customer-config.yml Reference

Overview

Edit customer-config.yml in your installer bundle before make generate-customer-assets. This file declares your deployment namespace, AWS environments, hosted zones, admin users, optional Canton settings, and AWS resource tags.

customer-config.yml

Required fields:

Optional:

Resource tags (tags)

Add a top-level tags map to label wallet infrastructure in your AWS account. Keys and values are strings forwarded to CDK resource tagging.

YAML

tags:
  env: production
  cost-center: custody
  team: platform-ops

Use names your organization already requires for cost allocation, ownership, or compliance reporting.

Optional: import existing AWS infrastructure

Standard installs omit the blocks below. The CDK long-lived stack then creates a VPC, ACM certificates, Route 53 records, and related resources.

Add these under the matching entry in the environments[] list when your platform team supplies existing infrastructure or manages DNS outside the wallet stack. The configurator applies them when you run make generate-customer-assets. You can also add or change the same blocks after generation if import decisions come later.

Block Use when
vpc_config Deploy into an existing VPC and subnets instead of creating a new VPC
certificate_config Attach existing ACM certificate ARNs for the ALB and CloudFront distribution
route53_records_config Skip Route 53 record creation when DNS is managed elsewhere
db_config Use an existing database secret and security group
alb_config, cloud_front_config, efs_config, log_bucket_config, frontend_bucket_config, cloud_map_config Import other long-lived resources instead of creating them

Route 53 (route53_records_config) - set create_records: false when another team owns DNS for the wallet hostnames:

YAML

route53_records_config:
  create_records: false

ACM certificates (certificate_config) - set one or both ARNs; omit the block to let CDK issue default certificates. alb_certificate_arn covers the API load balancer (api.{dns_prefix}.{zone}). cloud_front_certificate_arn covers the UI distribution ({dns_prefix}.{zone} and www.{dns_prefix}.{zone}). You may reuse one certificate for both ARNs.

YAML

certificate_config:
  alb_certificate_arn: arn:aws:acm:us-east-1:123456789012:certificate/<cert-id>
  cloud_front_certificate_arn: arn:aws:acm:us-east-1:123456789012:certificate/<cert-id>

VPC (vpc_config) - supply IDs and CIDR metadata for the VPC your network team provisioned. Private subnets carry wallet workloads; public subnets carry ingress. Isolated subnet fields are optional when your VPC layout includes them.

YAML

vpc_config:
  vpc_id: vpc-xxxxxxxx
  availability_zones:
    - us-east-1a
    - us-east-1b
  region: us-east-1
  vpc_cidr_block: 10.0.0.0/20
  private_subnet_ids:
    - subnet-xxxx
    - subnet-yyyy
  private_subnet_route_table_ids:
    - rtb-xxxx
    - rtb-yyyy
  private_subnet_ipv4_cidr_blocks:
    - 10.0.6.0/23
    - 10.0.8.0/23
  public_subnet_ids:
    - subnet-xxxx
    - subnet-yyyy
  public_subnet_route_table_ids:
    - rtb-xxxx
    - rtb-yyyy
  public_subnet_ipv4_cidr_blocks:
    - 10.0.0.0/23
    - 10.0.2.0/23

Example skeleton:

YAML

namespace: your-namespace
tags:
  env: production
  cost-center: custody
  team: platform-ops
environments:
  - name: testnet
    account_id: "123456789012"
    region: us-east-1
    testnet: true
    hosted_zone: wallet.example.com
    hosted_zone_id: Z0XXXXXXXXXXXX
    components:
      - wallet
      - policyNode0
      - policyNode1
      - policyNode2
    admins:
      - name: Admin User
        email: admin@example.com
  - name: mainnet
    account_id: "123456789012"
    region: us-east-1
    testnet: false
    hosted_zone: wallet.example.com
    hosted_zone_id: Z0XXXXXXXXXXXX
    components:
      - wallet
      - policyNode0
      - policyNode1
      - policyNode2
    admins:
      - name: Admin User
        email: admin@example.com

See the customer-config.yml file in your delivery bundle for the full template and comments.