Deployment profiles

The manifest’s deployment.profile names the shape of the deployment. Three profiles exist, and the difference between them is constraint, not code: the same binaries, the same manifest schema, different validated guarantees.

	reference	whitelabel	sovereign
Purpose	the hosted public deployment	an organization’s own instance	on-prem, jurisdiction-pinned
Egress default	external (upstreams permitted)	operator’s choice	none unless a reason is recorded
Residency	unpinned	commonly pinned	pinned (CN, EU, JP, …)
Branding	UniDPP defaults	full branding block	full branding block
Packs	dual-suite pilot policy	typically ecdsa-p256	jurisdiction suite (e.g. sm2)
Validation delta	—	—	egress × reason rule enforced

reference

The public demonstration deployment: ten services (the eight stack services, the console, and the JP peer), loopback binds, named tunnels to the chosen public surfaces. Egress is external because the stack’s services call each other as upstreams (issuer → registry, gateway → issuer, archive → log). It runs in dev mode, with open mutations and seeded-dev keyrings, because it exists to be probed, not trusted.

whitelabel

An organization’s own deployment: its name, product name, logo, theme, and footer on the same console and explorer surfaces. Zero code differs from the reference deployment; the branding block is the whole difference, and the console renders it live.

The pilot workspace runs one whitelabel tenant, acme-eu:

tenants/acme/unidpp-operator.yaml (excerpt)

api_version: unidpp.org/v1
deployment:
  name: acme-eu
  profile: whitelabel
  base_url: https://dpp.acme-mobility.example.org
branding:
  organization: ACME Mobility
  product_name: ACME Digital Product Passport
  theme:
    primary: "#7c3aed"
    accent: "#f59e0b"
  footer:
    legal_url: https://www.acme-mobility.example.org/legal
    contact_url: mailto:dpp@acme-mobility.example.org
services:
  registry: { bind: 127.0.0.1:9390, state_file: tenants/acme/registry-journal.jsonl }
  issuer:   { bind: 127.0.0.1:9393, state_file: tenants/acme/issuer-journal.jsonl, pack_suites: [ecdsa-p256] }
  console:  { bind: 127.0.0.1:9389 }
sovereignty:
  data_residency: EU
  external_calls: none

Three services, EU residency, egress sealed. The full walkthrough, including the console serving the branded chrome, is the 15-minute whitelabel deployment.

sovereign

The on-prem, jurisdiction-pinned shape. Two hard rules the validator enforces (these are load-time refusals, not conventions):

1. Egress needs a reason. A sovereign manifest with external_calls: tsa-only or external must carry a non-empty egress_override_reason; the recorded justification is part of the deployment record.
2. The log cannot contradict the policy. A sovereign deployment with a external_tsa_url set while external_calls is none is refused, even with an override reason on record.

The pilot workspace runs one sovereign tenant, acme-cn:

tenants/acme-cn/unidpp-operator.yaml (excerpt)

api_version: unidpp.org/v1
deployment:
  name: acme-cn
  profile: sovereign
  base_url: https://dpp.acme.cn.example.org
branding:
  organization: ACME 华动
  product_name: ACME 产品数字护照
  theme:
    primary: "#b91c1c"
    accent: "#991b1b"
services:
  registry: { bind: 127.0.0.1:9590, state_file: tenants/acme-cn/registry-journal.jsonl }
  issuer:   { bind: 127.0.0.1:9593, state_file: tenants/acme-cn/issuer-journal.jsonl, pack_suites: [sm2] }
  console:  { bind: 127.0.0.1:9589 }
sovereignty:
  data_residency: CN
  external_calls: none

Note the pack policy: pack_suites: [sm2], so every pack this issuer mints is signed with the SM2 suite, and nothing else. A verifier in that jurisdiction pins the SM2 anchor from the issuer’s keyring and verifies accordingly.

Choosing ports

Reference services occupy 8389-8396 and 8399 (the JP peer). Tenants take their own ranges; the acme tenants use 939x, the CN tenant 959x, declared per service block in the manifest. A tenant’s ports are its own; collisions between tenants are a manifest problem you find at validation or launch, not a runtime surprise.

What a profile is not

A profile does not select features, editions, or modules of the software. All services exist for all profiles; what changes is which blocks the manifest declares (absent = not deployed), which keys sign (suites), what may leave the box (sovereignty), and what the surfaces look like (branding).