33. Deployment Guide

33.1 Part 1: Build Machine

Production validator deployments should strictly separate binary compilation from runtime execution. Compile the node binaries on a dedicated build machine equipped with multi-core CPUs and adequate RAM to prevent compilation overhead from impacting production nodes.

Compile the binaries using full compiler optimization flags (-O3 -march=native -flto), run the automated test suite (ctest) to verify build integrity, and stage the compiled binaries into a secure distribution repository.

33.2 Part 2: Run Machine

Before deploying kortanad to a production server, execute the security and performance hardening script ops/harden.sh.

The script applies critical operating system kernel optimizations:

• File Descriptors: Sets ulimit -n 65535 to allow high-concurrency P2P and WebSocket connections.
• Network Buffers: Tunes TCP receive and send buffer sizes (sysctl -w net.core.rmem_max=16777216).
• Memory Tuning: Disables OS swap (swapoff -a) to prevent latency spikes caused by paging database buffers to disk.
• Systemd Setup: Installs hardened systemd service units with automatic restart policies and resource sandboxing.

33.3 Part 3: Public RPC (Full Nodes Only)

When deploying full nodes intended to serve public Web3 traffic, node operators must isolate the kortanad daemon behind a hardened reverse proxy (such as Nginx, HAProxy, or Cloudflare).

The reverse proxy terminates SSL/TLS connections, validates HTTP request formats, blocks malicious JSON-RPC payloads, and enforces per-IP rate limiting (e.g., 100 requests per minute). The backend kortanad daemon binds exclusively to 127.0.0.1:8545, ensuring that direct unauthenticated network access is prohibited.

---