Quickstart

Five minutes from nothing to a working node. You need Docker with Compose, Go, Rust (cargo), and SSH access to the private identity module (see CONTRIBUTING.md).

make identity-proxy     # fetch the identity module on this machine, for the image build
make limitd-vendor      # and the limits sidecar's crates, which include the identity's hdtp-limits
docker compose up -d    # the node and its limits sidecar (SPEC §5.7)
docker compose logs hdtp-gateway | grep -A2 "setup"

The log prints your portal URL and a one-time setup token. Open it — the wizard registers your first passkey, which is the node’s only login, on every bind including loopback. Register a second on another device: there is deliberately no online recovery path. If you lose them all, recovery needs shell access on the host — hdtp-gateway passkey reset-wizard mints a one-time link that re-opens registration.

Then create the identity people will reach, and have your wallet certify this node for it (see Your wallet):

docker compose exec hdtp-gateway hdtp-gateway account create --slug me --name "Your Name"
docker compose exec -T hdtp-gateway hdtp-gateway account csr --slug me > me.csr
hdtp id create --name "Your Name" --vault me.hdtp-vault.json
hdtp id issue --vault me.hdtp-vault.json --csr me.csr --chain-out chain.pem
docker compose cp chain.pem hdtp-gateway:/tmp/chain.pem
docker compose exec hdtp-gateway hdtp-gateway account install-leaf --slug me --chain /tmp/chain.pem

Open Card in the portal and download me.vcf. That is what you hand to people. Until the chain is installed there is no card: the page says the account has no certificate yet.

This quickstart is not prose someone hopes still works. An automated scenario builds these images, drives the portal through a real Chrome, registers a passkey with a virtual authenticator, and pairs a contact. Running it as written is how three bugs in it were found.