> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.finrock.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Signer (KMS)

> Deploy the Finrock Cloud Signer (KMS) Docker container on your own infrastructure to sign Legacy and MPC wallet transactions locally with full key control.

Sign transactions locally.

We offer a cutting-edge Key Management Server (KMS) that ensures total ownership and control of private keys for all assets in custody. Our KMS guarantees that Finrock's backend servers cannot access any private keys, Mnemonic Phrases, wallet seeds, or MPC Shares at any point.

Hosted on the client's infrastructure, preferably within environments like AWS or Azure, the KMS performs all signing tasks securely. This setup ensures that private keys/shares remain within the client's controlled environment, never exposing them externally. This provides an uncompromised level of security for asset management and transactions.

> [!WARNING]
>
> **EGRESS ONLY**
>
> The server or the VM where KMS is deployed must allow outbound traffic exclusively, any INGRESS (inbound) traffic must be blocked for all IPs (LAN, MAN, WAN).

**The Cloud Signer (KMS) is available as a docker container via [Docker Hub](https://hub.docker.com/r/finrock/ng-signer)**

```bash docker image theme={null}
docker pull finrock/ng-signer
```

## Config.json file

```json MPC Wallet theme={null}
{
  "signer_mode": "MPC",
  "signer_id": "2df047e7-xxxxx-xxx-xxxxx-77673f0be16c",
  "rsa_prv_key": "ras-----xx",
  "passphrase": "your-secret-password"
}
```

```json Legacy Wallet theme={null}
{
  "signer_mode": "LEGACY",
  "signer_id": "2df047e7-xxxxx-xxx-xxxxx-77673f0be16c",
  "rsa_prv_key": "ras-----xx",
  "srds": [
    "YW1vdW50IGFixxxxxxxxxxxxxxxxxxxyIG1vb24=",
    "YW11c2VkIGFiYW5kbxxxxxxxxxxxxRyZXNzIGdyZWF0"
  ]
}
```

## Starting Signer (detached container)

Use this mode to sign transactions. The software runs as a service and must be supplied with a Config file mounted to the docker container with read-only privileges.

### Running with docker run command

```bash MPC Wallet theme={null}
docker run -d --restart always --name finrock \
  -v "$(pwd)"/config.json:/app/config.json:ro \
  -v "$(pwd)"/keystore:/app/keystore:ro \
  finrock/ng-signer
```

```bash Legacy Wallet theme={null}
docker run -d --restart always --name finrock \
  -v "$(pwd)"/config.json:/app/config.json:ro \
  finrock/ng-signer
```

### Running as docker-compose

```yaml MPC Wallet theme={null}
version: '3'
services:
  signer:
    image: finrock/ng-signer
    container_name: finrock
    restart: always
    volumes:
      - ./config.json:/app/config.json:ro
      - ./keystore:/app/keystore:ro
```

```yaml Legacy Wallet theme={null}
version: '3'
services:
  signer:
    image: finrock/ng-signer
    container_name: finrock
    restart: always
    volumes:
      - ./config.json:/app/config.json:ro
```

## Removing Signer

```bash shell theme={null}
docker rm finrock -f
```

## ENVs

| Variable | Wallet Type | Type | Default Value |
| - | - | - | - |
| `FINROCK_SIGNER_MODE` | Both | ENUM | `LEGACY` or `MPC` |
| `FINROCK_SIGNER_ID` | Both | uuid | Unique ID for signer from Finrock |
| `FINROCK_RSA_PRV_KEY` | Both | rsa-key | RSA Private Key |
| `FINROCK_PASSPHRASE` | MPC | string | passphrase to encrypt MPC keystore |
| `FINROCK_MNEMONIC_PHRASE` | Legacy | string | 12-word seed phrase |
| `FINROCK_SECRET` | Legacy | string | encrypted mnemonic phrase |
| `FINROCK_API_HOST` | Both | string | `https://sapi.finrock.io` \[Default] |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.