Use this page to plan the workstation that runs the cold bridge and vault stack for cold vault operations.
Cold vault workstations are optional. Plan one only if your deployment uses cold storage.
The cold vault workstation is a dedicated, air-gapped machine used for offline signing. It runs the cold bridge and the vault stack in an isolated environment, so operation payloads must be transferred manually between the online deployment and the workstation.
For the cold vault model, see Cold vaults.
| Area | Requirement |
|---|---|
| Hardware | Dedicated laptop or desktop used only for cold vault operations. |
| Network isolation | No Wi-Fi, Bluetooth, Ethernet, cellular connectivity, or network boot path. |
| Operating system | Hardened Linux installed from verified media. |
| Storage | Removable SSD or encrypted USB for the operating system, vault, and cold bridge software. |
| Power | UPS or equivalent power protection for signing operations. |
| Transfer media | Approved removable media for moving .dat files between environments. |
| Physical controls | Controlled-access location and dual-control operating procedure. |
The workstation needs:
- Cold bridge software.
- Vault stack components.
- KMS or HSM drivers, if applicable.
- A local browser or API client for cold bridge operations.
The vault component runs alongside the cold bridge. It polls the cold bridge for signing work in the same way a hot vault polls the online API, except the endpoint is local to the air-gapped workstation.
Before using the workstation:
- Disable or remove Wi-Fi.
- Disable or remove Bluetooth.
- Disable or disconnect Ethernet.
- Disable cellular connectivity.
- Disable network boot.
- Use wired keyboard and mouse.
- Configure BIOS or firmware security controls.
- Use tamper-evident controls required by your operational policy.
- Record the workstation build and configuration in your operations documentation.
Before deployment, prepare:
| Artifact | Why it is needed |
|---|---|
| Cold bridge software | Provides the local UI and API for cold vault operations. |
| Vault stack components | Performs signing with the KMS backend. |
| KMS or HSM configuration | Allows the vault to use protected signing material. |
| Vault configuration | Required to redeploy the same cold vault if the workstation is replaced. |
| Transfer procedure | Defines how .dat files move between online and air-gapped environments. |