# Access Node Instantiation and Compliance Guide # 1. Registration validation: DOME The first step in the setup process is to confirm that our company is registered in DOME and therefore we have a LEAR Credential Employee with Onboarding permissions available so that we can issue our credentials. If you are not registered or there is any problem with the credential’s permissions, consult this guide: [Onboarding Guide](https://knowledgebase.dome-marketplace-dev2.org/books/dome-credential-issuer-user-guide) # 2. Issuance Validation: LEAR Credential Machine The second step is to validate that we currently have a LEAR Credential Machine at our disposal. To do this, we must confirm that we have access to the[ Wallet](https://wallet.dome-marketplace-sbx.org/) and see if our credential has been downloaded. If you do not have access or do not have the required credentials, please review the[ credential issuance guide](https://knowledgebase.dome-marketplace-dev2.org/books/dome-credential-issuer-user-guide/chapter/credential-issuance) . Once we have our issued credentials, we will need to consult the next 3 points: - Private key > This is the key generated during the LEAR Credential Machine issuance process . It is important to save it, as we will need it later. Image when we issued a new LEAR Credential Machine ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-wggxscby.png) - DID key > Auto-generated key at the time of creation that identifies the machine. After downloaded your credential, you can view your info ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-abzmlkfo.png) - LEAR Credential > Auto-generated token that identifies your credential. You could find it at the bottom of your machine info. ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-aazxi9te.png) # 3. Data Validation: DLT Once we have the issued credential, we need to generate our machine's addresses using this tool: [Dome Access Node Keys Generator.](https://dome-marketplace.github.io/dome-crypto-generator/) To do that, we need our machine's DID key, obtained previously. The generated addresses will be as follows: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-py4in7qv.png) # 4. AN Configuration: Secrets Check this guide if you will work with secrets: [Github sealed secrets guide](https://github.com/DOME-Marketplace/dome-gitops/blob/b2e285a1073e08214e3206374053d3b695f695f4/doc/application_owners/INTEGRATION.md#add-secrets). # 5. AN Configuration: Chart.yaml This is how your chart.yaml should look. All necessary dependencies are included in the AN configuration. Check the last version [here](https://github.com/DOME-Marketplace/access-node/releases):

apiVersion: v2 name: access-node description: Chart holder for ArgoCD type: application version: 0.7.31 appVersion: 0.1.0 dependencies: \- name: access-node condition: access-node.enabled repository: https://dome-marketplace.github.io/access-node version: <check the last version>

# 6. AN Configuration: Values.yaml First, we need to consider whether we've decided to work with secrets (remember rename the file to values.yaml), or not, as the file format may vary slightly. [Values with secrets.yaml](https://drive.google.com/file/d/1vcZif-q4-NxlM_gW60W3ukkkaD5kPjVo/view?usp=sharing) [Values without secrets.yaml](https://drive.google.com/file/d/1R7P-NYs2N1cM-_0OSaOuWLa81uRDYVKP/view?usp=sharing) First of all, we will check that the file header starts as shown in the image: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-bn4yuqws.png) Now let’s configure all the blocks. - Ingress Modify the ingress hots: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-gow23sva.png) For example this is our domain: desmos.dome-marketplace-lcl.org - App The next thing to check is that we have specified your DID key in the following field: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-xryrpoqg.png) Next, we will need to review the configured domains: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-uv34nn6s.png) We will need to configure your protocol (in this case it was http but usually it would be https) and the domain of our machine, the URL with which it will be identified. The next step is to configure the private key, which, if we are working with secrets, will look like this: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-gqx83uqp.png) Or without secrets: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-6qo49usm.png) - DB The next step will be to configure our databases. ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-xoilt1xe.png) Here we need to configure our database host; this example uses an embedded database. We'll also need to specify our database details and whether or not we're using secrets. ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-mgp3z7f6.png) As you can see, without secrets, we will need to specify our database password and disable secrets. - DLT-adapter The next block is the DLT block; here we will need to configure the data obtained with the dome key generator: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-6y32th5i.png) In case of working without secrets: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-oyha8cmm.png) - Postgresql For the configuration of our Postgres, we must take into account the configuration of the secrets. ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-f80znzri.png) And for the case of no secrets: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-t9tq943e.png) - Scorpio For the Scorpio configuration: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-f2xcc1ig.png) And for the configuration without secrets, we would only have to configure the password as shown in the image: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-3kp7nag9.png) - **Postgis ** The same procedure applies to secrets;. ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-ymtjyncz.png) And without secrets: ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-y4cn0u0n.png) This would be all the configuration to take into account to prepare our AN to be able to perform the synchronization tests. Logically, there are more blocks in the file that we haven't mentioned, but we suggest not editing them without having the necessary knowledge. # 7. Registering the node in the Trusted Lists In order for your AN node to communicate and connect with ours, it must be registered on the following two lists. #### Trusted Access node list [Trusted Access Node list file](https://github.com/DOME-Marketplace/trust-framework/blob/main/sbx/trusted_access_nodes_list.yaml) The format to follow is as follows:

