Deploy
ReadyEvery deployment, on any platform, does the same handful of things — and the recipes just automate them for you. One container and PostgreSQL on a VM is the simplest shape; an L4 / TCP-passthrough load balancer adds HA. The recipe is a plain, editable file you own, so you can take it as-is or reason your own way from scratch. One hard rule: nothing in front may terminate TLS.
Who this is for: whoever stands a deployment up — whether you want a one-command recipe or to build it by hand on infrastructure we don’t ship a recipe for. Both paths follow the same steps below.
Ydentifi’s mutual-TLS handshake must terminate at the server — the client certificate is the identity, so anything that terminates TLS at an edge strips it. Only L4 / TCP-passthrough load balancers are compatible. This isn’t a limitation to work around; it’s the shape banking-grade mTLS gateways have used for years, and it fails closed: a TLS-terminating proxy doesn’t weaken security, it refuses to connect.
The steps, in principle#
Whatever the platform, a deployment does these six things. Read them once and you can follow a recipe with your eyes open — or build your own on infrastructure we don’t ship a recipe for.
Get the image and a database
Pull the ydentifi-server container, and provision a PostgreSQL database — managed, or one you run yourself.
Establish the PKI
ydfi bootstrap mints the root CA and the server certificates. Store the root key in your secret manager. See Certificates & PKI.
Configure it
Feed the database URL, the TLS cert and key, the master encryption keys, and the license to the server as environment variables — from a file, or your platform’s secret store.
Install a license
A license lets the deployment run and sets its seat count. Download it with ydfi pull and install it with ydfi license apply; see Get a license.
Serve on :443, end to end
Put the server on :443 — directly on the host, or behind an L4 / TCP-passthrough load balancer for HA. Never anything that terminates TLS.
Publish trust & verify
Point DNS at it, hand your root CA certificate (ca.crt) to your relying parties as their trust anchor, start the server, and confirm with ydfi admin health.
Recipes, or roll your own#
The recipes automate those steps for the common targets. Crucially, a recipe is not a black box: it generates a plain docker-compose file, an env file, and your PKI into a directory you choose — standard artifacts you can read, commit, share, and modify. Take them as-is, or use them as a worked starting point for your own manifests.
| Target | Recipe | Status |
|---|---|---|
| On-prem · any cloud VM GCP, AWS, Azure — same command | ydfi deploy local up --domain … | ✓ Shipped |
| Managed Kubernetes GKE, EKS, AKS | ydfi deploy gke | eks | aks | At launch |
| From scratch anything else | the six steps above | ✓ Anywhere |
# evaluate on a laptop or a stock VM (self-signed, local only) $ ydfi deploy local up # single-host production: your domain + your TLS cert, end to end $ ydfi deploy local up --domain ydentifi.acme.example \ --tls-cert fullchain.pem --tls-key privkey.pem # managed Kubernetes recipes — at launch $ ydfi deploy gke # or: eks, aks
deploy local is one container plus PostgreSQL on the host you run it on — the same command whether that host is your own hardware or a GCP/AWS/Azure VM; only the machine underneath differs. The managed k8s recipes are pre-launch; until they ship, wrap the same container in a standard Kubernetes manifest with an L4 LoadBalancer Service, exactly as step 5 describes.
Pick your shape#
Two questions decide the topology: do you need high availability, and are you already on Kubernetes?
What works, what breaks#
- A VM + public / Elastic IP on
:443— the simplest deployment. - AWS NLB, GCP passthrough Network LB, Azure L4 Standard LB — layer-4, preserve the TCP stream.
- Kubernetes
Service type: LoadBalancerbacked by an L4 NLB. - nginx-stream TCP passthrough, or Cloudflare Spectrum (true TCP).
- AWS ALB, Cloud Run, App Engine / Functions, GCP HTTPS LB.
- Azure App Gateway, Front Door, App Service.
- Cloudflare Tunnel, proxy, or Workers (edge-terminated even with a
tcp://ingress). - Vercel, Netlify, Render, Heroku — all edge-terminated HTTPS.
The dividing line is simple: if the platform decrypts TLS before your server sees it, the client certificate is gone and mutual TLS can’t happen. Pick anything from the left column.