<commit_before># Recommended design for DCL MainNet deployment on AWS
![](./deployment-aws.png)

## Recommended IaC frameworks
- [Terraform](https://www.terraform.io) - for setting up AWS infrastructure
- [Ansible](https://www.ansible.com) - for provisioning DCL nodes

## Node specific AWS and DCL configurations

### Validator Node:
- Tendermint:
    - [config.toml]
        - [p2p]
            - `pex` = false
            - `persistent_peers` = [private sentry nodes with private IPs]
            - `addr_book_strict` = false
    - [app.toml]
        - [state-sync]
            - `snapshot-interval` = snapshot-interval
            - `snapshot-keep-recent` = snapshot-keep-recent

- AWS:
    - Instance type = EC2 instance
    - Network:
        - Private IPv4 = IPv4 address
        - Public IPv4 = not assigned
    - Security:
        - inbound:
            - allow `Tendermint p2p` port from Private Sentry Nodes' VPC CIDR
            - allow `RPC` port from Private Sentry Nodes' VPC CIDR
        - outbound:
            - all


### Private Sentry Node: 
- Tendermint:
    - [config.toml]
        - [p2p]
            - `pex` = true
            - `persistent_peers` = [validator node with private IP + other orgs' validator/sentry nodes with public IPs] 
            - `private_peer_ids` = [validator node id]
            - `unconditional_peers` = [validator node id]
            - `addr_book_strict` = false
        - [statesync]
            - `enable` = true
            - `rpc_servers` = [validator node's RPC endpoint]
            - `trust_height` = trust-height
            - `trust_hash` = trust-hash
    - [app.toml]
        - [state-sync]
            - `snapshot-interval` = snapshot-interval
            - `snapshot-keep-recent` = snapshot-keep-recent
- AWS:
    - Instance type = EC2 instance
    - Network:
        - Private IPv4 = IPv4 address
        - Public IPv4 = Elastic IP
    - Security:
        - inbound:
            - allow `Tendermint p2p` port for whitelist IPs
            - allow `RPC` port from Observer Nodes' VPC CIDR
            - allow `RPC` port from Public Sentry Nodes' VPC CIDR
        - outbound:
            - all

### Observer Node: 
- Tendermint:
    - [config.toml]
        - [p2p]
            - `pex` = true
            - `persistent_peers` = [private sentry nodes private with IPs]
            - `addr_book_strict` = false
        - [statesync]
            - `enable` = true
            - `rpc_servers` = [private sentry nodes' RPC endpoints]
            - `trust_height` = trust-height
            - `trust_hash` = trust-hash
    - [app.toml]
        - [api]
            - `enable` = true
- AWS:
    - Instance type = EC2 instance
    - Network:
        - Private IPv4 = IPv4 address
        - Public IPv4 = not assigned
    - Security:
        - inbound:
            - allow gRPC / REST / RPC ports the same VPC CIDR
        - outbound:
            - all

### Public Sentry Node: 
- Tendermint:
    - [config.toml]
        - [p2p]
            - `pex` = true
            - `persistent_peers` = [private sentry nodes with private IPs]
        - [statesync]
            - `enable` = true
            - `rpc_servers` = [private sentry nodes' RPC endpoints]
            - `trust_height` = trust-height
            - `trust_hash` = trust-hash
    - [app.toml]
        - [state-sync]
            - `snapshot-interval` = snapshot-interval
            - `snapshot-keep-recent` = snapshot-keep-recent
- AWS:
    - Instance type = EC2 instance
    - Network:
        - Private IPv4 = IPv4 address
        - Public IPv4 = Elastic IP
    - Security:
        - inbound:
            - allow `Tendermint p2p` port from everywhere
            - allow `Tendermint RPC` port from everywhere
        - outbound:
            - all


### Seed Node: 
- Tendermint:
    - [config.toml]
        - [p2p]<commit_msg>Add header for aws deployment diagram in doc<commit_after># Recommended design for DCL MainNet deployment on AWS
## AWS deployment diagram
![AWS deployment diagram](./deployment-aws.png)

