Overview

Fireblocks On-Prem Exchange Service (FOPES) allows you to store credentials and connect to third-party accounts, such as exchanges and fiat bank accounts from a managed environment. FOPES can be deployed on-site on your company's premises, or in a cloud environment.

Setup

Step 1: Machine provisioning

The FOPES machine should be SGX-enabled. For more details on how to provision an SGX-enabled machine see here.

Make sure the machine meets the following technical and security requirements:

OS - Ubuntu 18.04 or above
Latest Linux kernel version
Latest Intel microcode (BIOS update). Note that the microcode is automatically updated on Azure.
No inbound connections
Outbound - only port 2020 (TCP)
The installation phase requires a Docker registry, auth port 443 and 5000 for transport
Mandatory - provide the FOPES SGX Machine IP address to Fireblocks support for whitelisting purposes.

Step 2: Software installation

On the FOPES machine:

Enter root mode:
```
sudo -i
```
Download Fireblocks On-Prem Exchange Service CLI script (fopes-cli). The download link is then provided to you separately by the Fireblocks support team:
```
curl -o fopes "<<Download Link>>"
```
Change the script's permissions to be executable:
```
chmod +x fopes
```
The CLI script now requests that you enter the following inputs:
```
./fopes setup
```
- Fireblocks API Key - An API key issued on your Fireblocks workspace used for authentication
- Unique Instance Name - A unique FOPES instance name provided to you by Fireblocks

The CLI script verifies the underlying hardware and installs the drivers that support the correct version of SGX and the FOPES executable. The installation process includes an attestation flow that assures that the FOPES executable runs inside a secure Intel SGX enclave.

Start FOPES:

./fopes start

Account management

Connect an account

Retrieve the exchange credentials public key:

./fopes print-cred-pub-key > fopes-cred.pub.pem

Encrypt the exchange credentials in a secure machine and transfer the encrypted output into the FOPES machine. The exchange credentials are formatted as a JSON object and the structure is specific to the exchange type.
This can be done using OpenSSL on a Linux machine accordingly (creds.json is the file that contains the exchange secrets):
```
cat creds.json | openssl pkeyutl -encrypt -inkey fopes-cred.pub.pem -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha256 -pubin | base64 -w 0 > FILE_NAME.txt
```
Add the new account as follows:
```
./fopes add-account
```
You are then prompted with the following inputs:
- account-name - The unique name of the account you are connecting
- account-type - The account type. (e.g. COINBASE)
- account-key - The account API key or equivalent
- account-creds - The content of the encrypted JSON secrets file (base64 format)
- parent-account-id - (optional) The parent account ID. (When adding a sub-account)
- proxy-url - (optional) Proxy URL if you would like to pass the HTTPS requests through a proxy server.

The command output is the new account ID.

Admin quorum approval is required once the account is created. See further information in the Admin Quorum guide.

List account connections

Run:

./fopes list-accounts

Remove an account connection

Run:

./fopes remove-account <<account id>>

Backup & recovery

These locations are important for backup and recovery:

/databases/fopes/db - FOPES DB folder stores the secrets.db file, which is the FOPES secrets database. This db file is encrypted with a key generated inside a secure SGX enclave.
/databases/fopes/enclave/ra_loader_enclave.signed.so - The enclave loader. This file is required for seamless migration to a different server at any point in the future. Make sure to securely back up this file.

Recovery on the same machine

If you migrated your Azure instance to a different server, or you restarted your current server, run the following command line to initiate FOPES (this assumes that all the files under /databases/fopes were kept in place):

./fopes start

Deployment on a new server

Retrieve the backed-up copies of secrets.db and ra_loader_enclave.signed.so and copy each file to the following locations on the new server:
/databases/fopes/db/secrets.db
/databases/fopes/enclave/ra_loader_enclave.signed.so

After the above-mentioned files have been copied to the new server, run:

./fopes start

Software upgrades

Fireblocks notifies customers when a software update becomes available.

To update, run the following command:

./fopes upgrade

Monitoring

FOPES is docker-based and uses the docker JSON file driver for logging. The default output of the driver is standard output but can be configured to support other logging mechanisms.

For retrieving FOPES logs, run the following command:

./fopes logs

The log file is written to the /databases/fopes/log directory.