Deployment

Production deployment guide for ClawFi infrastructure. This document covers smart contract deployment, MCP server configuration, and authorization engine setup for mainnet operations.

Prerequisites

System Requirements

Development Environment:

Node.js 18.17 or later
Rust 1.75+ (for Solana programs)
Solana CLI 1.18+
Docker 24.0+ (for containerized deployment)

Network Access:

Solana RPC endpoint (mainnet-beta, devnet, or local validator)
PostgreSQL 15+ (for authorization engine state)
Redis 7+ (for MCP server session management)

Required Credentials

# Solana keypairs
DEPLOYER_KEYPAIR=~/.config/solana/deployer.json
AUTHORITY_KEYPAIR=~/.config/solana/authority.json

# API credentials
CLAWFI_SERVICE_KEY=sk_live_...
DATABASE_URL=postgresql://user:pass@host:5432/clawfi
REDIS_URL=redis://host:6379

Smart Contract Deployment

1. Build Solana Programs

# Clone contracts repository
git clone https://github.com/UseClawFi/contracts.git
cd contracts

# Install dependencies
npm install

# Build Solana programs
anchor build

# Verify build artifacts
ls -la target/deploy/
# Expected files:
# - vault_factory.so
# - vault.so
# - authorization_engine.so
# - transfer_manager.so

2. Deploy to Devnet (Testing)

# Configure Solana CLI for devnet
solana config set --url https://api.devnet.solana.com

# Airdrop SOL for deployment fees
solana airdrop 2

# Deploy VaultFactory program
solana program deploy \
  target/deploy/vault_factory.so \
  --keypair ~/.config/solana/deployer.json

# Output:
# Program Id: VFACToRyDEV...

# Deploy remaining programs
solana program deploy target/deploy/vault.so
solana program deploy target/deploy/authorization_engine.so
solana program deploy target/deploy/transfer_manager.so

3. Initialize Programs

# Initialize VaultFactory with governance parameters
anchor run initialize-factory -- \
  --authority $AUTHORITY_KEYPAIR \
  --treasury-fee 0.001 \
  --approval-timeout 86400

# Output:
# VaultFactory initialized at VFACToRyDEV...
# Authority: Auth1ty...
# Treasury fee: 0.1%

4. Mainnet Deployment

# Switch to mainnet-beta
solana config set --url https://api.mainnet-beta.solana.com

# Deploy with mainnet authority
solana program deploy \
  target/deploy/vault_factory.so \
  --keypair ~/.config/solana/mainnet-deployer.json \
  --upgrade-authority ~/.config/solana/mainnet-authority.json

# ⚠️ CRITICAL: Verify program addresses match expectations
solana program show VFACToRy...

# Set program as immutable (optional, only after thorough testing)
# solana program set-upgrade-authority \
#   VFACToRy... \
#   --new-upgrade-authority none

5. Program Verification

# Verify on-chain bytecode matches local build
solana-verify verify-from-repo \
  --program-id VFACToRy... \
  https://github.com/UseClawFi/contracts

# Expected output:
# ✓ On-chain program verified against source code
# ✓ Build reproducible

Authorization Engine Deployment

Architecture

┌─────────────────────────────────────────┐
│         Load Balancer (Nginx)           │
└────────────┬────────────────────────────┘
             │
     ┌───────┴────────┐
     │                │
┌────▼─────┐    ┌────▼─────┐
│  Auth    │    │  Auth    │
│ Engine 1 │    │ Engine 2 │
└────┬─────┘    └────┬─────┘
     │                │
     └───────┬────────┘
             │
      ┌──────▼───────┐
      │  PostgreSQL  │
      │   (Primary)  │
      └──────────────┘

1. Database Setup

-- Create database
CREATE DATABASE clawfi_authorization;

-- Create tables (run migrations)
\i migrations/001_create_policies.sql
\i migrations/002_create_audit_log.sql
\i migrations/003_create_approval_proposals.sql

-- Create read-only replica user
CREATE USER auth_engine_ro WITH PASSWORD 'secure_password';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO auth_engine_ro;

-- Performance indexes
CREATE INDEX idx_policies_vault_id ON policies(vault_id);
CREATE INDEX idx_audit_log_timestamp ON audit_log(timestamp DESC);
CREATE INDEX idx_proposals_status ON approval_proposals(status, expires_at);

2. Container Build

# Dockerfile
FROM node:18-alpine AS builder

WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

COPY . .
RUN npm run build

FROM node:18-alpine
WORKDIR /app

COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules

EXPOSE 8080
CMD ["node", "dist/server.js"]

