Top-level domain name registry service on Google Cloud Platform
Find a file
nickfelt f2c6021db0 Split FlowReporter logging into two lines for robustness
This prevents a possible failure mode of the logging where the logged
EPP input XML is very large (which can happen e.g. for domain creates
with large SMD values).  In those cases, the XML might cause the overall
JSON string to be too large to fit within a single log entry [1], in which
case it gets split over multiple lines and breaks automatic parsing.

This mitigates that case by logging the EPP input (raw and base64-encoded)
in a separate log statement so that the more compact metadata (like clientId)
and derived values (like ICANN reporting field) will still be in an intact
JSON string even in that case, and can still be readily parsed.  It's okay
if the actual EPP XML is harder to parse, since once we're logging the right
metadata fields we shouldn't need to automatically parse the EPP XML in any
normal cases.

[1] I haven't found this exact limit or splitting algorithm, or whether it's
a property of java logging or GAE log ingestion.  The GAE logs page does note
that a single application log entry (within a request, which can have up to
1000 such entries) maxes out at 8KB, so that might be it:
https://cloud.google.com/appengine/docs/standard/java/logs/#writing_application_logs

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=153771335
2017-04-26 10:50:13 -04:00
docs Copyedit the TLD security restrictions doc 2017-04-10 13:52:18 -04:00
java Split FlowReporter logging into two lines for robustness 2017-04-26 10:50:13 -04:00
javatests/google/registry Split FlowReporter logging into two lines for robustness 2017-04-26 10:50:13 -04:00
python Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
scripts Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
third_party/java Migrated README.google metadata into METADATA files 2017-03-21 15:38:00 -04:00
.gitignore Eclipse file generation script 2016-03-09 12:26:47 -08:00
AUTHORS Change all references to Domain Registry to Nomulus 2016-10-14 16:58:07 -04:00
CONTRIBUTING.md Add Google Java Style Guide info and link to CONTRIBUTING.md 2016-11-15 11:01:16 -05:00
CONTRIBUTORS Update create logic to ignore signed marks unless in sunrise 2016-12-06 11:52:46 -05:00
LICENSE Rename LICENSE.txt to LICENSE 2016-07-13 15:26:51 -04:00
README.md Make clearer which part of the invoicing pipeline we don't provide 2016-10-24 11:57:00 -04:00
WORKSPACE Restructure Maven dependencies in build 2017-01-09 11:59:04 -05:00

Nomulus

Overview

Nomulus is an open source, scalable, cloud-based service for operating top-level domains (TLDs). It is the authoritative source for the TLDs that it runs, meaning that it is responsible for tracking domain name ownership and handling registrations, renewals, availability checks, and WHOIS requests. End-user registrants (i.e. people or companies that want to register a domain name) use an intermediate domain name registrar acting on their behalf to interact with the registry.

Nomulus runs on Google App Engine and is written primarily in Java. It is the software that Google Registry uses to operate TLDs such as .GOOGLE, .HOW, .SOY, and .みんな. It can run any number of TLDs in a single shared registry system using horizontal scaling. Its source code is publicly available in this repository under the Apache 2.0 free and open source license.

Getting started

The following resources provide information on getting the code and setting up a running system:

If you are thinking about running a production registry service using our platform, please drop by the user group and introduce yourself and your use case. To report issues or make contributions, use GitHub issues and pull requests.

Capabilities

Nomulus has the following capabilities:

  • Extensible Provisioning Protocol (EPP): An XML protocol that is the standard format for communication between registrars and registries. It includes operations for registering, renewing, checking, updating, and transferring domain names.
  • DNS interface: The registry provides a pluggable interface that can be implemented to handle different DNS providers. It includes a sample implementation using Google Cloud DNS as well as an RFC 2136 compliant implementation that works with BIND.
  • WHOIS: A text-based protocol that returns ownership and contact information on registered domain names.
  • Registration Data Access Protocol (RDAP): A JSON API that returns structured, machine-readable information about domain name ownership. It is essentially a newer version of WHOIS.
  • Registry Data Escrow (RDE): A daily export of all ownership information for a TLD to a third party escrow provider to allow take-over by another registry operator in the event of serious failure. This is required by ICANN for all new gTLDs.
  • Premium pricing: Communicates prices for premium domain names (i.e. those that are highly desirable) and supports configurable premium registration and renewal prices. An extensible interface allows fully programmatic pricing.
  • Billing history: A full history of all billable events is recorded, suitable for ingestion into an invoicing system.
  • Registration periods: Qualified Launch Partner, Sunrise, Landrush, Claims, and General Availability periods of the standard gTLD lifecycle are all supported.
  • Brand protection for trademark holders (via TMCH): Allows rights-holders to protect their brands by blocking registration of domains using their trademark. This is required by ICANN for all new gTLDs.
  • Registrar support console: A self-service web console that registrars can use to manage their accounts in the registry system.
  • Reporting: Support for required external reporting (such as ICANN monthly registry reports, CZDS, Billing and Registration Activity) as well as internal reporting using BigQuery.
  • Administrative tool: Performs the full range of administrative tasks needed to manage a running registry system, including creating and configuring new TLDs.

Known issues

Registry operators interested in deploying Nomulus will likely require some additional components that are not provided out of the box.

Core dependencies

  • A DNS system. An interface for DNS operations is provided so you can write an implementation for your chosen provider, along with a sample implementation that uses Google Cloud DNS. If you are using Google Cloud DNS you may need to understand its capabilities and provide your own multi-AS solution.
  • A proxy to forward traffic on EPP and WHOIS ports to App Engine via HTTPS, since App Engine Standard only serves HTTP/S traffic. The proxy must support IPv4 and IPv6 access to comply with ICANN's requirements for gTLDs.

Additional functionality

  • A way to invoice registrars for domain name registrations and accept payments. Nomulus records the information required to generate invoices in billing events.
  • Fully automated reporting to meet ICANN's requirements for gTLDs. Nomulus includes substantial reporting functionality but some additional work will be required by the operator in this area.
  • A secure method for storing cryptographic keys. A keyring interface is provided for plugging in your own implementation (see configuration doc for details).
  • System status and uptime monitoring.

Outside references

  • Donuts Registry has helped review the code and provided valuable feedback
  • CoCCa and FRED are other open-source registry platforms in use by many TLDs
  • We are not aware of any fully open source domain registrar projects, but open source EPP Toolkits (not yet tested with Nomulus; may require integration work) include:
  • Some Open Source DNS Projects that may be useful, but which we have not tested: