Use this page to plan the dedicated server that runs the cold bridge and vault stack for cold vault operations.
Cold storage deployments require a cold vault server. If your deployment does not use cold storage, skip this page.
The cold vault server is a dedicated, air-gapped machine for offline signing. It runs the cold bridge and the vault stack in an isolated environment, so operators transfer operation payloads manually between the online deployment and the cold vault server.
For the cold vault model, see Cold vaults.
| Area | Requirement |
|---|---|
| Hardware | Dedicated standard server used only for cold vault operations. |
| Network isolation | No inbound or outbound network connectivity. The only permitted exception is connectivity to the HSM, if you use a network HSM. |
| Operating system | Hardened Linux installed from verified media. |
| Storage | Removable SSD for the operating system, vault, and cold bridge software. |
| Transfer media | Approved portable media, such as an approved USB device, for moving .dat files between environments. |
| Physical controls | Controlled-access location and dual-control operating procedure. |
The cold vault server needs:
- Cold bridge software.
- Vault stack components.
- KMS or HSM drivers, if applicable.
- A local browser, or a local API client such as
curlor Postman, for cold bridge operations.
The vault component runs alongside the cold bridge. It polls the cold bridge for signing work in the same way a hot vault polls the online API, except the endpoint is local to the air-gapped server.
Before using the cold vault server:
- Disable or remove Wi-Fi.
- Disable or remove Bluetooth.
- Disable or disconnect Ethernet.
- Disable cellular connectivity.
- Disable network boot.
- Block all inbound and outbound network connections. If you use a network HSM, allow connectivity to the HSM only.
- Use wired keyboard and mouse.
- Configure BIOS or firmware security controls.
- Use tamper-evident controls required by your operational policy.
- Record the server build and configuration in your operations documentation.
Before deployment, prepare:
| Artifact | Why you need it |
|---|---|
| Cold bridge software | Provides the local UI and API for cold vault operations. |
| Vault stack components | Signs operations with the KMS backend. |
| KMS or HSM configuration | Allows the vault to use protected signing material. |
| Vault configuration | Required to redeploy the same cold vault if the server is replaced. |
| Transfer procedure | Defines how .dat files move between online and air-gapped environments. |