# Deployment overview

Crypto Vault is self-hosted. Every component runs inside your own cloud accounts. Sodot provides the software; you own the infrastructure, the encryption keys, and the data.

## What you install: the Helm chart

A single `crypto-vault` Helm chart installs every service. You supply a `values.yaml` and run `helm install`; how you provision the underlying infrastructure is up to you.

The chart accepts Terraform outputs, hand-authored values files, or values injected from your own secrets manager. Any combination works as long as the required values are present.

## The example Terraform module

Sodot ships example Terraform for both supported cloud environments:

* **AWS:** EKS clusters with Nitro Enclaves, RDS PostgreSQL, AWS KMS, PrivateLink, and NLB front doors.
* **GCP:** regional GKE clusters with N2D SEV-SNP Confidential node pools, per-workload Cloud SQL proxy identities, Cloud HSM, Private Service Connect, and GKE Ingress front doors.

Each example provisions the complete three-cluster environment and renders the Helm values you install.
It is a concrete starting point, not a prescriptive template. Use it to understand the infrastructure
shape, then adapt it or replace it with your own infrastructure code. The combined GCP example keeps
all three clusters in one Terraform state under one caller, so it is an integration reference. A
production GCP deployment uses a separately administered root, backend, credential set, project, and
HSM key for each party.

## The deployment journey

Bringing the vault online follows four stages:

1. **Provision infrastructure.** Stand up three clusters, one per AWS account or GCP project, plus the
   supporting databases, encryption keys, and cross-cluster networking. Use the
   [AWS example](/deploy/provision-aws), or invoke the [GCP building block](/deploy/terraform/module-gcp)
   separately for each production party. The [combined GCP example](/deploy/provision-gcp) shows the
   complete wiring for integration and proof-of-concept deployments. The examples write ready-to-use
   values files and kubeconfigs, but do not install the chart.

2. **Install with Helm.** Apply the chart in two stages. Stage 1 brings up the Key Store and Policy Server on every cluster. Stage 2 activates the Orchestrator, message bus, relay, and web app on the hub cluster. The Orchestrator propagates cluster identity across all nodes.

3. **Run the setup ceremony.** IT verifies that every cluster node agrees on the same trust set, then hands off to the Setup Admins who enroll their passkeys. The vault is blocked for all operations until the ceremony completes.

4. **Go live.** Setup Admins configure the Administrative Policy, create user groups, and the vault is ready for day-to-day use.

The following pages walk through each stage in detail.