Multi-Party Computation Infrastructure

This repository contains all infrastructure and automation required to deploy, configure, and operate a distributed multi-party computation service in production. It focuses exclusively on provisioning and lifecycle management of the system components, using Ansible to ensure reproducible and consistent environments.

Compatibility

OS	Status
macOS	✅
Linux	✅
Windows (via WSL2)	✅
Native Windows	✅

Prerequisites

• Docker and Docker Compose
• Python 3.12
• Pyenv (optional)
• Pipx
• Poetry
• Ansible
• Vagrant (for local deployment testing)
• QEMU (for local deployment testing)

Installation

# Install Python 3.12.12 with pyenv.
pyenv install 3.12.12

# Set virtual environment in project folder, instead of global user folder.
poetry config virtualenvs.in-project true

# Install project dependencies and activate environment.
poetry install
poetry shell

# Install Ansible dependencies.
ansible-galaxy collection install -r requirements.yaml

Usage

The tool exposes two modes, each invoked as a positional argument:

Mode	Description
topology	Generate a blank topology configuration template
build	Build deployment artifacts from a topology file

Generate a topology template

python main.py topology [--nodes-number N] [--deployment-mode MODE]

Option	Default	Description
--nodes-number / -n	4	Total number of nodes (1 controller + N peers)
--deployment-mode / -d	development	development (Transit unseal) or production (AWS KMS unseal)

It writes .generated/topology.yaml, a commented YAML template with one controller block and N−1 peer blocks.

Fill in topology.yaml

Open .generated/topology.yaml and populate every field. The file is self-documented with inline comments. Key sections per node:

Build deployment artifacts

python main.py build [--topology PATH] [--check-ports]

Option	Default	Description
--topology / -t	.generated/topology.yaml	Path to the filled-in topology file
--check-ports / -c		Verify that declared ports are free on localhost

The command generates one directory per node under .generated/<node-name>/.

Deployment

# Deploy with Ansible (remote or local (real QEMU VMs) hosts).
poe run deploy [--topology PATH]

# Deploy with Ansible (local Docker (containers - DinD) hosts).
poe run act-deploy [--topology PATH]

Schematic Diagram

The following diagram illustrates the overall architecture of the multi-party computation signer service, including the controller node and other nodes.

flowchart TB
    Client[<strong>Service backend</strong>]

    subgraph CONTROLLER["Controller"]
        ControllerNGINX[<strong>NGINX</strong> <br /> mTLS termination]
        ControllerAPI[<strong>NestJS API</strong>]
        ControllerQueue[(<strong>Redis</strong> <br/> Job queue)]
        ControllerWorker[<strong>Worker</strong> <br/> Job orchestrator]
        ControllerEngine[<strong>Rust controller engine</strong> <br/> gRPC]

        ControllerNGINX --> ControllerAPI
        ControllerAPI --> ControllerQueue
        ControllerQueue --> ControllerWorker
        ControllerWorker --> ControllerQueue
        ControllerWorker --> ControllerEngine
    end

    subgraph FIRSTPEER["Peer #1"]
        FirstPeerNGINX[<strong>NGINX</strong> <br /> mTLS termination]
        FirstPeerEngine[<strong>Rust engine</strong> <br /> gRPC + Bearer]
        FirstPeerVault[<strong>Vault</strong> <br /> Key share #1]
        FirstPeerNGINX --> FirstPeerEngine
        FirstPeerEngine --> FirstPeerVault
    end

    subgraph SECONDPEER["Peer #2"]
        SecondPeerNGINX[<strong>NGINX</strong> <br /> mTLS termination]
        SecondPeerEngine[<strong>Rust engine</strong> <br /> gRPC + Bearer]
        SecondPeerVault[<strong>Vault</strong> <br/> Key share #2]
        SecondPeerNGINX --> SecondPeerEngine
        SecondPeerEngine --> SecondPeerVault
    end

    subgraph NPEER["Peer #3..N"]
        NPeerNGINX[<strong>NGINX</strong> <br /> mTLS termination]
        NPeerEngine[<strong>Rust engine</strong> <br /> gRPC + Bearer]
        NPeerVault[<strong>Vault</strong> <br /> Key share #3]
        NPeerNGINX --> NPeerEngine
        NPeerEngine --> NPeerVault
    end

    Client -->|HTTPS| ControllerNGINX

    ControllerEngine -->|WireGuard + mTLS + Bearer| FirstPeerNGINX
    ControllerEngine -->|WireGuard + mTLS + Bearer| SecondPeerNGINX
    ControllerEngine -->|WireGuard + mTLS + Bearer| NPeerNGINX

Loading