 cluster nodes.
cp hosts.ini.sample hosts.ini
Note:
Ensure you are inside
on-premdirectory as mentioned above.ansible_host : internal IP of nodes. eg. 100.10.20.56, 100.10.20.57 ...
ansible_user : user to be used for installation. In this ref-implementation we use Ubuntu user.
ansible_ssh_private_key_file : path to pem key for ssh to wireguard server. eg.
~/.ssh/nodes-ssh.pem
ansible-playbook -i hosts.ini env-check-setup.yaml
This ansible checks if localhost mapping ia already present in /etc/hosts file in all cluster nodes, if not it adds the same.
Setup passwordless ssh into the cluster nodes via pem keys. (Ignore if VM’s are accessible via pem’s).
Generate keys on your PC
ssh-keygen -t rsa
Copy the keys to remote rancher node VM’s:
ssh-copy-id <remote-user>@<remote-ip>
SSH into the node to check password-less SSH
ssh -i ~/.ssh/<your private key> <remote-user>@<remote-ip>
Rancher UI : (deployed in Observation K8 cluster)
Open ports and Install docker on Inji K8 Cluster node VM’s.
cd $K8_ROOT/mosip/on-prem
create copy of hosts.ini.sample as hosts.ini and update the required details for wireguard VM.
cp hosts.ini.sample hosts.ini
Update vpc_ip variable in ports.yaml with vpc CIDR ip to allow access only from machines inside same vpc.
Note:
CIDR Range will be shared by the Infra provider.
execute ports.yml to enable ports on VM level using ufw:
ansible-playbook -i hosts.ini ports.yaml
Disable swap in cluster nodes. (Ignore if swap is already disabled)
ansible-playbook -i hosts.ini swap.yaml
Caution: Always verify swap status with
swapon --showbefore running the playbook to avoid unnecessary operations.
execute docker.yml to install docker and add user to docker group:
ansible-playbook -i hosts.ini docker.yaml
Creating RKE Cluster Configuration file
rke config
Command will prompt for nodal details related to cluster, provide inputs w.r.t below mentioned points:
SSH Private Key Path :
Number of Hosts:
SSH Address of host :
SSH User of host :
Make all the nodes Worker host by default.
To create an HA cluster, specify more than one host with role Control Plane and etcd host.
Network Plugin Type : Continue with canal as default network plugin.
For rest for other configuration opt the required or default value.
As result of rke config command cluster.yml file will be generated inside same directory, update the below mentioned fields:
nano cluster.yml
Remove the default Ingress install
ingress:
provider: noneUpdate the name of the kubernetes cluster in cluster.yaml
For production deplopyments edit the cluster.yml, according to this .
Setup up the cluster:
Once cluster.yml is ready, you can bring up the kubernetes cluster using simple command.
This command assumes the cluster.yml file is in the same directory as where you are running the command.
rke up
The last line should read Finished building Kubernetes cluster successfully to indicate that your cluster is ready to use.
Copy the kubeconfig files
To access the cluster using kubeconfig file use any one of the below method:
cp $HOME/.kube/<cluster_name>_config $HOME/.kube/config
Alternatively
Test cluster access:
kubectl get nodes
Command will result in details of the nodes of the rancher cluster.
Save Your files
Save a copy of the following files in a secure location, they are needed to maintain, troubleshoot and upgrade your cluster.:
cluster.yml: The RKE cluster configuration file.
kube_config_cluster.yml: The for the cluster, this file contains credentials for full access to the cluster.
cluster.rkestate: The , this file contains credentials for full access to the cluster.
kubectl get svc -n istio-system
Note: Response should contain service names as mentioned below.
istio-ingressgateway: external facing istio service.
istio-ingressgateway-internal: internal facing istio service.
istiod: Istio daemon for replicating the changes to all envoy filters.
ansible_user : user to be used for installation, in this ref-impl we use Ubuntu user.
ansible_ssh_private_key_file : path to pem key for ssh to wireguard server. eg. ~/.ssh/wireguard-ssh.pem .
Make sure Kubeconfig file is set correctly to point to required mosip cluster.
The default challenge HTTP is changed to DNS challenge, as we require wildcard certificates.
Create a DNS record in your DNS service of type TXT with host _acme-challenge.sandbox.xyz.net, with the string prompted by the script.
