Prerequisites

Decentralization Manager overview

Choose a setup path

Goal	Minimum path	Additional requirements
Review the architecture	Repository and documentation access	No running Canton environment required.
Build from source	Rust, Node.js, Git, and repository dependency access	Canton access is optional for a compile-only check.
Run one development node	Build tools plus Canton Admin and Ledger API access	Authentication, local storage, and required ports.
Run a local multi-node workflow	Docker or multiple local processes	Multiple participant endpoints, peer addresses, and non-conflicting ports.
Deploy to production	Approved container, Kubernetes or equivalent, and persistent storage	Identity provider, TLS or mTLS, public peer connectivity, secret protection, monitoring, backup, and an approved compatibility row.

Development tools

The reviewed repository currently identifies:

• Rust edition 2024 with Rust 1.85 or newer.
• Node.js ^20.19.0 or >=22.12.0 for the embedded frontend.
• Docker for container builds and full integration testing.
• Daml SDK 3.4.11 through the dpm CLI for Daml packages and tests.
• Java 17 or newer for Daml tests.
• Git and an SSH key registered with GitHub for build paths that fetch canton-lib over SSH.

Use the approved product release and compatibility matrix when selecting exact tool versions.

Canton access

A running instance requires access to a Canton participant’s:

• Admin API for topology, keys, identity, package upload, and related privileged operations.
• Ledger API for contracts, commands, user rights, party data, and interactive submissions.

The operator must know:

• Host and port for each API.
• Whether each connection uses plaintext on a trusted private network, TLS, or mTLS.
• The certificate authority and server name where applicable.
• The Canton synchronizer and target environment.
• Which user or service identity has the required rights.

Production deployments should grant only the permissions required for supported workflows.

Authentication

Choose one approved identity-provider path for the operator interface:

• Keycloak public client using Authorization Code with PKCE.
• Auth0 single-page application and API audience.

Per-party credentials used for Canton operations are separate from browser login. Document their ownership, rotation, storage, and actAs or readAs rights before running workflows.

Do not use --insecure or DECPM_INSECURE outside isolated local development against an intentionally unsafe Canton configuration.

Networking

Default source values currently use:

• HTTP or web interface on port 8080.
• Noise peer communication on port 9000.
• Canton Ledger API on port 5001.
• Canton Admin API on port 5002.

These are defaults, not universal requirements. Confirm actual ports, firewall rules, DNS, load balancers, TLS termination, and peer reachability for the selected environment.

Persistent data

Plan persistent storage for:

• The generated Noise identity.
• The SQLite operational database.
• Peer configuration and party credentials.
• DAR files used by workflows.
• The optional .env file used by a local data directory.

Losing the persistent identity can require every peer to update its stored entry. Production setup must include an approved backup and recovery procedure.

Preflight commands

rustc --version
cargo --version
node --version
docker version
dpm version
java -version
git --version

Run only the checks required for your chosen setup path.

Readiness checklist

• An approved Decentralization Manager tag or image is selected.
• Required build tools match the approved compatibility row.
• Canton Admin and Ledger APIs are reachable.
• TLS or mTLS settings match what each Canton endpoint serves.
• The operator identity provider is configured.
• Per-party Canton credentials and rights are available.
• HTTP and peer ports are reachable by the intended callers.
• Persistent storage, secret protection, backup, logs, and monitoring are planned.
• Insecure mode is disabled for every shared or production environment.

Technical sources

• Repository README
• Operator guide
• Deployment guide
• Contribution prerequisites

Related pages

• Run Decentralization Manager locally
• Run Decentralization Manager with Docker
• Decentralization Manager production deployment
• Decentralization Manager authentication and operator roles
• Decentralization Manager compatibility, releases, and troubleshooting

Next step

👉 Choose a setup: Run Decentralization Manager locally or Run Decentralization Manager with Docker.