# Build container
docker build -t clawfi/auth-engine:1.0.0 .

# Tag for registry
docker tag clawfi/auth-engine:1.0.0 \
  registry.useclawfi.com/auth-engine:1.0.0

# Push to registry
docker push registry.useclawfi.com/auth-engine:1.0.0

3. Kubernetes Deployment

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: auth-engine
  namespace: clawfi-prod
spec:
  replicas: 3
  selector:
    matchLabels:
      app: auth-engine
  template:
    metadata:
      labels:
        app: auth-engine
    spec:
      containers:
      - name: auth-engine
        image: registry.useclawfi.com/auth-engine:1.0.0
        ports:
        - containerPort: 8080
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: clawfi-secrets
              key: database-url
        - name: REDIS_URL
          valueFrom:
            secretKeyRef:
              name: clawfi-secrets
              key: redis-url
        - name: SOLANA_RPC_URL
          value: "https://api.mainnet-beta.solana.com"
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
          limits:
            cpu: 2000m
            memory: 4Gi
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: auth-engine
  namespace: clawfi-prod
spec:
  selector:
    app: auth-engine
  ports:
  - port: 80
    targetPort: 8080
  type: ClusterIP

# Apply Kubernetes configuration
kubectl apply -f deployment.yaml

# Verify deployment
kubectl get pods -n clawfi-prod
kubectl logs -f deployment/auth-engine -n clawfi-prod

# Expected output:
# ✓ Connected to PostgreSQL
# ✓ Connected to Redis
# ✓ Connected to Solana RPC
# ✓ Authorization engine listening on :8080

4. Load Balancer Configuration

# nginx.conf
upstream auth_engine {
    least_conn;
    server auth-engine-1:8080 max_fails=3 fail_timeout=30s;
    server auth-engine-2:8080 max_fails=3 fail_timeout=30s;
    server auth-engine-3:8080 max_fails=3 fail_timeout=30s;
}

server {
    listen 443 ssl http2;
    server_name auth.useclawfi.com;

    ssl_certificate /etc/nginx/certs/useclawfi.com.crt;
    ssl_certificate_key /etc/nginx/certs/useclawfi.com.key;
    ssl_protocols TLSv1.3;

    location / {
        proxy_pass http://auth_engine;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;

        # Timeout configuration
        proxy_connect_timeout 5s;
        proxy_send_timeout 10s;
        proxy_read_timeout 30s;
    }

    location /health {
        proxy_pass http://auth_engine/health;
        access_log off;
    }
}

MCP Server Deployment

1. Server Configuration

// config/production.ts
export default {
  server: {
    host: '0.0.0.0',
    port: 8081,
    websocket: {
      maxConnections: 100000,
      pingInterval: 30000,
      pingTimeout: 5000
    }
  },

  auth: {
    jwtSecret: process.env.JWT_SECRET,
    agentKeyValidation: true,
    rateLimiting: {
      windowMs: 60000,
      maxRequests: 100
    }
  },

  upstreams: {
    authEngine: 'https://auth.useclawfi.com',
    solanaRpc: 'https://api.mainnet-beta.solana.com'
  },

  redis: {
    url: process.env.REDIS_URL,
    keyPrefix: 'mcp:',
    ttl: 3600
  }
};

2. Container Deployment

# docker-compose.yml
version: '3.8'

services:
  mcp-server:
    image: registry.useclawfi.com/mcp-server:1.0.0
    ports:
      - "8081:8081"
    environment:
      - NODE_ENV=production
      - JWT_SECRET=${JWT_SECRET}
      - AUTH_ENGINE_URL=https://auth.useclawfi.com
      - SOLANA_RPC_URL=https://api.mainnet-beta.solana.com
      - REDIS_URL=redis://redis:6379
    depends_on:
      - redis
    restart: unless-stopped
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: '2'
          memory: 4G

  redis:
    image: redis:7-alpine
    volumes:
      - redis-data:/data
    restart: unless-stopped

volumes:
  redis-data:

# Deploy with Docker Swarm
docker stack deploy -c docker-compose.yml clawfi-mcp

# Or with docker-compose
docker-compose up -d --scale mcp-server=3

# Verify deployment
docker ps
curl -f http://localhost:8081/health

3. WebSocket Load Balancing

# nginx-mcp.conf
map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

upstream mcp_servers {
    ip_hash;  # Sticky sessions for WebSocket
    server mcp-1:8081;
    server mcp-2:8081;
    server mcp-3:8081;
}

server {
    listen 443 ssl http2;
    server_name mcp.useclawfi.com;

    ssl_certificate /etc/nginx/certs/useclawfi.com.crt;
    ssl_certificate_key /etc/nginx/certs/useclawfi.com.key;

    location / {
        proxy_pass http://mcp_servers;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;

