Skip to main content

Setting Up the HFT Signer

The HFT signer is provided as a Terraform module, which allows you to easily deploy it in your cloud environment (currently supporting AWS).

Follow these steps to set it up:

  1. Create a machine user in Vertex servers
  2. Install required tools
  3. Collect installation parameters
  4. Get the TF module
  5. Apply the Terraform module
  6. Test the setup

1. Create a trading machine user​

In order for the HFT signer to use an API key from the MPC Cluster, you need to create a new HFT signer user. An HFT signer user is a user that has only the AttestedExporter system role.

To create such user, use the create user with custom roles API endpoint and specify the attested_exporter role.

# For each vertex server in the MPC cluster, run:

curl -L 'https://<VERTEX_URL>/admin/create-user-with-custom-roles' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'AUTHORIZATION: <ADMIN_TOKEN>' \
-d '{
  "name": "<MACHINE_USER_NAME>",
  "roles": [
    "attested_exporter"
  ]
}'

Then, make sure to grant the user with access to the relevant API keys by using the grant key usage permission API endpoint.

# For each vertex server in the MPC cluster, run:

curl -L 'https://<VERTEX_URL>/admin/keys/grant-usage-permission' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'AUTHORIZATION: <ADMIN_TOKEN>' \
-d '{
  "permission": "admin",
  "user_name": "<MACHINE_USER_NAME>",
  "key_name": "<API_KEY_NAME>"
}'

2. Install Required Tools​

Before starting the installation process, make sure you have the following installed:

  1. The terraform CLI.
  2. The aws CLI tool for AWS.
  3. Make sure you are logged in (i.e aws sso login).
  4. Make sure your account has permissions to create resources (such as EC2 instances, RDS instances, etc...).

In addition, this guide assumes you're running the provided example Terraform module as the root module (although most steps are applicable when running it as a submodule as well).

3. Collect Installation Parameters​

At this step you should collect the following pieces of information, listed down below. At the end of each bullet we put in parentheses a capitalized name which will be used to refer to the value being set throughout the rest of this guide.

  1. The Sodot Docker registry user and token which provides access to all relevant Helm charts, Docker images and Terraform modules (ARTIFACTORY_USER and ARTIFACTORY_TOKEN). You can get these by following the Obtaining Credentials guide.
  2. Several other parameters related to the existing trading machine you wish to deploy the HFT signer near, such as:
    • The trading machine's subnet ID (TRADING_MACHINE_SUBNET_ID).
    • The trading machine's placement group name (TRADING_MACHINE_PLACEMENT_GROUP_NAME), if it doesn't participate in a placement group, create one in "Cluster mode" and attach it.

4. Get the Terraform Module​

First, you'll need to log in to the Sodot Docker registry using the credentials you got in the previous step.

terraform login repo.sodot.dev

A. Use the module directly from the registry​

Then, you can use the module directly from the registry by adding it to your Terraform configuration. Add the following block to your main.tf (or similar) and run terraform init. Terraform will pull the module from your JFrog Artifactory registry at runtime.

module "hft-signer" {
  source  = "repo.sodot.dev/sodot-terraform-modules__sodot/hft-signer/aws"
  ...
}

B. Download the raw Terraform module to customize it​

  1. Fetch the desired release (replace <VERSION> with a tag such as v1.0.0):
curl -u "<ARTIFACTORY_USER>:<ARTIFACTORY_TOKEN>" \
  -O "https://repo.sodot.dev/artifactory/sodot-terraform-modules/sodot/hft-signer/aws/<VERSION>.zip"

Alternatively, you can use the Artifactory GUI instead.

  1. Unzip and make it your root module:
unzip <VERSION>.zip -d hft-signer
cd hft-signer

5. Apply the Terraform Module​

Setting up the relevant infrastructure is performed by running terraform init followed by terraform apply. Where you run those commands depends on the option you chose in Get the Terraform Module.

Configuring Terraform​

The module’s inputs are declared in variables.tf and have sensible defaults where appropriate. You must supply the following variables when invoking both terraform apply and terraform destroy:

  • region - the AWS region at which the trading machine is in.
  • artifactory_user=<ARTIFACTORY_USER> - provides Terraform with permissions to pull the Helm chart and the Vertex Docker image.
  • artifactory_token=<ARTIFACTORY_TOKEN> - provides Terraform with permissions to pull the Helm chart and the Vertex Docker image.
  • private_subnet_id=<TRADING_MACHINE_SUBNET_ID> - The trading machine's AWS subnet.
  • placement_group_name=<TRADING_MACHINE_PLACEMENT_GROUP_NAME> - The trading machine's placement group.
  • image_tag=<IMAGE_TAG> - The Docker image tag to use for the HFT signer.

Example for option B (inside the unzipped directory):

terraform init

terraform apply \
    -var "region=us-east-1" \
    -var "artifactory_user=my-artifactory-user" \
    -var "artifactory_token=my-artifactory-token" \
    -var "private_subnet_id=subnet-00000000000" \
    -var "placement_group_name=my-placement-group" \
    -var "image_tag=1.0.0"

For option A, run the same command from the root module that references module "hft-signer".

After running terraform apply, Terraform will output the following values: private_ip - The private IP address of the HFT signer instance. Keep this value handy as you'll need it to configure the trading machine Java SDK.

6. Test the Setup​

After the Terraform module has been applied successfully, you can test the setup by installing using the Java SDK to sign a payload.