Skip to main content

Infrastructure provisioning

Overview​

All shyware deployments share a common signing infrastructure layout. The Terraform modules live in ShywareLLC/community/infra/ (the community server repo — github.com/ShywareLLC/community). Per-deployment configuration is a thin terragrunt.hcl wrapper — no per-deployment Go or Terraform code required.

Module layout​

ShywareLLC/community/infra/
  signing/      — AWS KMS validator key + tally key + IAM Roles Anywhere trust anchor
  validator/    — Hetzner cloud server + Cloudflare tunnel (hostile-regime deployments)

Each deployment's deploy/ directory contains only the Terragrunt wrapper:

<deployment>/deploy/
  signing/
    terragrunt.hcl    — points to ShywareLLC/community/infra/signing; passes project/namespace inputs
  validator/
    terragrunt.hcl    — points to ShywareLLC/community/infra/validator; reads signing outputs automatically

Shared remote state​

# terragrunt.hcl (repo root)
remote_state {
  backend = "s3"
  config = {
    bucket         = "shyware-tfstate"
    key            = "${path_relative_to_include()}/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "shyware-tfstate-locks"
    encrypt        = true
  }
}

Provisioning a deployment​

Every deployment follows the same two-step sequence:

Step 1 — signing​

cd <deployment>/deploy/signing
AWS_ACCOUNT_ID=<account> terragrunt apply

This creates:

  • AWS KMS ECC_NIST_P256 validator signing key
  • AWS KMS ECC_NIST_P256 tally signing key
  • ACM Private CA root certificate
  • IAM Roles Anywhere trust anchor + profile + IAM role
  • CloudWatch metric alarms for signing failures

Outputs: kms_validator_key_id, kms_tally_key_id, role_arn, trust_anchor_arn, profile_arn

Copy tally_key_id and trust_anchor_arn into shyconfig.json (or inject via SHYWARE_* environment variables).

Step 2 — validator (hostile-regime deployments only)​

cd <deployment>/deploy/validator
HETZNER_NETWORK_ID=<id> HETZNER_FIREWALL_ID=<id> HETZNER_SSH_PUBLIC_KEY=<key> \
CLOUDFLARE_TUNNEL_TOKEN=<token> CLOUDFLARE_WARP_TOKEN=<token> \
terragrunt apply

Signing outputs are threaded in automatically via the dependency block — no manual ARN copying required.

Deployment signing configs​

Contract versionPostureNotes
shyvoting-v1recoverableCivic voting — domestic deployment
shyvoting-v1coercion_resistantHostile-regime — validator in neutral jurisdiction
shyshares-v1recoverableDAO or consortium governance
shywire-v1recoverableAnonymous value transfer
shycontracts-v1recoverableAnonymous smart contracts

IAM Roles Anywhere (no static keys on validators)​

The signing module provisions IAM Roles Anywhere as the credential chain for validators:

  1. ACM Private CA issues a root certificate (trust anchor)
  2. The validator obtains an X.509 certificate from the PCA at boot
  3. The certificate authenticates to IAM Roles Anywhere → 1-hour STS session token
  4. The STS token authorizes KMS Sign calls for the validator and tally keys

No static AWS access keys are placed on validator disks. Key rotation is managed by KMS. The IAM role policy restricts kms:Sign to the specific key ARNs provisioned by the module.

Starting the node​

After provisioning, start the ABCI node with the unified binary:

shyware-abci \
  --config  shyconfig.json \
  --db-path /opt/<deployment>/data \
  --addr    :26658

The binary reads all configuration — identity provider, governance keys, signing key IDs, deployment posture — from shyconfig.json. REDACTED values are injected via SHYWARE_* environment variables at runtime.

See Go SDK — protocol/config for the config.Load() and config.Manifest reference.