        # WebSocket timeouts
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
}

Monitoring & Observability

1. Prometheus Metrics

# prometheus.yml
global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'auth-engine'
    static_configs:
      - targets: ['auth-engine-1:8080', 'auth-engine-2:8080']

  - job_name: 'mcp-server'
    static_configs:
      - targets: ['mcp-server-1:8081', 'mcp-server-2:8081']

  - job_name: 'solana-exporter'
    static_configs:
      - targets: ['solana-exporter:9091']

2. Grafana Dashboards

# Import ClawFi monitoring dashboard
curl -X POST http://grafana:3000/api/dashboards/db \
  -H "Content-Type: application/json" \
  -d @dashboards/clawfi-overview.json

Key Metrics to Monitor:

Authorization latency (p50, p95, p99)
Transaction success rate
MCP WebSocket connection count
Solana RPC response times
Database query performance
Redis cache hit rate

3. Alerting Rules

# alerts.yml
groups:
  - name: clawfi_alerts
    interval: 30s
    rules:
      - alert: HighAuthorizationLatency
        expr: histogram_quantile(0.99, authorization_latency_seconds) > 0.5
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Authorization latency exceeding 500ms"

      - alert: TransactionFailureRate
        expr: rate(transactions_failed_total[5m]) / rate(transactions_total[5m]) > 0.05
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Transaction failure rate above 5%"

      - alert: MCPConnectionDrop
        expr: mcp_connections_active < 100
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "MCP connections dropped significantly"

Security Hardening

1. Network Security

# Firewall rules (iptables)
# Allow only necessary ports
iptables -A INPUT -p tcp --dport 443 -j ACCEPT  # HTTPS
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT # Auth engine (internal)
iptables -A INPUT -p tcp --dport 8081 -j ACCEPT # MCP server (internal)
iptables -A INPUT -j DROP  # Drop all other traffic

# Save rules
iptables-save > /etc/iptables/rules.v4

2. Secret Management

# Use HashiCorp Vault for secret storage
vault kv put secret/clawfi/prod \
  database_url="postgresql://..." \
  jwt_secret="..." \
  service_key="sk_live_..."

# Kubernetes secret creation
kubectl create secret generic clawfi-secrets \
  --from-literal=database-url="postgresql://..." \
  --from-literal=jwt-secret="..." \
  -n clawfi-prod

3. TLS Configuration

# Generate production certificates (Let's Encrypt)
certbot certonly --dns-cloudflare \
  -d useclawfi.com \
  -d *.useclawfi.com \
  --dns-cloudflare-credentials ~/.secrets/cloudflare.ini

# Auto-renewal
echo "0 0 * * * certbot renew --quiet" | crontab -

Backup & Disaster Recovery

1. Database Backups

# Automated PostgreSQL backup
#!/bin/bash
BACKUP_DIR="/backups/postgresql"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)

pg_dump -h postgres.useclawfi.com \
  -U clawfi_admin \
  -d clawfi_authorization \
  -F c \
  -f $BACKUP_DIR/clawfi_$TIMESTAMP.dump

# Upload to S3
aws s3 cp $BACKUP_DIR/clawfi_$TIMESTAMP.dump \
  s3://clawfi-backups/postgresql/

# Retention: Keep last 30 days
find $BACKUP_DIR -name "clawfi_*.dump" -mtime +30 -delete

2. Smart Contract Recovery

# Export program data
solana program dump VFACToRy... vault_factory_backup.so

# Store in secure location
aws s3 cp vault_factory_backup.so \
  s3://clawfi-backups/programs/ \
  --sse aws:kms \
  --sse-kms-key-id arn:aws:kms:...

3. Disaster Recovery Plan

RTO (Recovery Time Objective): 4 hours RPO (Recovery Point Objective): 15 minutes

Recovery Steps:

Restore database from latest backup
Redeploy authorization engine containers
Redeploy MCP server cluster
Verify Solana program accessibility
Run health checks and smoke tests
Resume normal operations

Health Checks

Authorization Engine

# Health check endpoint
curl https://auth.useclawfi.com/health

# Expected response:
{
  "status": "healthy",
  "database": "connected",
  "redis": "connected",
  "solana": "connected",
  "uptime": 86400,
  "version": "1.0.0"
}

