Two-Container AI Wallet Setup: WAIaaS + Push-Relay Production Architecture

说明与用途

两容器 WAIaaS 架构实现了自托管密钥存储、交易策略执行和推送通知审批，消除了第三方服务。

问题

AI agents that move real money need secure, self‑hosted wallet custody and real‑time approval workflows without exposing private keys to third parties.

结果

The two‑container WAIaaS architecture enables self‑hosted AI wallet custody with local key storage, policy enforcement, and real‑time approval via push notifications, eliminating third‑party control while maintaining operational simplicity.

工作流

• 1. Pull the two Docker images (waiaas/daemon:latest and push‑relay).
• 2. Create a named volume (waiaas‑data) for key persistence.
• 3. Write a docker‑compose.yml with daemon service exposing 127.0.0.1:3100, mounting the volume, and setting environment variables.
• 4. (Optional) Create a docker‑compose.secrets.yml overlay to inject secrets via Docker Secrets instead of .env.
• 5. Run docker compose up -d to start both containers.
• 6. Retrieve the auto‑generated master password from /data/recovery.key if using WAIAAS_AUTO_PROVISION.
• 7. Configure authentication layers: masterAuth for admin, sessionAuth for AI agents, ownerAuth for human approvals.
• 8. Define policies via REST API (e.g., spending limits, tiered security).
• 9. Use push‑relay to receive real‑time notifications on mobile devices for approvals.

证据

WAIaaS is an open‑source, self‑hosted Wallet‑as‑a‑Service that puts the answer firmly in your hands: your keys, your server, your rules.

来源

The daemon never phones home

来源

The push‑relay is the bridge that gets that alert to your device without requiring the daemon itself to be reachable from the public internet.

来源

The default port binding is 127.0.0.1:3100:3100, which means by default the daemon only listens on localhost.

来源

The daemon generates a random master password on first start, writes it to /data/recovery.key, and proceeds without waiting for human input.

来源