Skip to content

Important

For the production environment, a separate X-Road Security Server must be deployed on separate infrastructure (physical or virtual), with its own IP address and DNS name, different from those of the test environment.

Please do not use the test environment's Security Server, or its IP address or DNS name, for production. The Security Servers of the test and production environments, and their corresponding network identifiers, must be kept separate.

Alongside the transition to the production environment, the test infrastructure must be maintained and continue to operate for testing purposes.

Differences between production (AM) and test (ISAADemo)

ADEL has two environments: AM (production) and ISAADemo (test). Most guides in this knowledge base are written for both, and the steps are the same. This page collects everything that differs, so you can check it before moving from test to production.

The environment identifier is case sensitive

Use exactly AM or ISAADemo. The identifier must match the environment of your Security Server, and it is the first part of every X-Road identifier (for example AM/GOV/53204255/ADEL-ONBOARDING).

At a glance

Area Test (ISAADemo) Production (AM)
Data No real data Real data, including personal data
Joining Request access from ADEL Accession agreement signed in the ADEL self-service environment, plus the other onboarding steps
Service Level Agreement N/A Accession agreement
Certificates Test CA ADEL CA
Timestamping service Test TSA ADEL TSA
Central servers cs1.demo.x-road.isaa.cloud cs1.adel.gov.am, cs2.adel.gov.am, cs3.adel.gov.am
Package repository Default settings ADEL production repository
Data service usage agreement Not required Mandatory
Connectivity test service ISAADemo/GOV/demo-provider/TEST/XROAD-TEST AM/GOV/53204255/ADEL-ONBOARDING/connectivityCheck

Joining and agreements

  • Test: contact ADEL at adel@isaa.am to receive the test configuration anchor and member code. No Service Level Agreement applies.
  • Production: you must sign the accession agreement. Production onboarding also involves membership agreements, SLAs, formal compliance review and production certificates.
  • A single Security Server is enough for the test instance. High-availability clustering is not required there.
  • The obligations of an ADEL member apply through the accession agreement. This includes the information security confirmation letter that must be submitted when joining.
  • The configuration anchor and member code are environment-specific. Request them separately for each environment.

See: Joining ADEL, Sign the accession agreement, ADEL member obligations, ADEL environments.

Network addresses

Type Test (ISAADemo) Production (AM)
Central server cs1.demo.x-road.isaa.cloud cs1.adel.gov.am (91.221.228.94)
cs2.adel.gov.am (91.221.228.93)
cs3.adel.gov.am (91.221.228.92)
Management services Security Server mss.demo.x-road.isaa.cloud (63.184.54.254) mss.adel.gov.am (91.221.228.93)
Monitoring Security Server metrics-ss.demo.x-road.isaa.cloud monitoring.adel.gov.am

The firewall rules are the same in both environments (ports 5500 and 5577 for partners and monitoring, 4001, 80 and 443 towards the central server). Only the addresses differ.

See: ADEL IPs for whitelisting, Enable monitoring access.

Security Server installation

  • Ansible (VM): for production only, edit ansible/vars_files/remote_repo.yml to point to the ADEL production repository (https://registry.del.am/repository). For the test instance, leave the default repository settings as they are.
  • Helm (Kubernetes): the example values.yaml uses the ADEL registry (docker.registry.del.am) and the -am image tags.

See: Virtual Machine deployment using Ansible, Kubernetes deployment using Helm Chart.

Certificates and trust services

Test (ISAADemo) Production (AM)
Certification service ADEL Test ADEL
Certification Service in the Security Server Test CA ADEL CA
Timestamping service Test TSA ADEL TSA

The Configuration Guide uses the test setup (Test CA and Test TSA) in its screenshots. The steps are the same in production, but you select the ADEL CA and TSA services and use production certificates.

Data services

  • Data service usage agreement: mandatory in production, before access is granted to another member (Article 19, Paragraph 2 of the RA Law on Public Information). It is not required in the test environment. See Conclusion of an agreement for the use of data services.
  • Access rights: in both environments the data service provider grants access to your subsystem. In production this follows the signed agreement.
  • Identifiers in examples: the guides use TEST/GOV/1234/... as a placeholder instance in the REST publishing guide. Replace it with ISAADemo or AM.
  • Provider identifiers: for some provider services the member class, member code and subsystem code differ between environments. For example, the SRC CitizenBankIncome guide uses ISAADemo/GOV/SRC/DECLARATION in test and AM/GOV/49797259/DECLARATION in production.

Testing connectivity

ADEL operates a test provider in each environment. Contact ADEL support with your subsystem identifier to get access before calling it.

Field Test (ISAADemo) Production (AM)
Instance ISAADemo AM
Member class GOV GOV
Member name demo-provider ISA
Member code demo-provider 53204255
Subsystem code TEST ADEL-ONBOARDING
Service code XROAD-TEST connectivityCheck
Endpoint hello hello

See: REST requests for testing.

Security requirements

Data and personal data

  • Test: no real data is used. Sample data (for example sample PSNs for the SRC service) is provided on request.
  • Production: real data is used. Query only data for which you have a legitimate purpose and a basis in the data service usage agreement. Do not use sample values from the guides, and do not write personal data to application logs unless necessary.