Deploy WebVH Hosting appliance

By the end of this guide, you will have an active Affinidi-hosted WebVH Hosting appliance, linked to your VTA.

Affinidi provisions and operates the underlying infrastructure. You link the appliance to your Verifiable Trust Agent (VTA) and mediator when you create it, then activate it with one PNM command that grants its temporary setup DID access to your VTA.

Use this guide when you want Affinidi to manage hosting infrastructure on your behalf. To run WebVH Hosting on your own infrastructure instead, see Self-hosted (open source): unified daemon or Self-hosted (open source): standalone services.

Choose the appliance size

Match your VTA and mediator to the WebVH Hosting appliance size you plan to create. Choose before you deploy them, because a VTA’s mode and size, and an appliance’s size, are fixed at creation.

• Basic runs on a shared network, so use it for evaluation and development. It also works with an Enhanced VTA.
• Enhanced is recommended for production. Its Isolated VTA runs in an AWS Nitro Enclave, a Trusted Execution Environment (TEE), with hardware-rooted attestation, keys and data. Enhanced is available on the Standard and Enterprise plans.
• Advanced is the largest size, available on the Enterprise plan.

For the VTA’s modes and the sizes each plan includes, see Isolated and Shared modes.

Prerequisites

• Rust 1.95 or later installed on your machine, to compile the PNM CLI.
• A running Verifiable Trust Agent (VTA) with a did:webvh DID. Your VTA creates, signs, and publishes your DIDs to the WebVH Hosting appliance.
• A Mediator DID for DIDComm-based message routing, based on did:web, did:webvh, or did:peer. See Affinidi DIDComm Mediator. If the mediator’s Mediator ACL mode is Explicit Allow, your VTA DID must be on its allow list. See Deploy VTA appliance for how to add it.
• Super-admin access to your VTA, which creating the webvh context in Step 3 requires. See Deploy VTA appliance.

Step 1. Install the PNM CLI

PNM connects to your VTA and runs the command that activates the appliance. Install the same PNM version the VTA documentation uses, so PNM, your VTA, and the appliance work together:

cargo install pnm-cli@0.45.0 --locked --registry crates-io

Confirm the installation

pnm help

If PNM is already installed at this version and connected to your VTA, skip to Step 2.

Step 2. Provision the appliance in Affinidi Portal

1. Log in to Affinidi Portal and select your project.

2. Under Affinidi Elements in the left sidebar, select WebVH Hosting.

3. Click Create configuration and fill in the fields:

   

   Field	What to enter
   Name of configuration	A name for your own reference, 3 to 64 characters, including at least one letter or number. Defaults to Default WebVh Hosting.
   Description - optional	A short note on the purpose of this instance.
   Verifiable Trust Agent DID	Choose your VTA’s DID from the list, or select ＋ Enter custom VTA DID and paste it. If the project has no VTAs, type the DID directly. Must be a did:webvh DID. Cannot be changed after creation.
   Mediator DID	The mediator DID from Before you begin. Must be based on did:web, did:webvh, or did:peer. Cannot be changed after creation. To deploy one, see Deploy an Affinidi-hosted mediator.
   Appliance size	The size you chose in Choose the appliance size. Basic is the default and the only size on the Essential and Community plans. Enhanced is on the Standard and Enterprise plans, and Advanced on Enterprise. Fixed after creation.
   Version	Shown only when more than one version is available. Leave the default.

4. Click Create. The Portal returns to the WebVH Hosting list, where the new configuration’s Deployment state shows Pending, then In Progress, while Affinidi provisions the infrastructure.

5. Click the configuration name to open its details page. Setup State shows Inactive until you complete Step 3.

Step 3. Activate the appliance with PNM

The details page shows the activation steps under Steps to activate your WebVH setup.

1. Wait for Deployment state to show Complete. Under Step 1: Grant the setup DID access to your VTA, Generating setup DID changes to the command generated for your appliance. The command grants the appliance’s temporary setup DID, a did:key, admin access to a webvh context in your VTA. The --admin-handoff flag lets the setup DID hand that access over once, to the appliance’s long-term admin DID. The long-term entry has the same expiry as your own VTA admin entry, and is permanent if yours is.

   

2. Click Copy. The copied command looks like this, with --name and --admin-did pre-filled for your appliance:

   pnm contexts create --id webvh --vta <vta-name> --name webvh-<subdomain> --admin-did <setup-did> --admin-expires 6h --admin-handoff

3. Replace <vta-name> with your VTA’s slug, the local name PNM uses for your VTA, and run the command.

4. Return to the configuration’s details page and, under Step 2: Confirm the grant, click I’ve run the command.

5. Wait while activation completes, which can take a few minutes. The page updates automatically: when activation succeeds, Setup State changes to Active, the activation steps disappear, and Server DID shows the appliance’s permanent did:webvh.

   Mediator in Explicit Allow mode

   The appliance connects to its mediator as its Server DID. A mediator in Explicit Deny mode, the default, accepts it without further setup. A mediator whose Mediator ACL mode is Explicit Allow accepts connections only from DIDs on its allow list, as described in Supported Access Control Lists (ACLs), so add the Server DID to that list as soon as it appears.

   Portal keeps a saved DID on the list permanently, so check the DID before you save:

   1. In Affinidi Portal, select DIDComm Mediator in the left sidebar and open your mediator’s configuration.
   2. Under Access Controls, click Edit.
   3. Click Add DID, paste the Server DID into User’s DID, leave Blocked cleared, and click Save.

Confirm

Test 1: Setup State shows Active

Expected result: on the configuration’s details page, Setup State shows Active.

Note these two values for the next guide:

• Server DID: on the configuration’s details page. It shows Available after activation until Setup State is Active, then the appliance’s permanent did:webvh.
• WebVH URL: on the configuration card in the WebVH Hosting list. Its host is the domain of every DID you create on this appliance.

Troubleshooting

Next steps

• Create your first hosted DID: register the appliance with your VTA and publish a did:webvh identifier on it.
• Create and manage DIDs: update, inspect, and delete DIDs on the appliance.
• Glossary: terms used across these pages and in pnm output.