Wait for a few minutes for the above entry to get into effect.
** Verify**: host -t TXT _acme-challenge.sandbox.mosip.net
Press enter in the certbot prompt to proceed.
Certificates are created in /etc/letsencrypt on your machine.
Certificates created are valid for 3 months only.
Wildcard SSL certificate renewal. This will increase the validity of the certificate for next 3 months.
SSL cert path
SSL key path
Cluster node ip's (comma seperated no whitespace)
Post installation check
sudo systemctl status nginx
Steps to uninstall nginx (incase it is required)
sudo apt purge nginx nginx-common
DNS mapping: Once nginx server is installed sucessfully, create DNS mapping for observation cluster related domains as mentioned in DNS requirement section.
Monitoring should be deployed which includes deployment of prometheus, grafana and alertmanager.
Create slack incoming webhook.
After setting slack incoming webhook update slack_api_url and slack_channel_name in alertmanager.yml.
cd $K8_ROOT/monitoring/alerting/
nano alertmanager.yml
Update:
Update Cluster_name in patch-cluster-name.yaml.
cd $K8_ROOT/monitoring/alerting/
nano patch-cluster-name.yaml
Update:
Create clusteroutput
kubectl apply -f clusteroutput-elasticsearch.yaml
Start clusterFlow
kubectl apply -f clusterflow-elasticsearch.yaml
Install elasticsearch, kibana and Istio addons\
set min_age in elasticsearch-ilm-script.sh and execute the same.
min_age : is the minimum no. of days for which indices will be stored in elasticsearch.
Inji provides set of Kibana Dashboards for checking logs and throughputs.
Brief description of these dashboards are as follows:
contains the logstash Index Pattern required by the rest of the dashboards.
contains a Search dashboard which shows only the error logs of the services, called
Import dashboards:
cd K8_ROOT/logging
./load_kibana_dashboards.sh ./dashboards <cluster-kube-config-file>
View dashboards
Note: Before running the Postgres install script, update the POSTGRES_HOST value in install.sh with the correct PostgreSQL host.
Redis Installation
Health Checks: Verifies all pods are running and healthy
All Inji Certify-related pods are in Running or Completed status.
Verified via kubectl get pods -n inji-certify
Services Registered and Reachable
Microservices register successfully with the config-server.
All services are listed and accessible within the cluster:kubectl get services -n inji-certify
Database Initialized Correctly
PostgreSQL tables and seed data are created as per init_values.yaml.
No database errors during initialization.
Ingress Configured Properly
Istio ingress rules are correctly applied.
Services are reachable externally through the configured gateway.
External Access Verified
Health endpoint responds successfully curl -k https://injicertify.sandbox.xyz.net/health
HTTP 200 response received.
Artifactory Installation
For installation instructions, refer to the artifactory installation guide.
Artifactory is used to store, manage, and distribute build artifacts (such as Docker images, Helm charts, binaries, and other deployment packages) required by the Inji stack and related services. Installing Artifactory ensures that all deployment dependencies are securely managed and easily accessible during automated deployments and upgrades.
Why install Artifactory?
Centralizes storage of deployment artifacts for consistency and reliability.
Enables version control and traceability of all build packages.
Facilitates automated CI/CD pipelines by providing a secure and scalable repository.
Supports integration with Kubernetes, Docker, and Helm for seamless deployments.
Redis Installation
Redis pod is running and healthy.
Verified via:kubectl get pods -n mimoto
Database Initialized Correctly
PostgreSQL tables and seed data are created as per values.yaml.
No database errors during initialization.
Partner Onboarder Installed and Functional
Partner Onboarder module installed without errors.
Reports are successfully generated and visible in S3 or NFS storage.
Correct S3 bucket configuration provided during installation.
Mimoto Installed Successfully
Database host and port are correctly configured in values.yaml.
SSL certificate handling works correctly (self-signed or public domain).
All Mimoto pods are running and healthy.
Onboarding New Issuer for VCI
certs/oidckeystore.p12 is correctly created with all required keys and aliases.
Issuer onboarding can be verified through logs or API calls.
Pods Running and Healthy
All Mimoto-related pods are in Running or Completed status.
