Two-Container AI Wallet Setup: WAIaaS + Push-Relay Production Architecture

Описание и применение

Двухконтейнерная архитектура WAIaaS обеспечивает автономное хранение приватных ключей, контроль транзакций и push‑уведомления для одобрения, исключая сторонние сервисы.

Задача

AI agents that move real money need secure, self‑hosted wallet custody and real‑time approval workflows without exposing private keys to third parties.

Результат

The two‑container WAIaaS architecture enables self‑hosted AI wallet custody with local key storage, policy enforcement, and real‑time approval via push notifications, eliminating third‑party control while maintaining operational simplicity.

Рабочий процесс

• 1. Pull the two Docker images (waiaas/daemon:latest and push‑relay).
• 2. Create a named volume (waiaas‑data) for key persistence.
• 3. Write a docker‑compose.yml with daemon service exposing 127.0.0.1:3100, mounting the volume, and setting environment variables.
• 4. (Optional) Create a docker‑compose.secrets.yml overlay to inject secrets via Docker Secrets instead of .env.
• 5. Run docker compose up -d to start both containers.
• 6. Retrieve the auto‑generated master password from /data/recovery.key if using WAIAAS_AUTO_PROVISION.
• 7. Configure authentication layers: masterAuth for admin, sessionAuth for AI agents, ownerAuth for human approvals.
• 8. Define policies via REST API (e.g., spending limits, tiered security).
• 9. Use push‑relay to receive real‑time notifications on mobile devices for approvals.

Доказательства

WAIaaS is an open‑source, self‑hosted Wallet‑as‑a‑Service that puts the answer firmly in your hands: your keys, your server, your rules.

Источник

The daemon never phones home

Источник

The push‑relay is the bridge that gets that alert to your device without requiring the daemon itself to be reachable from the public internet.

Источник

The default port binding is 127.0.0.1:3100:3100, which means by default the daemon only listens on localhost.

Источник

The daemon generates a random master password on first start, writes it to /data/recovery.key, and proceeds without waiting for human input.

Источник