33. Deployment Guide

33.1 Part 1: Build Machine

It is highly recommended to separate the build environment from the run environment. Use a high-CPU instance (e.g., AWS c6a.8xlarge) to compile the binaries and run the 1,700+ test suite, then stage the binaries to a dist/ folder. Ensure glibc compatibility if compiling on Ubuntu 24.04 and running on an older OS.

33.2 Part 2: Run Machine

Deploy the built binaries to the run machine (e.g., AWS i4i.2xlarge with instance-store NVMe).

Host Hardening: Run the included ops/harden.sh script to disable swap, tune the TCP stack, and raise file descriptor limits (ulimit -n 65535).
Memory Tuning: RocksDB block caches should be tuned in config.toml to consume no more than 60% of available RAM, leaving the rest for the OS page cache.

33.3 Part 3: Public RPC (Full Nodes Only)

[!CAUTION] Validators Should Not Serve Public RPC. Validator nodes must minimize their attack surface. Running a public RPC endpoint on a validator exposes it to DDoS attacks that can cause missed slots and slashing.

To run a public RPC node:

Run kortanad bound to 127.0.0.1.
Place a TLS Edge Proxy (nginx or HAProxy) in front of it.
Apply strict rate limiting (e.g., 5 req/sec/ip).