# Deployment overview

Crypto Vault is self-hosted. Every component runs inside your own cloud accounts. Sodot provides the software; you own the infrastructure, the encryption keys, and the data.

## What you install: the Helm chart

A single `crypto-vault` Helm chart installs every service. You supply a `values.yaml` and run `helm install`; how you provision the underlying infrastructure is up to you.

The chart accepts Terraform outputs, hand-authored values files, or values injected from your own secrets manager. Any combination works as long as the required values are present.

## The example Terraform module

Sodot ships an example Terraform module that provisions a complete three-cluster AWS environment: EKS clusters with Nitro-capable node groups, RDS PostgreSQL databases, KMS encryption keys, PrivateLink cross-cluster connectivity, and ingress. It is a concrete starting point, not a prescriptive template. Use it to understand the infrastructure shape, then adapt it to your environment or replace it with your own IaC.

:::note
The example Terraform provisions AWS only. The Helm chart itself is cloud-provider-agnostic.
:::

## The deployment journey

Bringing the vault online follows four stages:

1. **Provision infrastructure.** Stand up three clusters (one per sub-account), the supporting databases, encryption keys, and cross-cluster networking. The example Terraform does this for you on AWS and writes a ready-to-use values file and kubeconfig per cluster for the Helm step (it does not install the chart itself); any equivalent IaC achieves the same end state.

2. **Install with Helm.** Apply the chart in two stages. Stage 1 brings up the Key Store and Policy Server on every cluster. Stage 2 activates the Orchestrator, message bus, relay, and web app on the hub cluster. The Orchestrator propagates cluster identity across all nodes.

3. **Run the setup ceremony.** IT verifies that every cluster node agrees on the same trust set, then hands off to the Setup Admins who enroll their passkeys. The vault is blocked for all operations until the ceremony completes.

4. **Go live.** Setup Admins configure the Administrative Policy, create user groups, and the vault is ready for day-to-day use.

The following pages walk through each stage in detail.