Deploy Worker Node

Deploy Worker Node

A worker node represents a domain — an organization that owns data and executes tasks locally, enforcing its own policies.

1. Download Service Images

branectl download services worker -f

2. Generate Configuration

# Backend (how to execute containers)
branectl generate backend -f -p ./config/backend.yml local

# Proxy
branectl generate proxy -f -p ./config/proxy.yml

# Policy secrets and database
branectl generate policy_secret -f -p ./config/policy_deliberation_secret.json
branectl generate policy_secret -f -p ./config/policy_expert_secret.json
branectl generate policy_db -f -p ./policies.db

# Node configuration (generate last)
branectl generate node -f worker <YOUR_HOSTNAME> <LOCATION_ID>

Replace <YOUR_HOSTNAME> with the address reachable by other nodes, and <LOCATION_ID> with this domain’s unique ID (must match the central node’s infra.yml).

Expected file structure

./
  config/
    certs/
    backend.yml
    proxy.yml
    policy_deliberation_secret.json
    policy_expert_secret.json
  node.yml
  policies.db
  target/
    release/

3. Generate Certificates

branectl generate certs -f -p ./config/certs server <LOCATION_ID> -H <HOSTNAME>

Share the ca.pem file with the central node administrator.

4. Configure Policies

By default, all requests are denied. Set up policies before starting:

• Use the Policy Reasoner GUI or branectl
• Generate a token for your policy expert:

branectl generate policy_token <EXPERT_NAME> <DOMAIN_ID> 30d \
  -s ./config/policy_expert_secret.json

See the Policy Guide for writing policies.

5. Start the Node

branectl start worker

Monitor: docker ps

Stopping

branectl stop worker