0. Introduction

Most of the code of the nodes which are running is in /services folder with verifier, issuer, centre and wallet-cli.
The chaincode (smart contract) is in /chaincode/ssi-contract/index.js and its interface is in bash /scripts/ff-contract-interface.json
Fabric Binaries are in fabric-samples/bin
Also /crypto folder is auto generated by firefly.

To Dos:

• Both wallet-cli and issuer needs to be updated with PQC.
• Accumulator instead of current chain lookup for access status
• Fixing log transfer
• Front end for all 4 services

1. FireFly Stack Setup

1.1 — Install base tools

sudo apt update && sudo apt upgrade -y
sudo apt install -y git curl wget jq build-essential python3 python3-pip unzip

1.2 — Install Docker Engine

curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

# Add your user to docker group (no sudo needed after this)
sudo usermod -aG docker $USER
# Log out and back in, then verify:
docker --version         # Docker version 24.x
docker compose version   # Docker Compose v2.x

1.3 — Install Node.js 18 LTS

curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -
sudo apt install -y nodejs
# Verify
node --version  # v18.x.x
npm --version   # 9.x.x

1.4 — Install Go 1.21+

wget https://go.dev/dl/go1.21.6.linux-amd64.tar.gz
sudo rm -rf /usr/local/go
sudo tar -C /usr/local -xzf go1.21.6.linux-amd64.tar.gz

# Add to PATH (append to ~/.bashrc)
echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc
echo 'export GOPATH=$HOME/go' >> ~/.bashrc
echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bashrc
source ~/.bashrc

# Verify
go version  # go1.21.6 linux/amd64

1.5 — Install FireFly CLI

FF_VERSION=v1.3.1
curl -fsSL https://github.com/hyperledger/firefly-cli/releases/download/${FF_VERSION}/firefly-cli_Linux_x86_64.tar.gz \
  | tar -zxv ff
sudo mv ff /usr/local/bin/ff

# Verify
ff version

Alternatively, download the binary directly from: https://github.com/hyperledger/firefly-cli/releases

1.6 — Download Fabric binaries

cd ~/ssi-blockchain
curl -sSL https://bit.ly/2ysbOFE | bash -s -- 2.5.4 1.5.7
# Downloads fabric-samples/, bin/ (peer, orderer, etc.), and config/

# Add peer binary to PATH
echo 'export PATH=$PATH:$HOME/ssi-blockchain/bin' >> ~/.bashrc
source ~/.bashrc

# Verify
peer version  # peer: version 2.5.4

1.7 — Initialize and start the FireFly stack

# Create a 2-member Fabric stack (org1 = Issuer/Centre, org2 = Verifier)
ff init ssi-network 2 \
  --blockchain-provider fabric \
  --database postgres

# Start the stack (takes 2–3 minutes first time, spins up ~15 containers)
ff start ssi-network

# Verify both orgs are healthy
curl http://localhost:5000/api/v1/status | jq .
curl http://localhost:5001/api/v1/status | jq .

Useful FireFly CLI commands:

ff stop ssi-network    # stop all containers
ff start ssi-network   # start again (state persisted)
ff reset ssi-network   # WIPE all data and start fresh
ff logs ssi-network    # tail logs from all services
ff remove ssi-network  # delete stack entirely

💡 Windows users: run all steps inside WSL2 Ubuntu (wsl --install in PowerShell as Administrator, then reboot).

---

2. Smart Contract Deployment

# Navigate to contract directory
cd ~/ssi-blockchain/contract

# Install dependencies
npm install

# Package the chaincode
# Ensure peer binary is in path or use full path
peer lifecycle chaincode package ssi-contract.tar.gz --path . --lang node --label ssi-contract_1.0

# Deploy to FireFly stack (order of commands might be different here depending on version, the error output should give the corrected order)
ff deploy fabric ssi-network ssi-contract 1.0 ./ssi-contract.tar.gz

---

3. Register Contract Interfaces (FFI)

Org 1 (Port 5000):

curl -X POST http://localhost:5000/api/v1/contracts/interfaces \
  -H 'Content-Type: application/json' \
  -d @scripts/ff-contract-interface.json | jq -r .id

copy the top most ID from here^ and use it later for issuer and centre

Org 2 (Port 5001):

curl -X POST http://localhost:5001/api/v1/contracts/interfaces \
  -H 'Content-Type: application/json' \
  -d @scripts/ff-contract-interface.json | jq -r .id

copy the top most ID from here^ and use it later for verifier (this command might need to be re run with explicit definitions for /submitLogRoot, if it gives error later, then we will have 2 interface IDs the other one only for the submit funciton)

---

4. Environment Configuration

Folder: /services/issuer/ & /services/centre/

• File: .env
• Port: 5000
• Value: FIREFLY_INTERFACE_ID=<ID_FROM_PORT_5000>

Folder: /services/verifier/

• File: .env
• Port: 5001
• Value: FIREFLY_INTERFACE_ID=<ID_FROM_PORT_5001>

---

5. System Registration & Webhooks

Register Issuer (Org 1):

curl -X POST http://localhost:3001/register

Register Policy (Org 1):

curl -X POST http://localhost:3001/policy \
  -d '{"resourceId": "library-door-1", "requiredRole": "student", "requiredLevel": 1}'

Register Verifier (Org 2):

curl -X POST http://localhost:5001/api/v1/contracts/invoke \
  -d '{
    "interface": "<ID_FROM_PORT_5001>",
    "location": { "channel": "firefly", "chaincode": "ssi-contract" },
    "method": "registerVerifier",
    "input": {
      "verifierId": "verifier-door-1",
      "publicKey": "verifier-pub-key",
      "endpoint": "http://localhost:3002"
    }
  }'

Register Webhook (Org 1):

curl -X POST http://localhost:5000/api/v1/subscriptions \
  -d '{
    "name": "centre-log-receiver",
    "transport": "webhooks",
    "filter": { "tag": "log-batch" },
    "options": {
      "url": "http://host.docker.internal:3003/receive-batch",
      "method": "POST"
    }
  }'

(I tried both localhost:3003 and host.docker.internal:3003)

6. Wallet Operations

Request Credential:

node wallet.js request joe student 1

Prove Identity:

node wallet.js prove <CREDENTIAL_ID> library-door-1

Revoke Credential:

curl -X POST http://localhost:3001/revoke -d '{"credentialId": "<ID>"}'

Audit Logs:

curl http://localhost:3003/logs

Just for audit there is bash node wallet.js list to show issued credentials will be removed later.