smom-dbis-138/terraform/phases/PHASE1_SUMMARY.md

Phase 1 Deployment Summary

Overview

Phase 1 is the initial deployment to get the DeFi Oracle Meta Mainnet (ChainID 138) operational using a simplified VM-based architecture across 5 US Commercial Azure regions.

Architecture

West Europe (Admin/Control Plane)

• Purpose: Admin-only region, no workload nodes
• Resources:
  • Key Vault for secrets management
  • Nginx Proxy Server (Standard_D4plsv6) to route Cloudflare traffic
  • Networking infrastructure

5 US Commercial Azure Regions (Workload)

• Regions: eastus, westus, centralus, eastus2, westus2
• Per Region:
  • 1 VM using Standard_D8plsv6 (8 vCPUs, Dplsv6 Family)
  • Ubuntu 22.04 LTS Gen 2
  • Docker Engine, NVM, Node.js 22 LTS, JDK 17
  • Besu blockchain client

Infrastructure Components

Modules Created

1. networking-vm (terraform/modules/networking-vm/)

   • Virtual Network (10.0.0.0/16)
   • VM Subnet (10.0.1.0/24)
   • Network Security Group with rules for:
     • SSH (22)
     • P2P TCP/UDP (30303)
     • RPC HTTP (8545)
     • RPC WebSocket (8546)
     • Metrics (9545)

2. nginx-proxy (terraform/modules/nginx-proxy/)

   • Nginx reverse proxy VM (Standard_D4plsv6)
   • Load balancing across 5 US regions
   • SSL/TLS termination (certbot ready)
   • Cloudflare integration ready

3. vm-deployment (updated)

   • Phase 1 cloud-init (cloud-init-phase1.yaml)
   • Installs: Docker, NVM, Node 22 LTS, JDK 17
   • Besu container setup

Networking Security

NSG Rules for Workload VMs

• Inbound:
  • SSH (22): Allow from anywhere (TODO: restrict in production)
  • P2P TCP (30303): Allow Besu P2P
  • P2P UDP (30303): Allow Besu discovery
  • RPC HTTP (8545): Allow from Nginx proxy (TODO: restrict)
  • RPC WebSocket (8546): Allow from Nginx proxy (TODO: restrict)
  • Metrics (9545): Allow Prometheus (TODO: restrict)
• Outbound: Allow all (internet access)

NSG Rules for Nginx Proxy

• Inbound:
  • HTTP (80): Allow from Cloudflare (TODO: restrict to Cloudflare IPs)
  • HTTPS (443): Allow from Cloudflare (TODO: restrict to Cloudflare IPs)
  • SSH (22): Allow for management (TODO: restrict to admin IPs)
• Outbound: Allow all (backend communication)

Deployment Files

Phase 1 Configuration

• terraform/phases/phase1/phase1-main.tf: Main Terraform configuration
• terraform/phases/phase1/variables.tf: Variable definitions
• terraform/phases/phase1/terraform.tfvars.example: Example variables
• terraform/phases/phase1/README.md: Deployment guide

Phase 3 Archive

• terraform/phases/phase3/multi-region-global.tf: Archived 36-region AKS deployment plan

Next Steps

1. Deploy Phase 1:

   cd terraform/phases/phase1
   terraform init
   cp terraform.tfvars.example terraform.tfvars
   # Edit terraform.tfvars with your SSH key
   terraform plan -out tfplan
   terraform apply tfplan
   

2. Configure SSL:

   • SSH to Nginx proxy VM
   • Run certbot to configure SSL certificates
   • Update Cloudflare DNS to point to Nginx proxy

3. Harden Security:

   • Restrict NSG rules to specific IP ranges
   • Configure Cloudflare IP ranges for Nginx proxy
   • Restrict SSH access to admin IPs

4. Monitor and Validate:

   • Verify Besu nodes are syncing
   • Test RPC endpoints through Nginx proxy
   • Monitor VM health and metrics

5. Plan Phase 3 Expansion:

   • After Phase 1 is stable, deploy Phase 3 (36-region global AKS)

Resource Naming Convention

All resources follow: {cloud}-{env}-{region}-{resource}-{instance}

• Cloud: az (Azure)
• Environment: p (prod), d (dev), t (test), s (staging)
• Region: 3-character code (e.g., eus, wus, cus, eus2, wus2, wst)
• Resource: Resource type abbreviation
• Instance: Sequential number (e.g., 001)

Example: az-p-eus-rg-comp-001 (Azure prod East US compute resource group 001)