Verified via kubectl get pods -n mimoto
Services Registered and Reachable
All microservices are listed and accessiblekubectl get services -n mimoto
External Access Verified
Health endpoint responds successfully curl -k https://<your-mimoto-domain>/health
HTTP 200 response received.
Note: Before running the minio install script, update the EXTERNAL_HOST value in install.sh with the correct minio host.
Note: Before running the Postgres install script, update the POSTGRES_HOST value in install.sh with the correct PostgreSQL host.
Health Checks: Verifies all pods are running and healthy
All Inji Verify pods are in Running or Completed status.
Verified via kubectl get pods -n inji-verify
Services Registered and Reachable
Microservices are registered with the config-server.
All services are listed and accessible within the cluster kubectl get services -n inji-verify
Database Initialized Correctly
PostgreSQL tables and seed data are created as per init_values.yaml.
No database errors during initialization.
Ingress Configured Properly
Istio ingress rules are correctly applied.
Services are reachable externally through the configured gateway.
External Access Verified
Health endpoint responds successfully curl -k https://injiverify.sandbox.xyz.net/health
HTTP 200 response received.
Service Management Functional
Ability to restart services using ./restart-all.sh.
Ability to delete services using ./delete-all.sh.
Full Stack Deployment (with eSignet)
Certify, Web Wallet, Verify, Mimoto
Countries using MOSIP eSignet for authentication
Full Stack Deployment (without eSignet / own Auth Server)
Certify, Web Wallet, Verify, Mimoto
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo add mosip https://mosip.github.io/mosip-helmansible-playbook -i hosts.ini docker.yamlsudo systemctl start wg-quick@wg0
sudo systemctl status wg-quick@wg0cd $K8_ROOT/nfscp hosts.ini.sample hosts.ini
kubectl config view ansible-playbook -i ./hosts.ini nfs-ports.yamlssh -i ~/.ssh/nfs-ssh.pem ubuntu@<internal ip of nfs server>
git clone https://github.com/mosip/k8s-infra -b v1.2.0.1cd /home/ubuntu/k8s-infra/nfs/
sudo ./install-nfs-server.sh
cd $K8_ROOT/nfs/ <!-- mosip or inji -->./install-nfs-client-provisioner.shkubectl -n nfs get deployment.apps/nfs-client-provisioner kubectl get storageclass
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
longhorn (default) driver.longhorn.io Delete Immediate true 57d
nfs-client cluster.local/nfs-client-provisioner Delete Immediate true 40s sudo apt update -y
sudo apt-get install software-properties-common -y
sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt-get update -y
sudo apt-get install python3.8 -y
sudo apt install letsencrypt -y
sudo apt install certbot python3-certbot-nginx -y nano hosts.ini[nginx]
node-nginx ansible_host=<internal ip> ansible_user=root ansible_ssh_private_key_file=<pvt .pem file> ansible-playbook -i hosts.ini mosip/on-prem/nginx/nginx_ports.yaml
cd $K8_ROOT/mosip/on-prem/nginx
sudo ./install.sh cd $K8_ROOT/utils/httpbin
./install.shcurl https://api.sandbox.xyz.net/httpbin/get?show_env=true
curl https://api-internal.sandbox.xyz.net/httpbin/get?show_env=true ingressNginx:
enabled: falsespec:
externalLabels:
