Fystack Enterprise Deployment Guide

Run the Fystack custody platform on your own Kubernetes infrastructure — EKS, GKE, AKS, OpenShift, or self-managed. This guide walks platform engineers through every step from cluster prerequisites to production cutover.

Start installingArchitecture overview

What you need to provide

The template deploys the Fystack application stack. Your platform team provides PostgreSQL 15+, MongoDB, NATS with JetStream and client TLS/mTLS, Consul, and Redis/Valkey with RedisBloom, plus ingress, TLS, DNS, and secrets. The template intentionally does not install or operate these services. See Stateful dependencies.

Who this guide is for

This documentation is written for platform / DevOps engineers who already operate their own Kubernetes cluster. You should be comfortable with:

  • kubectl and helm
  • the customer-owned public edge, DNS, and TLS process
  • A secrets backend (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager)
  • GitOps workflows or direct Helm/Kustomize deployment

You do not need prior experience with multi-party computation or wallet infrastructure — the mpcium identity ceremony is documented step-by-step.

What is and isn't included

This guide covers everything required to run Fystack on your cluster. It does not cover application-layer concerns like wallet UX, transaction policy configuration, or end-user onboarding — those are documented separately in the product user guide.

In scope: Kubernetes prerequisites, dependency provisioning, the mpcium identity ceremony, deploying every workload, ingress and TLS, secrets management, observability, day-2 operations, security hardening.

Out of scope: writing your own MPC threshold scheme, building custom blockchain integrations, modifying the Fystack source code.

Reading order

If you are setting up a new environment, read sections in order:

  1. Architecture — understand the components before you provision anything.
  2. Prerequisites — verify your cluster meets the requirements.
  3. Platform setup — cloud-specific bootstrapping.
  4. Third-party services — configure only the integrations you use.
  5. Installation — the step-by-step deployment runbook.
  6. Operations — once you are live, this is where you live.

If something breaks, jump straight to Troubleshooting.

Conventions used in this guide

  • Commands prefixed with $ are run on your local workstation against the target cluster.
  • Commands prefixed with # run inside a pod (typically via kubectl exec).
  • <customer> is the lowercase DNS slug passed to scripts/create-customer.sh.
  • The generated namespaces are <customer>-fystack and <customer>-mpcium.
  • REPLACE_ME_* markers in the generated overlay must be replaced before validation and deployment.