> For the complete documentation index, see [llms.txt](https://entrytarget.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://entrytarget.gitbook.io/docs/getting-started/provisioning.md).

# Provisioning

EntryTarget runs on AWS infrastructure — Fargate for compute and RDS PostgreSQL for storage — in **your own AWS account**. Everything starts at the vendor Console.

## 1. Register on the Console

Create an account at `https://console.entrytarget.com/`, providing:

* Contact information
* The **AWS Account ID** where your ledger will run

Your container image is built specifically for your AWS account. It cannot run on a different AWS account, on EC2, or on non-AWS infrastructure — a mismatch stops the process at startup with an "Environment mismatch" error.

## 2. Deploy

Deployment is **vendor-managed**: you provide an AWS access key in the Console, and the vendor deploys a CloudFormation stack in your AWS account that provisions:

* **VPC** with proper networking and subnets
* **Fargate service** running the container image — one task
* **RDS PostgreSQL** master instance
* **RDS Read Replica** (recommended)
* **Security Groups** with appropriate access rules

The stack sizes infrastructure and runtime configuration to the tier preset you choose (below). Self-deployment is also possible if you have specific AWS requirements — you receive the container image and the database schema, create the RDS instances, apply the schema, and run the image as a Fargate task with the [environment variables](/docs/operations/environment-variables.md) set. Only the two database URLs are mandatory.

{% hint style="danger" %}
**Run exactly one instance.** EntryTarget runs as a single process — Fargate desired count 1, no autoscaling. Running more than one instance against the same database is unsupported and must never be done. To handle more volume, scale **vertically**: a bigger Fargate task, a bigger RDS instance, a higher tier preset. See [Deployment](/docs/operations/deployment.md).
{% endhint %}

## 3. Choose a Performance Tier

Tiers are **configuration presets** — recommended infrastructure sizing and environment-variable values for the workload you expect. They have no billing effect and are never enforced; billing is a fixed monthly price regardless of tier or volume.

| Tier | Fargate       | RDS Master    | RDS Replica   | `LEDGER_BATCH_SIZE` | `LEDGER_BATCH_TIMEOUT_MS` | `LEDGER_DB_POOL_SIZE` | gp3 IOPS |
| ---- | ------------- | ------------- | ------------- | ------------------- | ------------------------- | --------------------- | -------- |
| 1    | 1 vCPU / 2 GB | db.t4g.medium | db.t4g.medium | 150                 | 20                        | 10                    | 3000     |
| 2    | 2 vCPU / 4 GB | db.r8g.large  | db.r8g.large  | 200                 | 15                        | 20                    | 6000     |
| 3    | 4 vCPU / 8 GB | db.r8g.xlarge | db.r8g.xlarge | 300                 | 10                        | 40                    | 12000    |

Every tier is a **single Fargate task**. Moving up a tier means a bigger task and a bigger RDS — never a second instance.

Recommended for all tiers: `LEDGER_IDEMPOTENCY_MAX_KEYS ≥ peak TPS × desired replay window in seconds` (see [Idempotency](/docs/concepts/idempotency.md)).

## 4. Network Access

| Source        | Destination | Port | Purpose          |
| ------------- | ----------- | ---- | ---------------- |
| Fargate       | RDS Master  | 5432 | Write operations |
| Fargate       | RDS Replica | 5432 | Read operations  |
| Your services | Fargate     | 8080 | API access       |
| Prometheus IP | Fargate     | 8080 | Metrics scraping |

{% hint style="warning" %}
The `/metrics` endpoint has no authentication. Restrict access to your Prometheus scraper's IP via Security Groups.
{% endhint %}

TLS to the database is automatic in production builds — there is no TLS environment variable to set.

## 5. Next Steps

1. [Set up API credentials](/docs/getting-started/credentials.md)
2. [Create accounts and execute your first transaction](/docs/getting-started/first-transaction.md)

For day-2 operations — environment variables, observability, backups, maintenance — see the [Operations](/docs/operations/deployment.md) section.