cluster: <YOUR-CLUSTER-NAME-HERE>cd $K8_ROOT/monitoring/alerting/
./install.shkubectl apply -f - <<EOF
## The data here is of generic interest to modules in different namespaces hence this is marked as inji-stack-config.
## Replace your domain names here.
## api-host: External public access. (Typically required only in production rollouts).
## api-internal-host: Internal secure access over Wireguard.
## By default all domains and subdomains listed below point to api-internal-host. Modify this default behavior ONLY in production rollout as follows:
apiVersion: v1
kind: ConfigMap
metadata:
name: inji-stack-config
namespace: default
data:
inji-version: develop
installation-domain: sandbox.xyz.net
api-host: api.sandbox.xyz.net
iam-external-host: iam.sandbox.xyz.net
api-internal-host: api-internal.sandbox.xyz.net
injiweb-host: injiweb.sandbox.xyz.net
injiverify-host: injiverify.sandbox.xyz.net
injicertify-host: injicertify.sandbox.xyz.net
inji-postgres-host: postgres.sandbox.xyz.net
esignet-mock-host: esignet-mock.sandbox.xyz.net
mosipid-identity-esignet-host: esignet-mosipid.sandbox.xyz.net
esignet-insurance-host: esignet-insurance.sandbox.xyz.net
minio-host: minio.sandbox.mosip.net
EOFcd /path/to/config-server/
touch values.yaml touch values.yamlgitRepo:
uri: https://github.com/mosip/inji-config
version: release-0.8.x
## Folders within the base repo where properties may be found.
searchFolders: ""
private: false
## User name of user who has access to the private repo. Ignore for public repo
username: ""
token: ""
```
```
envVariables:
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_API_PUBLIC_HOST
valueFrom:
configMapKeyRef:
name: inji-stack-config
key: api-host
enabled: true
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_API_INTERNAL_HOST
valueFrom:
configMapKeyRef:
name: inji-stack-config
key: api-internal-host
enabled: true
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_PARTNER_CRYPTO_P12_PASSWORD
valueFrom:
secretKeyRef:
key: mosip-partner-crypto-p12-password
name: conf-secrets-various
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MPARTNER_DEFAULT_MOBILE_SECRET
valueFrom:
secretKeyRef:
key: mpartner_default_mobile_secret
name: keycloak-client-secrets
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_INTERNAL_URL
valueFrom:
configMapKeyRef:
name: keycloak-host
key: keycloak-internal-url
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_EXTERNAL_URL
valueFrom:
configMapKeyRef:
name: keycloak-host
key: keycloak-external-url
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_INTERNAL_HOST
valueFrom:
configMapKeyRef:
name: keycloak-host
key: keycloak-internal-host
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_KEYCLOAK_EXTERNAL_HOST
valueFrom:
configMapKeyRef:
name: keycloak-host
key: keycloak-external-host
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_DB_DBUSER_PASSWORD
valueFrom:
secretKeyRef:
name: db-common-secrets
key: db-dbuser-password
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_S3_ACCESSKEY
valueFrom:
configMapKeyRef:
name: s3
key: s3-user-key
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_S3_REGION
valueFrom:
configMapKeyRef:
name: s3
key: s3-region
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_S3_SECRETKEY
valueFrom:
secretKeyRef:
name: s3
key: s3-user-secret
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_ESIGNET_HOST
valueFrom:
configMapKeyRef:
key: esignet-host
name: inji-stack-config
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_ESIGNET_MOCK_HOST
valueFrom:
configMapKeyRef:
key: esignet-mock-host
name: inji-stack-config
enabled: true
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIPID_IDENTITY_ESIGNET_HOST
valueFrom:
configMapKeyRef:
key: mosipid-identity-esignet-host
name: inji-stack-config
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_ESIGNET_INSURANCE_HOST
valueFrom:
configMapKeyRef:
key: esignet-insurance-host
name: inji-stack-config
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_INJI_DATASHARE_HOST
valueFrom:
configMapKeyRef:
key: inji-datashare-host
name: inji-stack-config
enabled: false
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_INJIWEB_HOST
valueFrom:
configMapKeyRef:
key: injiweb-host
name: inji-stack-config
enabled: true
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_INJIVERIFY_HOST
valueFrom:
configMapKeyRef:
key: injiverify-host
name: inji-stack-config
enabled: true
- name: SPRING_CLOUD_CONFIG_SERVER_OVERRIDES_MOSIP_INJICERTIFY_HOST
valueFrom:
configMapKeyRef:
key: injicertify-host
name: inji-stack-config
enabled: true
```
* Create a file named `configserver.sh`:
```sh
touch configserver.sh#!/bin/bash
# Installs config-server
## Usage: ./install.sh [kubeconfig]
if [ $# -ge 1 ] ; then
export KUBECONFIG=$1
fi
NS=config-server
CHART_VERSION=12.0.1
read -p "Is conf-secrets module installed?(Y/n) " yn
if [ $yn = "Y" ]; then read -p "Is values.yaml for config-server chart set correctly as part of Pre-requisites?(Y/n) " yn; fi
if [ $yn = "Y" ]
