On-Premises Installation
This page describes what to expect when deploying The Vault on your own infrastructure. The detailed, command-by-command installation runbook is delivered as part of the on-premises onboarding package — this page covers the deployment shape, prerequisites, and what your team will be responsible for.
Estimated time to a fully operational deployment: 2–4 hours of hands-on work for an experienced platform engineer with all prerequisites prepared in advance, plus the time required to provision the underlying infrastructure.
What You Get
When you contract for an on-premises deployment, The Vault team provides:
| Item | Purpose |
|---|---|
| Container registry credentials | Access to the OCI registry hosting all platform images and deployment charts |
| Bootstrap deployment package | Templated configuration for every component, including reference values and a guided installation script |
vault-ctl operator CLI | Management tool for bootstrapping the first organization, rotating credentials, and running operational checks |
| Step-by-step installation runbook | The detailed command-by-command procedure for each phase of deployment |
| Onboarding sessions | Dedicated technical onboarding with a Vault implementation engineer |
| Ongoing support | Upgrade guidance, security advisories, and incident support during the contract term |
The runbook itself is delivered alongside the onboarding package and is not published in this public documentation site, since it contains environment-specific operational procedures and infrastructure-shape details that are not required to evaluate the platform.
Prerequisites
Before the installation engagement begins, your team prepares the following infrastructure. The full list and recommended sizing is in Infrastructure Requirements.
Compute platform
A managed or self-hosted Kubernetes cluster (validated on AWS EKS, GCP GKE, Azure AKS, and bare-metal kubeadm/Rancher/OpenShift). Production deployments use at least three worker nodes for high availability.
Data services
| Service | Purpose |
|---|---|
| Managed PostgreSQL (per service) | Stores wallets, transactions, policies, identity, and encrypted key share metadata |
| Managed Redis | Caching for the policy engine |
| Message broker | Event-driven messaging between platform services |
| Object storage | Encrypted backup destination |
These can be your existing managed services (e.g., RDS, Cloud SQL, ElastiCache, MemoryStore) or deployed alongside the platform in your cluster.
Cryptographic services
| Service | Purpose |
|---|---|
| KMS (AWS KMS, GCP Cloud KMS, or HashiCorp Vault) | Wraps server signer key material at rest |
| Public TLS certificate | External TLS for the API and dashboard |
| Internal CA | Mutual TLS between platform services (issued automatically by the deployment, or supplied) |
Networking
| Item | Notes |
|---|---|
| Ingress controller | Any standard Kubernetes ingress controller is supported |
| External DNS | A domain that resolves to your ingress, e.g., vault.yourdomain.com |
| Outbound connectivity | Required for blockchain RPC nodes and (optionally) push notifications to mobile signers |
Mobile devices
Two or more iOS 15.5+ or Android 10+ (API 29) devices with hardware-backed secure elements. See Mobile App Setup.
Deployment Phases
The actual deployment proceeds in four phases. The runbook in the onboarding package contains the exact procedure for each step; this page describes only what is happening conceptually so your team can plan around the engagement.
Phase 1 — Prepare
- Provision Kubernetes, databases, KMS, DNS, and TLS certificates
- Receive and verify your registry credentials and bootstrap package
- Populate environment-specific configuration: domain, KMS keys, database endpoints, ingress class
- Provision long-lived secrets (database passwords, signing keys, registry credentials)
Phase 2 — Deploy
- Apply the bootstrap configuration, which deploys the platform’s components in dependency order:
- Identity and authentication layer
- Identity-Aware Proxy (the API gateway)
- Messaging and supporting infrastructure
- Application services (wallets, policy, users, notifications, events)
- MPC layer (signing coordinator and server signers)
- Web dashboard
- Wait for all services to report ready and pass internal health checks
- Verify ingress, mTLS, and certificate issuance
Phase 3 — Bootstrap
- Use the operator CLI to register your first organization (Profile)
- Invite the first Admin user via email
- Verify identity workflows, MFA enrollment, and dashboard access
- Confirm that the platform, identity, and approval flows are wired correctly
Phase 4 — Verify
- Enroll the first mobile signer devices
- Run a Distributed Key Generation ceremony to create the first MPC master key
- Create a test wallet and execute a small test transaction to confirm end-to-end signing
- Connect monitoring dashboards and alerting endpoints
- Hand over to your operations team
Air-Gapped and Restricted Network Deployments
The Vault supports fully air-gapped deployments. In this model:
- Container images and deployment charts are delivered as offline archives
- All images are mirrored to your internal registry before the deployment begins
- Configuration is updated to point exclusively at your internal registry
- No outbound connectivity is required from the cluster except for blockchain RPC nodes (which can themselves be self-hosted within your network)
- Mobile signers either connect over your VPN, or you operate without push notifications and use polling-based delivery
The onboarding package includes a checklist and procedure specifically for air-gapped environments.
Operational Handover
After installation, your operations team is responsible for:
- Day-to-day platform health and incident response
- Database and configuration backups
- Periodic upgrades to new platform releases
- Certificate rotation (for both the internal CA and public TLS certificate)
- KMS key lifecycle management
- Mobile signer device lifecycle (enrollment, revocation, replacement)
See Operations for what’s covered. Detailed operational runbooks are delivered with the onboarding package and updated alongside each platform release.
What’s Next
| If you want to… | See |
|---|---|
| Understand the deployment model and key custody implications | Deployment Sovereignty |
| Plan infrastructure sizing | Infrastructure Requirements |
| Onboard the first users via the dashboard | SaaS Onboarding (the in-platform steps are identical) |
| Set up mobile signers | Mobile App Setup |
To begin the on-premises installation engagement, contact your implementation engineer.