Deploy a cold bridge

Use this page when deploying cold vault operations. The cold bridge is required only for cold storage deployments.

The cold bridge runs on the air-gapped workstation and provides:

• A local UI for cold vault operations.
• A local API for uploading, decoding, and downloading operation payloads.
• Optional payload encryption and decryption for .dat files.
• A local endpoint that the vault component polls for signing work.

The cold bridge is stateless and uses in-memory storage for workloads. It does not require a database or persistent volume.

For workstation requirements, see Cold vault workstation planning.

Before installing the cold bridge:

1. Build the workstation according to Cold vault workstation planning.
2. Verify that network connectivity is disabled.
3. Install the hardened operating system from verified media.
4. Install KMS or HSM drivers, if applicable.
5. Prepare approved transfer media for moving .dat files.

Transfer the cold bridge software, vault stack components, and configuration files to the air-gapped workstation using approved physical media.

Install the components using the deployment method agreed for your environment. The cold bridge and vault are deployed together so the vault can poll the local cold bridge endpoint for signing work.

If your deployment enables cold bridge payload encryption, configure the same passphrase on:

• The cold bridge.
• The online system configuration used to process cold bridge payloads.

If the passphrase differs between the air-gapped workstation and the online system, operation payloads cannot be decrypted.

After startup, call the status endpoint from the air-gapped workstation:

curl -X GET "{ColdBridgeURL}/v1/feed/status"

Expected response shape:

{
  "accountToSign": 0,
  "accountSigned": 0,
  "transactionToSign": 0,
  "transactionSigned": 0,
  "manifestToSign": 0,
  "manifestSigned": 0
}

Register the cold vault with the standard vault registration process:

• Register a vault in the UI
• Register a vault with the API

After registration, the vault can appear as Pending because the cold vault cannot automatically connect to the online deployment.

Complete the manual handshake by transferring the initial vault payload from the cold bridge to the online system:

1. On the air-gapped workstation, download the payload from the cold bridge.
2. Transfer the .dat file to the online environment.
3. Import the .dat file into Ripple Custody.
4. Verify that the vault status is Completed.

For exact UI and API steps, see:

• Complete the first-time vault handshake in the UI
• Complete the first-time vault handshake with the API

Before using the cold vault for production operations:

1. Create a test account using the cold vault.
2. Export pending operations from the online environment.
3. Transfer the .dat file to the air-gapped workstation.
4. Upload the file to the cold bridge.
5. Confirm that the operation appears in the signing queue.
6. Download the signed .dat file.
7. Transfer the signed file back to the online environment.
8. Import the signed operations and verify the result.

For day-to-day operation steps, see Process cold vault operations with the API.