> For the complete documentation index, see [llms.txt](https://docs.bitsafe.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bitsafe.finance/decentralization-manager/get-started/production-deployment.md).

# Production deployment

[Run Decentralization Manager with Docker](/decentralization-manager/get-started/run-with-docker.md)

### Production architecture

Deploy one Decentralization Manager instance for each participating organization. Separate the authenticated HTTP surface from the peer communication surface. Provide private connectivity to Canton Admin and Ledger APIs, persistent storage, an approved identity provider, centralized logs, metrics, backups, and secret management.

### Required controls

* Pin an approved image by immutable digest.
* Run as a non-root user with minimum filesystem permissions.
* Disable insecure mode.
* Use TLS for the operator surface and approved TLS or mTLS for Canton and peer paths.
* Restrict inbound traffic to approved callers and peers.
* Store credentials outside the image and rotate them.
* Persist the Noise key, operational database, and required DAR state.
* Configure health, readiness, resource limits, and restart policy.

### Deployment sequence

1. Approve the compatibility row and image digest.
2. Provision namespaces, identities, certificates, secrets, storage, and network policy.
3. Configure Canton and identity-provider clients.
4. Deploy one instance without adding peers.
5. Verify login, Canton connectivity, persistence, metrics, logs, and backup.
6. Exchange peer records through an authenticated channel.
7. Validate mesh health.
8. Run one low-risk workflow.
9. Record the deployment and recovery evidence.

### Persistent data

Back up the Noise identity and SQLite database using an application-consistent procedure. Test restoration in an isolated environment. Protect backups as sensitive material.

### Availability

The application should have a disruption policy, resource requests, probes, monitoring, and alerting. Do not add multiple active replicas behind one identity unless the supported architecture explicitly permits it.

### Upgrades

Peer protocol changes can require coordinated mesh upgrades. Confirm whether a release supports rolling upgrade. If not, schedule a lockstep maintenance window, pause workflows, back up state, update every peer, and verify compatibility before resuming.

### Production checklist

* [ ] Approved release and image digest
* [ ] Identity provider and roles
* [ ] TLS or mTLS and certificates
* [ ] Network policies and firewall rules
* [ ] Secret storage and rotation
* [ ] Persistent storage and tested restoration
* [ ] Health checks, logs, metrics, alerts, and resource limits
* [ ] Mesh upgrade and rollback plan
* [ ] Incident and support contacts

### Technical source

* [Production deployment guide](https://github.com/DLC-link/decentralization-manager/blob/main/docs/DEPLOYMENT_GUIDE.md)

### Related pages

* [Decentralization Manager authentication and operator roles](/decentralization-manager/operations-and-reference/authentication-and-operator-roles.md)
* [Decentralization Manager security architecture](/decentralization-manager/operations-and-reference/security-architecture.md)
* [Decentralization Manager backup, recovery, and mesh upgrades](/decentralization-manager/operations-and-reference/backup-recovery-and-upgrades.md)
* [Decentralization Manager compatibility, releases, and troubleshooting](/decentralization-manager/operations-and-reference/compatibility-releases-and-troubleshooting.md)

### Next step

👉 **Lock down operator access:** [Decentralization Manager authentication and operator roles](/decentralization-manager/operations-and-reference/authentication-and-operator-roles.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bitsafe.finance/decentralization-manager/get-started/production-deployment.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.