# About ginkgo.tlog.mullvad.net

This document describes configuration and operational aspects of Mullvad
VPN's stable Sigsum log with base URL https://ginkgo.tlog.mullvad.net/.

## Announcements

Non-trivial changes are announced on the mailing list at
https://groups.google.com/g/mullvad-sigsum-log-operations.

## Interoperability

ginkgo.tlog.mullvad.net implements version 1 of the following specifications:

- https://git.glasklar.is/sigsum/project/documentation/-/blob/main/log.md
- https://c2sp.org/tlog-cosignature
- https://c2sp.org/tlog-witness

## Availability

Any plans to discontinue witness.mullvad.net or the version 1 specifications
that it complies with will be announced at least one year in advance.

Operational issues are tended to during regular working hours. This means
weekdays between 08:00 and 17:00 CET/CEST, unless during public holidays in
Sweden.

Planned maintenance is announced at least 24h in advance. Short disturbances
like server reboots, service restarts, and similar are typically not announced
in advance. Other noteworthy events are announced as soon as possible.

Report operational issues at sigsum-logs@mullvad.net.

## Operations

- Hardware: Dedicated servers (AMD Ryzen 9 9950X 16-Core Processor with 186 GiB RAM)
- System software:
  - Hardened Ubuntu 22.04 (Jammy Jellyfish) LTS.
  - Automatic security updates are enabled, checking twice a day.
  - System time is synchronized with ntp.netnod.se and backup NTP servers from
    our provider, using systemd-timesyncd.
  - Recursive DNS resolvers from Quad9 and Cloudflare.
- Log software: log-go, trillian and sigsum-agent.
- Key management: signing key is kept in a YubiHSM2.
- Rate limit: 288 entries per 24h for each domain suffix.
- Physical access: Hosting provider (31173) and relevant employees at Mullvad VPN (Sweden)
- Remote access: Relevant employees at Mullvad VPN (Sweden) — SSH keys only, no password.
- Service redundancy: Yes.
  - On the service level, a secondary node running in a separate
    data center can be promoted to be the primary node. This is a manual
    process requiring physical access to a certain safe and data center.
- Key backup: Yes.

## How to request a custom rate limit

Send an email to the non-public inbox: sigsum-logs@mullvad.net

Specify:

- A brief motivation
- The requested rate limit
- The domain to configure this for

Expect a response within five working days.

## How to request configuration of a witness

Send an email to the non-public inbox: sigsum-logs@mullvad.net

Specify:

- The witness' verification key
  - The key name should be on the form of a schema-less URL
- Some "proof" that you're authorized to use the verification-key name
  - E.g., serve the verification key under a page for the same domain
- A witness URL to use for add-checkpoint requests
- Contact information for someone responsible for the witness' operations

Expect a response within three working days.

## Configuration for trust policies

In Sigsum policy-file format:

  log f00c159663d09bbda6131ee1816863b6adcacfe80b0b288000b11aba8fe38314 https://ginkgo.tlog.mullvad.net/

## Configuration for witnesses

- Verification key: sigsum.org/v1/tree/c03f05182be9341e33b9edd5f3f8675b08332164640203e743f4285359cace47+e8a1c774+AfAMFZZj0Ju9phMe4YFoY7atys/oCwsogACxGrqP44MU
- Bastion (optional): bastion-ginkgo.tlog.mullvad.net:443
- Expected rate: cosignatures are collected every 10s

(The vkey name is the same as the log's origin line.)