# Deployment Instructions - All Secrets in .env

**Date**: 2026-01-04  
**Status**: Ready for Deployment

---

## Prerequisites

All secrets and configuration should be stored in `.env` file. Create it from the template:

```bash
cd rpc-translator-138
cp env.template .env
# Or: cp .env.example .env
```

Edit `.env` and add all required values, including secrets.

---

## Deployment Methods

### Method 1: Direct Deployment (Recommended)

**Run on Proxmox host (r630-01):**

```bash
# 1. SSH to Proxmox host
ssh root@192.168.11.11

# 2. Clone/copy project (if not already there)
cd /opt  # or your preferred location
git clone <repository> proxmox
cd proxmox/rpc-translator-138

# 3. Create .env file with secrets
cp env.template .env
nano .env  # Add all secrets and configuration

# 4. Verify node readiness
./verify-node-ready.sh r630-01

# 5. Deploy supporting services
./deploy-supporting-services.sh r630-01

# 6. Start containers
pct start 106  # Redis
pct start 107  # Web3Signer
pct start 108  # Vault

# 7. Configure services (enter each container)
pct enter 106  # Configure Redis
pct enter 107  # Configure Web3Signer
pct enter 108  # Configure Vault
```

### Method 2: Via Proxmox Web UI

1. Access Proxmox Web UI: https://192.168.11.11:8006
2. Create containers manually (see `LXC_DEPLOYMENT.md`)
3. Configure services in each container

### Method 3: Via Proxmox API (Advanced)

If you have Proxmox API credentials configured in `.env`:

```bash
# Add to .env:
PROXMOX_HOST=192.168.11.11
PROXMOX_USER=root@pam
PROXMOX_TOKEN_VALUE=your-token-here

# Use MCP Proxmox tools or API scripts
```

---

## .env File Secrets Checklist

Ensure your `.env` file contains:

### Required for Deployment

- [ ] `PROXMOX_HOST` - Proxmox host IP (if using remote deployment)
- [ ] `PROXMOX_TOKEN_VALUE` - API token (if using API deployment)

### Required for Services

- [ ] `REDIS_PASSWORD` - Redis password (if using password authentication)
- [ ] `VAULT_ROLE_ID` - Vault AppRole role ID
- [ ] `VAULT_SECRET_ID` - Vault AppRole secret ID
- [ ] `WALLET_ALLOWLIST` - Comma-separated wallet addresses

### Optional but Recommended

- [ ] `WEB3SIGNER_KEY_PASSWORD` - If Web3Signer keys are encrypted
- [ ] Custom service passwords
- [ ] API keys for external services

---

## Security Notes

1. **Never commit `.env` to git** - It's in `.gitignore`
2. **Store secrets securely** - Use password manager or secret management system
3. **Rotate credentials regularly** - Follow security best practices
4. **Use strong passwords** - Especially for Redis and Vault
5. **Limit access** - Only necessary services should have access to secrets

---

## Next Steps After Deployment

1. Verify all services are running
2. Test connectivity between services
3. Deploy translator service to VMIDs 2400-2402
4. Update translator .env files with service IPs
5. Start translator services
6. Test end-to-end functionality

See `DEPLOYMENT.md` for detailed instructions.
