MMashDiv

Installing Ecosystem

Install ScyllaDB, generate the wallet encryption key, enable the extension and verify the matching engine actually started — in the order that avoids losing data.

11 min readUpdated 3 September 2026install, scylladb, redis, kms, extension

Ecosystem installs in four stages: a ScyllaDB node, the vault key that encrypts every private key the addon will ever create, the extension itself, and a restart. The order matters. Creating a master wallet before the vault key exists fails; generating a new vault key after wallets exist destroys them.

The main installer does not touch any of this. There is not a single mention of ScyllaDB in installer.sh, and none of the variables below appear in .env.example. Every step here is manual.

Before you begin

  • A working Bicrypto install — backend, frontend and cron running under PM2
  • Redis reachable and answering PING (the core already requires it)
  • Root or sudo on the box that will run ScyllaDB
  • The purchase code for EcoSystem & Native Trading (product ID 40071914), from your MashDiv dashboard — stage 4 activates it
  • Shell access to the project root — several steps have no admin-panel equivalent
  • A safe place to store a passphrase you can never lose

ScyllaDB can live on the app box or its own. On the app box, budget for it properly: ScyllaDB wants 4 GB minimum and recommends roughly 2 GB per logical core. It is an SSD workload and it will fight the Node processes for memory on a small VPS.

1. Install ScyllaDB

ScyllaDB ships two official install paths. The web installer is what ScyllaDB recommends for new installs; the APT route gives you direct control over the repository, which matters if your server may not pipe a script from the internet into sudo bash.

curl -sSf get.scylladb.com/server | sudo bash

# or pin a release
curl -sSf get.scylladb.com/server | sudo bash -s -- --scylla-version 2026.1
sudo apt-get update
sudo apt-get install -y curl gpg wget

sudo mkdir -p /etc/apt/keyrings
sudo gpg --homedir /tmp --no-default-keyring --keyring /tmp/temp.gpg \
  --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys c503c686b007f39e
sudo gpg --homedir /tmp --no-default-keyring --keyring /tmp/temp.gpg \
  --export --armor c503c686b007f39e | sudo gpg --dearmor \
  -o /etc/apt/keyrings/scylladb.gpg
sudo wget -O /etc/apt/sources.list.d/scylla.list \
  https://downloads.scylladb.com/deb/debian/scylla-2026.1.list

sudo apt-get update
sudo apt-get install -y scylla

Modern ScyllaDB releases are self-contained and no longer need a separate Java 8 install. The signing key also moved: the fingerprint is now c503c686b007f39e, and the repository list lives under /deb/debian/ rather than /deb/ubuntu/.

Then configure and start it.

  1. Edit /etc/scylla/scylla.yaml — two changes.

    Change api_port: 10000 to api_port: 10001. Port 10000 is Virtualmin's default and the clash is silent until Scylla refuses to start.

    Uncomment and set the authenticator so the cluster is not open to anything that can reach port 9042:

    authenticator: PasswordAuthenticator

  2. Run the setup wizard — it tunes the kernel, disks and network for you.

    sudo scylla_setup

  3. Start and enable the service.

    sudo systemctl start scylla-server
sudo systemctl enable scylla-server
sudo systemctl status scylla-server

  4. Create a role for the platform. The default superuser is cassandra:cassandra and must not stay that way.

    cqlsh -u cassandra -p cassandra

    Then, at the cqlsh prompt:

    CREATE ROLE IF NOT EXISTS bicrypto
  WITH PASSWORD = 'a-long-random-password'
  AND LOGIN = true
  AND SUPERUSER = true;

    Exit, reconnect with the new credentials, and run describe keyspaces; to prove they work.

Do not create keyspaces or tables by hand. The client creates SCYLLA_KEYSPACE and SCYLLA_FUTURES_KEYSPACE — and every table and index inside them — on its first successful connection, and it runs its own column migrations on every subsequent boot.

Port 9042 must be reachable from the backend and from nowhere else. Loopback or a private network only.

2. Add the ScyllaDB variables

None of these are in .env.example. Add them by hand to the project root .env.

SCYLLA_CONNECT_POINTS="127.0.0.1:9042"
SCYLLA_DATACENTER="datacenter1"
SCYLLA_USERNAME="bicrypto"
SCYLLA_PASSWORD="a-long-random-password"
SCYLLA_KEYSPACE="trading"
SCYLLA_FUTURES_KEYSPACE="futures"

SCYLLA_DATACENTER must match the datacenter name the node itself reports, not a name you choose. Authentication is only attached when both username and password are set — half a pair is the same as none.

If Scylla is unreachable the backend probes the first contact point with a short TCP check, logs that trading is unavailable, and carries on booting. Everything except trading keeps working. Setting SCYLLA_ENABLED="false" makes that state deliberate and stops the connection attempts entirely.

3. Generate the vault key

This is the step people skip and regret. The vault key encrypts every master wallet and every per-user deposit key the addon will create.

node ./scripts/kms/generate.mjs

It generates a random 32-byte key, prompts for a passphrase of at least 12 characters, encrypts the key with AES-256-GCM (PBKDF2, 100,000 iterations, SHA-512) and writes the result back to .env as ENCRYPTED_ENCRYPTION_KEY — four colon-separated hex parts: IV, auth tag, ciphertext, salt.

