Production Docker Architecture: WAIaaS Daemon + Push-Relay for Enterprise AI Wallets

Description and use

Deploying WAIaaS in Docker provides a self‑hosted wallet infrastructure for AI agents, keeping private keys and policies on the owner’s server, with optional mobile notifications via a separate push‑relay.

Problem

Developers building autonomous AI agents that handle real money need secure, self‑hosted wallet infrastructure to avoid third‑party custody, rate limits, and vendor lock‑in.

Outcome

Deploying WAIaaS via Docker Compose yields a production‑ready, self‑hosted wallet daemon with optional mobile approvals, secure key storage, and robust health monitoring.

Workflow

• Clone the WAIaaS repo
• Run docker compose up -d to start the daemon (or use docker run with auto‑provision for scripted setups)
• Retrieve the auto‑generated master password from /data/recovery.key if using auto‑provision
• Configure environment variables (e.g., RPC endpoints, port, hostname) in docker-compose.yml or via Docker secrets
• Mount a named volume (waiaas-data) to persist wallet data across restarts
• Optionally deploy the push-relay service for mobile approvals
• Set up a reverse proxy (nginx, Caddy) if external access is required, ensuring TLS termination
• Use Docker secrets overlay to keep the master password out of environment variables
• Monitor the daemon via the healthcheck endpoint and restart policy

Evidence

WAIaaS ships two Docker images: waiaas daemon and push‑relay

Source

The daemon is not exposed to the internet out of the box

Source