then
echo Create $NS namespace
kubectl create ns $NS
# set commands for error handling.
set -e
set -o errexit ## set -e : exit the script if any statement returns a non-true return value
set -o nounset ## set -u : exit the script if you try to use an uninitialised variable
set -o errtrace # trace ERR through 'time command' and other functions
set -o pipefail # trace ERR through pipes
echo Istio label
kubectl label ns $NS istio-injection=enabled --overwrite
helm repo update
UTIL_URL=https://raw.githubusercontent.com/mosip/mosip-infra/master/deployment/v3/utils/copy_cm_func.sh
COPY_UTIL=./copy_cm_func.sh
DST_NS=config-server # DST_NS: Destination namespace
wget -q $UTIL_URL -O copy_cm_func.sh && chmod +x copy_cm_func.sh
echo Copy configmaps and secrets
$COPY_UTIL configmap inji-stack-config default $NS
if kubectl -n conf-secrets get secret conf-secrets-various >/dev/null 2>&1; then
$COPY_UTIL secret conf-secrets-various conf-secrets $NS
else
echo "Skipping copy, conf-secrets-various secret not found"
fi
if kubectl -n s3 get configmap s3 >/dev/null 2>&1 && kubectl -n s3 get secret s3 >/dev/null 2>&1; then
$COPY_UTIL configmap s3 s3 $NS
$COPY_UTIL secret s3 s3 $NS
else
echo "Skipping copy, s3 config or secret not found"
fi
echo Installing config-server
helm -n $NS install config-server mosip/config-server -f values.yaml --wait --version $CHART_VERSION
echo Installed Config-server.
else
echo Exiting the MOSIP installation. Please meet the pre-requisites and than start again.
kill -9 `ps --pid $$ -oppid=`; exit
fi chmod +x configserver.sh
./configserver.sh# On your local machine (connected to K8s cluster via kubectl)
git clone https://github.com/mosip/inji-certify.git
cd inji-certify/deploycd redis
./install.shcd ../db_scripts
# Update init_values.yaml with your database configuration, update the necessary parameters for your PostgreSQL database. Provide path or how to navigate to this yaml in cloned repo.
./init_db.shcd ../inji-certify
./install.shkubectl get pods -n inji-certifykubectl get services -n inji-certifycurl -k https://injicertify.sandbox.xyz.net/health# On your local machine (connected to K8s cluster via kubectl)
git clone https://github.com/mosip/mimoto.git
cd mimoto/deploycd deploy/redis
./install.shcd ../../db_scripts
./init_db.shcd ../partner-onboarder
./install.shcd ../deploy/mimoto
./install.shkubectl get pods -n mimotokubectl get services -n mimotocurl -k https://<your-mimoto-domain>/healthgit clone https://github.com/mosip/inji-web.git
cd inji-web/deploydefault,inji-default,standalonecd datashare
./install.sh
cd ..cd injiweb
./install.shkubectl get pods -n injiwebkubectl get services -n injiwebcurl -k https://injiweb.sandbox.xyz.net/healthgit clone https://github.com/mosip/inji-verify.git
cd inji-verify/deploycd ../db_scripts
# Update init_values.yaml with your database configuration, update the necessary parameters for your PostgreSQL database.
./init_db.sh
cd ../deploy./install-all.shkubectl get pods -n inji-verifykubectl get services -n inji-verifycurl -k https://injiverify.sandbox.xyz.net/health./delete-all.sh./restart-all.shNote: The basic Skill-sets mentioned below, in fact, expects you to know the following to be able to deploy it from scratch and that too on a bare metal servers (On-Premise). This should not get intimidating as in typical scenarios we expect the infrastructure to be deployed by an experienced 'System-Admin/DevOps'. However in case you want to evangelize Inji in your organization and want to have a hands-on with the deployment, this guide helps you with the steps and instructions to achieve this.
Note:
Ignored scenarios are not related to particular use cases and 34 scenarios are known issues can be tracked from INJICERT-681, INJICERT-1118, INJICERT-1176
Note: In case you already have VPN configured to access nodes privately please skip Wireguard installation and continue to use the same VPN.
Note: You can also refer to Wireguard Administrator's Guide for more on Wireguard configuration and management.
Note:
Remove [Cluster] complete section from copied hosts.ini file.