\- name: <your company name> dlt\_address: <dlt\_address generated [above](https://docs.google.com/document/d/1JHphRZdbzM_wa8BBXB9YYF1vQDkkgfgWrzbB3pq6kcM/edit?tab=t.0#heading=h.vr3rlgmu0p3x)>

#### Trusted Services list [Trusted services list file](https://github.com/DOME-Marketplace/trust-framework/blob/main/sbx/trusted_services_list.yaml) The format to follow is as follows:

- clientId : <"did:key of your machine"> redirectUris : \[\] scopes : \[\] clientAuthenticationMethods: \["client\_secret\_jwt"\] authorizationGrantTypes: \["client\_credentials"\] postLogoutRedirectUris : \[\] requireAuthorizationConsent: false requireProofKey: false jwkSetUrl: " https://verifier.dome-marketplace-sbx.org/oidc/did/did:key:<did key of our machine>" tokenEndpointAuthenticationSigningAlgorithm: "ES256"

# 8. AN Synchronization Tests These are the steps that will be taken before the tests: 8.1. Backup before testing Perform a dump backup of the Scorpio data so we can restore it afterwards and delete the data of your DB. Remember to put it out of your docker or it will disappear if you restart your AN. 8.2. Configuration for testing Add the externalAccessNodesUrls configuration inside the APP block as shown on the image below, which should be adapted for these tests. (It will be reconfigured later to point to the correct location.)

externalAccessNodesUrls: enableCustomUrls: true customUrls: “https://desmos.dome-marketplace-lcl.org”

How it should looks ![](https://knowledgebase.dome-marketplace.eu/uploads/images/gallery/2026-02/embedded-image-4mzxv1ad.png) 8.3. Review the values configuration and Trusted Lists registry Verify that you complete all the steps above and your machine is correctly registered in the Trusted lists [Trusted Lists github](https://github.com/DOME-Marketplace/trust-framework/tree/main/sbx) 8.4. Install AN After doing the previous steps, be sure that you installed your AN correctly. I'm leaving these commands here in case they're helpful. Remember that you need to throw these commands inside your values.yaml directory.

helm dependency build helm install myaccessnode . -f values.yaml

8.5. Desmos running without errors

Confirm that your desmos pod is working correctly. You could check it with kubectl logs desmos-648bdbc988-pl2ft -n <your-namespace> -c desmos Tests to Perform We will perform two tests: 1. Synchronization with the blockchain 2. P2P verification We will create a temporary entity, one on your node and another on ours, and see if it synchronizes via the blockchain. We can do it using Postman or using the curl command by postforwarding to Scorpio:

kubectl port-forward svc/scorpio 9090:9090 -n marketplace

Or if we have access to the bae marketplace, from there; For example, this is our configured site:[ Bae marketplace local](https://dome-marketplace-lcl.org/dashboard)

curl --location 'http://localhost:9090/ngsi-ld/v1/entities/?type=catalog' \\ --header 'Content-Type: application/json' \\ --data '{ "id": "urn:catalog:MyDummyTest", "type": "catalog", "version": "2.5", "lastUpdate": "2024-07-09T12:00:00Z", "lifecycleStatus": "Launched" }'

And we will validate that it has been created correctly using curl

curl --location 'http://localhost:9090/ngsi-ld/v1/entities/urn:catalog:MyDummyTest'