NordStern Docs
Internal Engineering

Deployment & Cloud Infrastructure

Operational reference for the local Docker Compose stack, Terraform pilot deployment, and the Kubernetes GitOps blueprint.

NordStern has three defined deployment models: Local Compose (for active development), Terraform Single-EC2 Pilot (for testnet staging), and Kubernetes GitOps (for production scale).

1. Local Compose Stack

  • Path: docker-compose.platform.yml
  • Ingress: Traefik parses Docker labels to route subdomains locally (e.g. *.localhost).
  • Storage: Named volume pgdata hosts the PostgreSQL databases locally.

2. Terraform Single-EC2 Pilot

The active staging deploy pathway is designed around a single AWS EC2 instance connected to an Amazon RDS Postgres database.

  • Path: deploy/terraform/
  • Database: Amazon RDS runs PostgreSQL, executing deploy/pg-init.sql on startup to partition the 4 databases.
  • Orchestration: The EC2 host runs Docker Compose. The platform-api and control-plane execute on the host, spawning individual anchor containers in the docker daemon.
  • Secrets: Integrated with AWS Secrets Manager.

3. Kubernetes & GitOps Blueprint (Roadmap)

The project includes production-grade Kubernetes deployment manifests designed for high-availability scaling.

                    ┌────────────────────────┐
                    │     ArgoCD Engine      │
                    └────────────────────────┘
                                 │
                                 ▼
┌─────────────────────────────────────────────────────────────────┐
│                           EKS Cluster                           │
│                                                                 │
│ ┌───────────────────────────┐     ┌───────────────────────────┐ │
│ │        Namespace A        │     │        Namespace B        │ │
│ │ ┌──────┐ ┌──────┐ ┌─────┐ │     │ ┌──────┐ ┌──────┐ ┌─────┐ │ │
│ │ │Anchor│ │ Biz  │ │Ingr │ │     │ │Anchor│ │ Biz  │ │Ingr │ │ │
│ │ │Platform│ Server │     │ │     │ │Platform│ Server │     │ │ │
│ │ └──────┘ └──────┘ └─────┘ │     │ └──────┘ └──────┘ └─────┘ │ │
│ └───────────────────────────┘     └───────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
  • Path: anchor-template/infra/
  • EKS Setup: Provisioned with VPC, node groups managed by Karpenter, and ECR repositories.
  • Helm Chart (anchor-stack): Packages the Anchor Platform, Business Server, ingress definitions (using AWS ALB Controller), and default-deny Kubernetes NetworkPolicies.
  • GitOps (ArgoCD): App-of-apps pattern that manages deployment sync, including cert-manager (TLS certificates), external-dns (wildcard domain routing), and Prometheus/Grafana monitors.

Kubernetes Deployment is Untested Blueprint

The Helm charts, Karpenter configurations, and ArgoCD manifests inside anchor-template/infra are blueprints. They are not wired to the active runtime provisioning engine. The Control Plane currently provisions anchors using the Docker daemon socket (dockerode) rather than spawning Kubernetes pods.

Secrets Architecture & Storage

Deep dive into the SecretStore model, database references, and the AWS Secrets Manager/LocalStack configuration.

Disaster Recovery & Backups

Disaster recovery procedures, dump scheduling, secret-store reconciliation, and database restore workflows.

On this page

1. Local Compose Stack2. Terraform Single-EC2 Pilot3. Kubernetes & GitOps Blueprint (Roadmap)Traceability Links