If ENCRYPTED_ENCRYPTION_KEY is already set, the script prints "already set" and does nothing. That guard is deliberate.

ENCRYPTED_ENCRYPTION_KEYtype: secret
The encrypted master key. Four colon-separated hex parts. Required for every wallet operation.
ENCRYPTION_KEY_PASSPHRASEtype: secret
The passphrase that decrypts it. Optional — set it and the vault unlocks itself at boot; leave it out and an admin must unlock manually after every restart.

Lose the passphrase, or replace ENCRYPTED_ENCRYPTION_KEY with a fresh one, and every wallet already stored becomes permanently unreadable — including the addresses customers have already deposited to. No support process can undo it. Back up .env somewhere your database backup does not live, and store the passphrase separately from both.

The trade-off on ENCRYPTION_KEY_PASSPHRASE is real and yours to make. With it, restarts are unattended and withdrawals resume by themselves. Without it, the passphrase never touches the disk, but the vault starts locked after every restart and withdrawal signing stays dead until someone opens /admin/ecosystem and enters it.

4. Enable the extension

Three things happen on the product's own page, in this order: the licence is activated, the release is installed, and only then is the addon switched on. Then one restart, because the matching engine only starts while the backend boots.

  1. The EcoSystem & Native Trading card — click it to open the product page
  2. Its switch stays disabled, reading Activate license first, until the licence is activated

  1. Open the Extension Manager. Go to Admin → System → Extension Manager. On the Extensions tab (or by searching for EcoSystem) find the EcoSystem & Native Trading card and click it. Until its licence is activated the card reads Activate and its switch is disabled — hover it and the tooltip reads Activate license first.

  2. Activate the licence. On the product page press Activate License. Paste the purchase code from your MashDiv dashboard, optionally an email address for update notifications, and press Activate License. The screen confirms License Activated! and sends you back to the product page a couple of seconds later. If the server has no outbound access, the License File tab on the same screen takes the licence certificate downloaded from your MashDiv dashboard instead: place it as license.txt in the lic folder at the project root and press the button on that tab.

    1. Paste the purchase code here
    2. Activate License — then wait for the redirect back to the product page
    3. The License File tab, for a server with no outbound HTTPS

  3. Install the release. Back on the product page, now licensed, the Overview tab has a release panel. If it offers Install v…, press it; if it says Up to date on a product you have only just licensed, press Check for Updates once, then install whatever it offers. The Releases tab holds the notes for the version you are being offered — read them first.

    Install downloads the release, verifies it and extracts it over the project root. It runs no migrations, builds nothing and restarts nothing, so finish it from a shell on the server:

    pnpm updator

    That is the finalise chain — stop, dependencies, schema, seed data, frontend build, start — and it is what makes the addon's tables, routes and screens exist. It is also what the licensed chain add-ons (Solana, Tron, TON, Monero) build on, so on a managed box a plain restart is not a substitute. If the panel still says Up to date after the check there is nothing to download; go straight to the next step.

    1. Check for Updates, then Install v… when it is offered
    2. Releases — the notes for the version you are about to install
    3. The Enabled switch — step 4, not yet

  4. Switch it on, then restart. Turn the Enabled switch on — in the product page heading, or on the card in the Extension Manager, which is usable now that the licence is verified. This is what makes Blockchain Ecosystem appear under Admin → Extensions → Trading Platforms (/admin/ecosystem) and lets the addon's API answer; until it is on, neither exists.

    The switch does not start the matching engine, though. The engine and the ScyllaDB connection are brought up while the backend boots, and only when the addon is already on — so restart both backend processes:

    pm2 restart backend cron

    Until that restart the engine is not running and the trading keyspace does not exist, which is exactly what the checks below would tell you. Turning the addon off later is the same switch; it leaves the licence in place, so switching it back on needs no reactivation.

5. Verify

Four checks, in increasing order of confidence.

cqlsh -u bicrypto -p '…' -e "DESCRIBE KEYSPACE trading;"

You should see orders, candles, orderbook, trades, open_orders_by_market, eco_index_state and stop_orders. If the keyspace does not exist, the backend has never connected — either it was not restarted after the addon was switched on, or Scylla is unreachable. Check the logs for SCYLLA.

pm2 logs backend --lines 200 | grep -i "ECOSYSTEM\|SCYLLA"

Then open /admin/ecosystem. The masthead shows the vault state: a green "Vault Active" badge, or an "Initiate Vault" button if it is locked. Unlock it now if you did not set the passphrase.

Finally, open Ecosystem → Blockchains → Requirements. Nothing is configured yet, so every chain will report missing variables — that is the correct answer at this point, and that page is where you go next.

What is still missing

A working install at this point has an engine and no chains, no wallets, no tokens and no markets. In order:

  1. Enable at least one blockchain
  2. Create its master wallet
  3. Add tokens
  4. Create a market

The platform's own database backup covers MySQL and nothing else. Orders, candles, the trade tape and the order book have no backup path in the product. Set up nodetool snapshot or an equivalent before you take real orders, not after.