Production Docker for 15-Package Monorepo: Microservices Architecture for Self-Hosted AI Wallets

Description and use

This workflow enables rapid deployment of a secure, auditable, rate‑limited AI wallet daemon using Docker, Docker Secrets, and a three‑layer authentication model.

Problem

Deploying a self-hosted AI wallet daemon that manages private keys, DeFi execution, and REST API while ensuring security, auditability, and rate‑limit control.

Outcome

The workflow enables a secure, auditable, and rate‑limit‑controlled AI wallet daemon to be deployed in minutes with Docker, using Docker Secrets for production safety and a clear three‑layer authentication model.

Workflow

• Clone the WAIaaS repo: git clone https://github.com/waiaas/WAIaaS.git
• Navigate into the repo: cd WAIaaS
• Start the daemon: docker compose up -d
• (Optional) Use auto‑provision: docker run -d --name waiaas -p 127.0.0.1:3100:3100 -v waiaas-data:/data -e WAIAAS_AUTO_PROVISION=true ghcr.io/waiaas/waiaas:latest and retrieve the master password with docker exec waiaas cat /data/recovery.key
• For production, create secret files: mkdir -p secrets && echo "your-secure-password" > secrets/master_password.txt && chmod 600 secrets/master_password.txt
• Deploy with secrets overlay: docker compose -f docker-compose.yml -f docker-compose.secrets.yml up -d
• Create a wallet via API: curl -X POST http://127.0.0.1:3100/v1/wallets -H "Content-Type: application/json" -H "X-Master-Password: my-secret-password" -d '{"name": "trading-wallet", "chain": "solana", "environment": "mainnet"}'
• Create a session token for an AI agent: curl -X POST http://127.0.0.1:3100/v1/sessions -H "Content-Type: application/json" -H "X-Master-Password: my-secret-password" -d '{"walletId": "<wallet-uuid>"}'
• Configure policies via API to enforce default‑deny and set spending limits, notifications, delays, or approvals.

Evidence

The daemon runs as a non-root user (UID 1001), which is the right call for a service that's holding cryptographic material.

Source

For homelab use, environment variables are fine. For anything that's actually in production — a VPS, a server, a dedicated machine running agents with real funds — you want Docker Secrets instead of plaintext environment variables.

Source