## Recommended IaC frameworks
- [Terraform](https://www.terraform.io) - for setting up AWS infrastructure
- [Ansible](https://www.ansible.com) - for provisioning DCL nodes

## Node specific AWS and DCL configurations

### Validator Node:
- Tendermint:
    - [config.toml]
        - [p2p]
            - `pex` = false
            - `persistent_peers` = [private sentry nodes with private IPs]
            - `addr_book_strict` = false
    - [app.toml]
        - [state-sync]
            - `snapshot-interval` = snapshot-interval
            - `snapshot-keep-recent` = snapshot-keep-recent

- AWS:
    - Instance type = EC2 instance
    - Network:
        - Private IPv4 = IPv4 address
        - Public IPv4 = not assigned
    - Security:
        - inbound:
            - allow `Tendermint p2p` port from Private Sentry Nodes' VPC CIDR
            - allow `RPC` port from Private Sentry Nodes' VPC CIDR
        - outbound:
            - all


### Private Sentry Node: 
- Tendermint:
    - [config.toml]
        - [p2p]
            - `pex` = true
            - `persistent_peers` = [validator node with private IP + other orgs' validator/sentry nodes with public IPs] 
            - `private_peer_ids` = [validator node id]
            - `unconditional_peers` = [validator node id]
            - `addr_book_strict` = false
        - [statesync]
            - `enable` = true
            - `rpc_servers` = [validator node's RPC endpoint]
            - `trust_height` = trust-height
            - `trust_hash` = trust-hash
    - [app.toml]
        - [state-sync]
            - `snapshot-interval` = snapshot-interval
            - `snapshot-keep-recent` = snapshot-keep-recent
- AWS:
    - Instance type = EC2 instance
    - Network:
        - Private IPv4 = IPv4 address
        - Public IPv4 = Elastic IP
    - Security:
        - inbound:
            - allow `Tendermint p2p` port for whitelist IPs
            - allow `RPC` port from Observer Nodes' VPC CIDR
            - allow `RPC` port from Public Sentry Nodes' VPC CIDR
        - outbound:
            - all

### Observer Node: 
- Tendermint:
    - [config.toml]
        - [p2p]
            - `pex` = true
            - `persistent_peers` = [private sentry nodes private with IPs]
            - `addr_book_strict` = false
        - [statesync]
            - `enable` = true
            - `rpc_servers` = [private sentry nodes' RPC endpoints]
            - `trust_height` = trust-height
            - `trust_hash` = trust-hash
    - [app.toml]
        - [api]
            - `enable` = true
- AWS:
    - Instance type = EC2 instance
    - Network:
        - Private IPv4 = IPv4 address
        - Public IPv4 = not assigned
    - Security:
        - inbound:
            - allow gRPC / REST / RPC ports from the same VPC CIDR
        - outbound:
            - all

### Public Sentry Node: 
- Tendermint:
    - [config.toml]
        - [p2p]
            - `pex` = true
            - `persistent_peers` = [private sentry nodes with private IPs]
        - [statesync]
            - `enable` = true
            - `rpc_servers` = [private sentry nodes' RPC endpoints]
            - `trust_height` = trust-height
            - `trust_hash` = trust-hash
    - [app.toml]
        - [state-sync]
            - `snapshot-interval` = snapshot-interval
            - `snapshot-keep-recent` = snapshot-keep-recent
- AWS:
    - Instance type = EC2 instance
    - Network:
        - Private IPv4 = IPv4 address
        - Public IPv4 = Elastic IP
    - Security:
        - inbound:
            - allow `Tendermint p2p` port from anywhere
            - allow `Tendermint RPC` port from anywhere
        - outbound:
            - all


### Seed Node: 
- Tendermint:
    - [config.toml]
        - [p2p]
{'fraction_non_alphanumeric': 0.10750193348801237, 'fraction_numerical': 0.006187161639597835, 'mean_word_length': 1.6150994270306707, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 4, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4201382', 'n_tokens_mistral': 2440, 'n_tokens_neox': 2384, 'n_words': 630}