MCP Server

# WebSocket connection test
wscat -c wss://mcp.useclawfi.com/v1/connect

# Send authentication frame
{"jsonrpc":"2.0","method":"clawfi.authenticate","params":{"agentKey":"ak_test_..."},"id":1}

Solana Programs

# Verify program deployment
solana program show VFACToRy...

# Check program health
anchor test --skip-build --skip-deploy

Rollback Procedures

Smart Contract Rollback

# Revert to previous program version
solana program set-buffer-authority \
  <buffer-address> \
  --new-buffer-authority <upgrade-authority>

solana program upgrade \
  <program-id> \
  <previous-version.so> \
  --upgrade-authority <upgrade-authority>

Application Rollback

# Kubernetes rollback
kubectl rollout undo deployment/auth-engine -n clawfi-prod

# Docker Swarm rollback
docker service update --rollback clawfi-mcp_mcp-server

Performance Tuning

Database Optimization

-- Enable query planner optimization
SET work_mem = '256MB';
SET shared_buffers = '4GB';
SET effective_cache_size = '12GB';

-- Vacuum and analyze
VACUUM ANALYZE policies;
VACUUM ANALYZE audit_log;
VACUUM ANALYZE approval_proposals;

Redis Configuration

# redis.conf
maxmemory 4gb
maxmemory-policy allkeys-lru
tcp-backlog 511
timeout 0
tcp-keepalive 300

Deployment Checklist

Pre-Deployment

Smart contracts audited by third-party firm
Load testing completed (target: 10x expected traffic)
Disaster recovery plan documented
Monitoring dashboards configured
Alert thresholds validated
Security review completed
Backup procedures tested

Deployment

Post-Deployment

Monitor metrics for 24 hours
Verify transaction success rate > 99%
Confirm authorization latency < 50ms
Test failover procedures
Document any issues encountered
Update runbook with lessons learned

Support & Escalation

Production Issues:

Slack: #clawfi-prod-alerts
PagerDuty: Critical alerts
Email: [email protected]

Security Issues:

Email: [email protected]
Response SLA: < 1 hour for critical

Last Updated: March 2026 Version: 1.0.0 Status: Production Ready

PreviousCards NextVaults

Last updated 1 hour ago

Good afternoon

hashtagPrerequisites

hashtagSystem Requirements

hashtagRequired Credentials

hashtagSmart Contract Deployment

hashtag1. Build Solana Programs

hashtag2. Deploy to Devnet (Testing)

hashtag3. Initialize Programs

hashtag4. Mainnet Deployment

hashtag5. Program Verification

hashtagAuthorization Engine Deployment

hashtagArchitecture

hashtag1. Database Setup

hashtag2. Container Build

hashtag3. Kubernetes Deployment

hashtag4. Load Balancer Configuration

hashtagMCP Server Deployment

hashtag1. Server Configuration

hashtag2. Container Deployment

hashtag3. WebSocket Load Balancing

hashtagMonitoring & Observability

hashtag1. Prometheus Metrics

hashtag2. Grafana Dashboards

hashtag3. Alerting Rules

hashtagSecurity Hardening

hashtag1. Network Security

hashtag2. Secret Management

hashtag3. TLS Configuration

hashtagBackup & Disaster Recovery

hashtag1. Database Backups

hashtag2. Smart Contract Recovery

hashtag3. Disaster Recovery Plan

hashtagHealth Checks

hashtagAuthorization Engine

hashtagMCP Server

hashtagSolana Programs

hashtagRollback Procedures

hashtagSmart Contract Rollback

hashtagApplication Rollback

hashtagPerformance Tuning

hashtagDatabase Optimization

hashtagRedis Configuration

hashtagDeployment Checklist

hashtagPre-Deployment

hashtagDeployment

hashtagPost-Deployment

hashtagSupport & Escalation

Prerequisites

System Requirements

Required Credentials

Smart Contract Deployment

1. Build Solana Programs

2. Deploy to Devnet (Testing)

3. Initialize Programs

4. Mainnet Deployment

5. Program Verification

Authorization Engine Deployment

Architecture

1. Database Setup

2. Container Build

3. Kubernetes Deployment

4. Load Balancer Configuration

MCP Server Deployment

1. Server Configuration

2. Container Deployment

3. WebSocket Load Balancing

Monitoring & Observability

1. Prometheus Metrics

2. Grafana Dashboards

3. Alerting Rules

Security Hardening

1. Network Security

2. Secret Management

3. TLS Configuration

Backup & Disaster Recovery

1. Database Backups

2. Smart Contract Recovery

3. Disaster Recovery Plan

Health Checks

Authorization Engine

MCP Server

Solana Programs

Rollback Procedures

Smart Contract Rollback

Application Rollback

Performance Tuning

Database Optimization

Redis Configuration

Deployment Checklist

Pre-Deployment

Deployment

Post-Deployment

Support & Escalation