Add below mentioned details:
ansible_host : public IP of Wireguard Bastion server. eg. 100.10.20.56
ansible_user : user to be used for installation. In this ref-impl we use Ubuntu user.
ansible_ssh_private_key_file : path to pem key for ssh to wireguard server. eg. ~/.ssh/wireguard-ssh.pem
Note:
Permission of the pem files to access nodes should have 400 permission. sudo chmod 400 ~/.ssh/privkey.pem
These ports are only needed to be opened for sharing packets over UDP.
Take necessary measure on firewall level so that the Wireguard server can be reachable on 51820/udp.
Note:
Increase the number of peers above in case more than 30 wireguard client confs (-e PEERS=30) are needed.
Change the directory to be mounted to wireguard docker as per need. All your wireguard confs will be generated in the mounted directory (-v /home/ubuntu/wireguard/config:/config).
Note: Network Requirements
All the VM's should be able to communicate with each other.
Need stable Intra network connectivity between these VM's.
All the VM's should have stable internet connectivity for docker image download (in case of local setup ensure to have a locally accessible docker registry).
Note:
Output should show the cluster name to confirm you are pointing to right kubernetes cluster.
If not pointing to right K8 cluster change the kubeconfig to connect to right K8 cluster.
Enable firewall with required ports:
Note:
Script prompts for:
* NFS Server: NFS server ip for persistence.
* NFS Path : NFS path for storing the persisted data. eg. /srv/nfs/mosip/Note: You can find the inji-stack-cm.yaml file in the deployment scripts or configuration directory of the Inji stack repository, typically under the deploy or k8s folder. If it is not present, you can create it using the sample configmap YAML provided in this guide, and then update the domain names as per your environment before applying it to your Kubernetes cluster
Note : Ensure nelow mentioned services are listed in the output result of above command. You can even check Rancher incase deployed. 1. inji-certify 2. inji-softhsm
Note : Ensure below mentioned services are listed in the output result of above command. You can even check Rancher incase deployed. 1. inji-certify 2. inji-softhsm
Note:
If you are running the Onboarder in a separate INJI cluster, update the extraEnvVars section in values.yaml accordingly.




Countries using their own authentication servers
export INJI_ROOT=<location of mosip directory>
export K8_ROOT=$INJI_ROOT/k8s-infra
export INFRA_ROOT=$INJI_ROOT/mosip-infrahelm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update
kubectl create ns cattle-monitoring-system
helm -n cattle-monitoring-system install rancher-monitoring-crd mosip/rancher-monitoring-crdUpdate the allowed IP's to subnets CIDR ip . e.g. 10.10.20.0/23
Share the updated peer.conf with respective peer to connect to wireguard server from Personel PC.
MOSIP Error Logscontains a Search dashboard which show all logs of a particular service, called Inji Service Logs dashboard.
contains dashboards which show insights into Inji processes, like the number of UINs generated (total and per hr), the number of Biometric deduplications processed, number of packets uploaded etc, called Inji Insight dashboard.
contains dashboards which show how quickly different MOSIP Services are responding to different APIs, over time, called Response Time dashboard.
Is host (<node1-ip>) a Control Plane host (y/n)? [y]: y
Is host (<node1-ip>) a Worker host (y/n)? [n]: y
Is host (<node1-ip>) an etcd host (y/n)? [n]: y`cluster_name: sandbox-name`INFO[0000] Building Kubernetes cluster
INFO[0000] [dialer] Setup tunnel for host [10.0.0.1]
INFO[0000] [network] Deploying port listener containers
INFO[0000] [network] Pulling image [alpine:latest] on host [10.0.0.1]
...
INFO[0101] Finished building Kubernetes cluster successfullycp kube_config_cluster.yml $HOME/.kube/<cluster_name>_config
chmod 400 $HOME/.kube/<cluster_name>_config* `export KUBECONFIG="$HOME/.kube/<cluster_name>_config`global:
resolve_timeout: 5m
slack_api_url: <YOUR-SLACK-API-URL>
...
slack_configs:
- channel: '<YOUR-CHANNEL-HERE>'
send_resolved: truecd $K8_ROOT/logging
./intall.sh cd $K8_ROOT/logging
./elasticsearch-ilm-script.sh