Deploy an L1 with Terraform and Ansible

Configure Cloud Credentials and SSH

# AWS
export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"

# Generate an SSH key for node access
ssh-keygen -t rsa -b 4096 -f ~/.ssh/avalanche-deploy -N ""

For GCP, authenticate with gcloud auth application-default login. For Azure, use az login.

Configure Terraform Variables

cd terraform/l1/aws    # or terraform/l1/gcp, terraform/l1/azure
cp terraform.tfvars.example terraform.tfvars

Edit terraform.tfvars:

name_prefix              = "my-l1"
environment              = "fuji"        # or "mainnet"
validator_count          = 5
rpc_archive_count        = 1
rpc_pruned_count         = 1
ssh_public_key           = "ssh-rsa AAAA..."
ssh_private_key_file     = "~/.ssh/avalanche-deploy"
enable_staking_key_backup = true

Provision Cloud Infrastructure

make infra    # Runs terraform init && terraform apply

This creates all VMs, networking (VPC, subnets, security groups), and storage (S3 bucket for staking keys if enabled). Terraform auto-generates the Ansible inventory at ansible/inventory/aws_hosts.

Deploy AvalancheGo

make deploy
make status    # Wait for "P:OK" on all nodes

This runs playbook l1/deploy-nodes.yml, which:

• Installs AvalancheGo on all nodes
• Starts syncing with the Primary Network using partial-sync-primary-network: true (syncs only P-Chain headers — much faster than a full sync)
• Collects NodeIDs and saves them to ansible/node_ids.txt
• Backs up initial staking keys to S3 (if configured)

Configure Your Genesis

Before creating the L1, prepare your genesis file at configs/l1/genesis/genesis.json.

Use the Genesis Builder to generate this visually, or edit the included template.

Key settings:

• chainId — Unique EVM chain ID (check availability)
• feeConfig — Gas limits and base fees
• warpConfig — Cross-chain messaging with quorumNumerator: 67
• alloc — Pre-funded addresses and pre-deployed contracts

Create Your L1

# Import or create a deployer key
platform keys import --name l1-deployer
platform keys default --name l1-deployer

# Build and run the create-l1 tool
make create-l1
./tools/create-l1/create-l1 \
  --network=fuji \
  --key-name=l1-deployer \
  --validators=$(cd terraform/l1/aws && terraform output -json validator_ips | jq -r 'join(",")') \
  --chain-name=mychain \
  --output=l1.env

The create-l1 tool executes three P-Chain transactions:

1. CreateSubnetTx — Creates a new Subnet (returns SUBNET_ID)
2. CreateChainTx — Creates the EVM chain with your genesis (returns CHAIN_ID)
3. ConvertSubnetToL1Tx — Converts the Subnet to an L1, registering all validators with their BLS keys

The output l1.env file contains SUBNET_ID, CHAIN_ID, CONVERSION_TX, and EVM_CHAIN_ID.

Configure Nodes for Your L1

source l1.env
make configure-l1 SUBNET_ID=$SUBNET_ID CHAIN_ID=$CHAIN_ID
make status

This runs playbook l1/configure.yml, which:

• Adds track-subnets: <SUBNET_ID> to each node's config
• Copies the appropriate chain config (archive, pruned, or validator)
• Restarts AvalancheGo on all nodes
• Automatically deploys eRPC as a load balancer (auto-detects EVM chain ID from genesis)