Cyclos on PaaS: Running a Community Currency and Payment Platform That a Cooperative Controls End to End

Community currencies, mutual credit networks and loyalty schemes all need the same thing a bank does: a ledger with accounts, transfers, rules and an interface members trust, without a bank's budget. Cyclos, from the Dutch non-profit STRO, has been that software for two decades. This post follows a cooperative deploying it on MassiveGRID PaaS, which is built on Virtuozzo Application Platform, formerly Jelastic, and treating a payment ledger with the seriousness it deserves.

The organisation is a regional cooperative we will call the Ashdown Pound, running a complementary currency accepted by 400 local businesses and held by 4,000 members. The Cyclos 4 PRO package deploys the Cyclos web application on Tomcat with the PostgreSQL database Cyclos requires and persistent storage for documents and images, over HTTPS from the first minute.

What Cyclos does

Cyclos 4 is a payment and online-banking platform: member and business accounts, account types with balance limits and credit rules, transfers between accounts with fees and scheduling, mobile payments through its app and by SMS or NFC where configured, marketplaces and advertisements, and an administration console for the operator. It exposes a REST API and supports scripting, webhooks and payment-gateway integrations, so a scheme can connect to a bank for conversion between the community currency and national money. It is used by complementary currencies, microfinance institutions, loyalty programmes and marketplaces, which is a way of saying that its ledger has been trusted with real value for a long time.

Licensing, stated plainly

Cyclos 4 PRO is licensed by STRO, and the package deploys the software for use under the licence the operator holds. STRO also offers a free Communities edition for smaller schemes and a hosted service. The Ashdown Pound holds a PRO licence, obtained from STRO on the non-profit's terms, and the platform side of the cost is the environment's resource use. The cooperative's treasurer wanted that separation written down: STRO for the software and its support, MassiveGRID for the infrastructure and its SLA, the cooperative for the operation.

Treating a ledger like a ledger

A payment platform's requirements are availability, integrity and confidentiality, and the cooperative's technical volunteer mapped each to platform features rather than to hope.

• Availability. The Tomcat and PostgreSQL containers run on separate physical hosts by anti-affinity, with live migration off a degrading host and a 100% platform SLA. For the database, the volunteer replaced the package's single PostgreSQL with the PostgreSQL Primary-Secondary Cluster in the same environment group, so a standby holds every transaction and Pgpool-II provides the entry point.
• Integrity. Cyclos's own transactional model does the accounting. Around it: the Database Backup/Restore add-on hourly from the standby, WAL archiving for point-in-time recovery, and a quarterly restore drill into a clone with a balance-sum check against production.
• Confidentiality. The environment in an isolated group in the London region; the PostgreSQL SSL/TLS add-on between Tomcat and the database; the container firewall exposing only 443; Let's Encrypt on the members' domain, which the mobile app requires; platform access through collaboration roles so the treasurer can see backups and the region without being able to change topology.

Sizing a Java ledger for 4,000 members

Cyclos is a Java web application; its load is members checking balances and businesses accepting payments, with bursts on market days. The Tomcat node's JVM heap follows its cloudlet allocation, so the volunteer set a 32-cloudlet limit (a cloudlet is 128 MiB of RAM plus 400 MHz of CPU) and let vertical scaling allocate the actual use: 8 to 12 cloudlets on a normal day, 20 on the monthly market Saturday when hundreds of payments happen within hours. The PostgreSQL cluster's nodes sit at 6 to 10. A load alert at 85% for ten minutes goes to the volunteers' chat. The cooperative pays for the market Saturday on the market Saturday.

Upgrades and the mobile app

Cyclos releases regularly and the mobile app expects a compatible server. The volunteer's upgrade path is the platform's standard one: clone the environment, redeploy the clone's Tomcat container with the new Cyclos WAR, run the migration, test with the app against the clone's URL, then repeat on production in an announced window. Because the mobile app pins the members' domain, the certificate is a Let's Encrypt one that renews itself, and a failed renewal would be the outage members noticed first; the cooperative's external monitoring checks the certificate as well as the site.

What it costs to run a currency

About 30 cloudlets an hour across the environment on average, roughly $73 a month before discounts at MassiveGRID's published $0.003372 per cloudlet-hour, plus disk and a public IP; the STRO licence is separate. The cooperative had been quoted a managed hosting arrangement at a multiple of that with a single database server and nightly backups. The treasurer's remark at the annual meeting was that the currency's infrastructure now costs less per member per year than the paper notes it had replaced.

Frequently Asked Questions

Is Cyclos suitable for a loyalty programme or a marketplace rather than a currency?

Yes. Cyclos's account types, transfer rules, marketplace and advertisement features, and API are used for loyalty schemes, time banks, microfinance and marketplaces as well as complementary currencies. The ledger model is the same; the configuration differs.

Can Cyclos connect to a real bank account for conversions?

Yes, through its REST API, payment gateway integrations, webhooks and scripting. A scheme typically connects to a payment provider for members to buy the community currency with national money and for businesses to redeem it, with the integration built by the scheme or a Cyclos partner.

Why PostgreSQL specifically?

Cyclos 4 requires PostgreSQL; the package deploys it. The platform's PostgreSQL cluster package with Pgpool-II is the drop-in upgrade for a standby and an entry point, and the PostgreSQL TLS and backup add-ons apply.