Files

defiQUG 1fb7266469 Add Oracle Aggregator and CCIP Integration

- Introduced Aggregator.sol for Chainlink-compatible oracle functionality, including round-based updates and access control.
- Added OracleWithCCIP.sol to extend Aggregator with CCIP cross-chain messaging capabilities.
- Created .gitmodules to include OpenZeppelin contracts as a submodule.
- Developed a comprehensive deployment guide in NEXT_STEPS_COMPLETE_GUIDE.md for Phase 2 and smart contract deployment.
- Implemented Vite configuration for the orchestration portal, supporting both Vue and React frameworks.
- Added server-side logic for the Multi-Cloud Orchestration Portal, including API endpoints for environment management and monitoring.
- Created scripts for resource import and usage validation across non-US regions.
- Added tests for CCIP error handling and integration to ensure robust functionality.
- Included various new files and directories for the orchestration portal and deployment scripts.

2025-12-12 14:57:48 -08:00

3.4 KiB

Raw Blame History

Phase 1 Architecture Update: Cloudflare Tunnel + Private IPs

Updated Architecture

Network Configuration

Backend VMs (5 US regions): Private IPs only (no public IPs)
Nginx Proxy (West Europe): Public IP (for Cloudflare Tunnel connection)
Cloudflare Tunnel: Connects to Nginx proxy public IP, handles DNS and SSL termination

Security Benefits

Reduced Attack Surface: Backend VMs have no public IPs, not directly accessible from internet
Cloudflare Protection: DDoS protection, WAF, and SSL/TLS handled by Cloudflare
No Inbound Ports: Cloudflare Tunnel uses outbound connection only
Private Network: Backend VMs communicate via private IPs (once VPN is deployed)

Changes Made

1. VM Module Updates

Removed public IP creation for "besu-node" type
Only "sentry" and "rpc" node types get public IPs (if needed in future)
Backend VMs now use private IPs only

2. Nginx Proxy Updates

Updated to use private IPs for backend connectivity
Added Cloudflare Tunnel installation and configuration
Created systemd service for Cloudflare Tunnel
Added setup instructions in cloud-init script

3. NSG Rules

Updated comments to reflect VPN/ExpressRoute requirement
Noted that RPC rules should be restricted to Nginx proxy subnet once VPN is deployed

Cross-Region Connectivity Requirement

Important: Backend VMs are in US regions while Nginx proxy is in West Europe. Since backend VMs use private IPs only, cross-region connectivity requires:

Option 1: Azure VPN/ExpressRoute (Recommended)

Deploy VPN Gateway or ExpressRoute
Connect all regions via VPN
Nginx proxy can reach backend VMs via private IPs
Most secure option for production

Option 2: Cloudflare Tunnel on Each Backend VM

Install Cloudflare Tunnel agent on each backend VM
Each VM exposes RPC endpoints via Cloudflare Tunnel
Nginx proxy connects to Cloudflare Tunnel endpoints
Simpler setup, but requires Cloudflare Tunnel on each VM

Option 3: Temporary Public IPs (Testing Only)

For initial testing, temporarily enable public IPs
Restrict NSG rules to Nginx proxy IP only
Not recommended for production

Cloudflare Tunnel Setup

See CLOUDFLARE_TUNNEL_SETUP.md for detailed setup instructions.

Quick steps:

SSH to Nginx proxy VM
Run cloudflared tunnel login
Run cloudflared tunnel create <tunnel-name>
Configure /etc/cloudflared/config.yml
Enable and start cloudflared service
Configure DNS in Cloudflare Dashboard

Next Steps

Deploy Phase 1 infrastructure (with current configuration)
Set up Cloudflare Tunnel on Nginx proxy
Deploy VPN/ExpressRoute for backend connectivity OR
Install Cloudflare Tunnel on each backend VM
Test end-to-end connectivity
Restrict NSG rules to specific IP ranges once connectivity is established

Files Modified

terraform/modules/vm-deployment/main.tf: Removed public IPs for "besu-node" type
terraform/modules/vm-deployment/outputs.tf: Updated outputs
terraform/modules/nginx-proxy/nginx-cloud-init.yaml: Added Cloudflare Tunnel setup
terraform/phases/phase1/phase1-main.tf: Updated backend_vms to use private IPs only
terraform/modules/networking-vm/main.tf: Updated NSG rule comments

Documentation Created

CLOUDFLARE_TUNNEL_SETUP.md: Detailed Cloudflare Tunnel setup guide
ARCHITECTURE_UPDATE.md: This file

3.4 KiB Raw Blame History