Geo-Distributed Blockchain Node Cluster in Kubernetes

Mon, 01 Jan 0001 00:00:00 +0000

Geo-Distributed Blockchain Node Cluster in Kubernetes

Client

Cryptocurrency platform (Web3 / DeFi)

Challenge

The client needed fault-tolerant infrastructure to run ETH and BSC full nodes across four regions (EU, US, AP, LatAm) with minimal latency for end users, DDoS and RPC spam protection, secure HSM-based transaction signing, and centralized observability. Cold node sync takes 2–3 weeks — a fast-bootstrap solution was required.

Solution

1. Infrastructure & IaC (Terraform + EKS)

Terraform modules: VPC, subnets, security groups for 4 regions (Frankfurt, Virginia, Singapore, São Paulo)
Managed Kubernetes (EKS 1.29+) per region with dedicated node pools: full nodes, archive nodes, signing service
NVMe StorageClass (gp3) via CSI driver for high-performance chaindata storage
Helm charts for geth / bsc-node with per-region custom values

2. GitOps: Flux CD Multi-Cluster

Flux CD v2 with Kustomization per region — single source of truth for all clusters
Secrets management: HashiCorp Vault + External Secrets Operator (ESO)
All infrastructure changes applied via git push — no direct cluster access required

3. Load Balancing & Anti-Spam

HAProxy 2.8: sticky sessions, health checks via eth_syncing — traffic routed only to fully synced nodes
Nginx Ingress: rate limiting, IP reputation filtering (Lua-based, fail2ban-style)
Cloudflare Workers: geo-routing + L7 DDoS protection
Custom Go sidecar: health endpoint returns ready only when node is fully synced

4. HSM Integration for Transaction Signing

AWS CloudHSM (prod) / YubiHSM2 (staging) for private key storage
Go microservice with PKCS#11 abstraction — swap HSM vendor without rewriting code
Isolated K8s namespace + NetworkPolicy: no egress except to HSM endpoint
gRPC API for backend: sign tx, get pubkey
Full audit log of all signing operations → Loki

5. Monitoring & Alerting

Custom Prometheus exporter (Go): eth_blockNumber, eth_syncing, peer count per node
Grafana dashboards: sync lag, block height per region, RPC latency, SLO 99.9%
Alertmanager → PagerDuty: alerts on block lag > N blocks, node down, peer count below threshold
Loki + Promtail: structured logs from all nodes with region/pod correlation

6. Operations & Disaster Recovery

Snapshot bootstrap: chaindata from S3 via rclone — node ready in hours instead of weeks
DR playbook: step-by-step runbooks for regional recovery
Chaos Engineering (Chaos Mesh): node kill, network partition, pod failure tests
Architecture Decision Records (ADR) for all key design choices

Technologies

Kubernetes

Terraform

Helm

Flux CD

Prometheus

Grafana

Results

✅ Geo-routing: latency reduced by routing users to the nearest region
✅ Fast bootstrap: node ready in hours via S3 snapshot instead of 2–3 weeks of sync
✅ Anti-spam: rate limiting + IP reputation — public RPC handles bot load without degradation
✅ HSM: private keys never leave the hardware module
✅ GitOps: every infrastructure change goes through git with a full audit trail
✅ SLO 99.9%: tracked in Grafana, PagerDuty alerts on any degradation

Migration and DevOps for a CS-Cart Marketplace

Mon, 01 Jan 0001 00:00:00 +0000

Infrastructure and Deployment of a Multi-Vendor CS-Cart Marketplace

Client

Multi-vendor marketplace

Challenge

Revive a legacy marketplace project and migrate it from standard shared hosting to a modern cloud environment. Ensure high availability, build CI/CD infrastructure, set up test environments, integrate third-party delivery services, and automate routine operations with AI. At the final stage, prepare an on-premise server (NAS) on the client side for cold repository storage.

Solution

1. Infrastructure in Yandex Cloud (Terraform)

Built IaC configuration (Terraform) to provision Yandex Cloud infrastructure (virtual networks, VMs).
Configured separate virtual machines for production and development environments.
Attached and partitioned additional disks, deployed automated backups for databases and files to Yandex Object Storage (S3).
Used Yandex Cloud Postbox for reliable service email delivery (domain, SPF, DKIM configured).

2. Containerization and Microservices

Migrated the marketplace from classic hosting to a Docker-based VPS environment.
Built a custom Dockerfile for CS-Cart and a docker-compose stack with a microservice-oriented web server architecture.
Established full-featured dev and prod environments.
Configured deployment pipelines via a local Git server (Forgejo).

3. Marketplace Platform (CS-Cart)

Upgraded the CS-Cart core and optimized the database by removing obsolete, unused plugins.
Deployed a clean platform installation with a new commercial theme.
Configured multi-vendor business logic: role separation and seller dashboards.
Integrated and configured modules: dynamic product loading, AI capabilities, smart live search, and SEO module.
Integrated shipping (CDEK) and payment systems. Launched automated data exchange with 1C accounting systems.

4. Automation and n8n

Deployed n8n process orchestration.
Integrated ChatGPT API to automate repetitive operations such as content generation and normalization.
Configured workers and triggers for store business workflows.

5. Security and Cloudflare

Configured Cloudflare Proxy DNS.
Implemented Cloudflare Turnstile to reduce spam during sign-up and checkout flows.
Added bot protection: disabled direct registrations, configured strict caching, and filtered low-quality traffic.
Installed SSL certificates and configured proper redirects.

6. On-Premise Infrastructure and Documentation

Set up a dedicated subdomain with a wiki engine for technical and user documentation.
Implemented local infrastructure in the client’s office based on Synology NAS: Docker, S3 buckets, and backups.
Deployed a local Git server (Forgejo) with a CI/CD runner for version control and long-term preservation of project assets.
Collected a complete backup of Terraform states, passwords, codebases, and configurations.

7. Project Archival and Repositories

Migrated the production site to backup hosting for archival mode and disabled active synchronizations.
Procured and configured Synology NAS in the office: external access, Docker, S3 buckets.
Deployed Forgejo with a runner under the git.* domain.
Repositories included: website source code, theme and add-ons, documentation, n8n workflows, Telegram bots, DB backups, terraform-yandex, terraform-cloudflare, and password vault.

Technologies

Docker

Terraform

Yandex Cloud

Nginx

Forgejo

Linux

Results

✅ Infrastructure: shared hosting → VPS in Yandex Cloud via Terraform, fully containerized with Docker
✅ Platform: clean CS-Cart Multi-Vendor installation replaced a heavily modified legacy core
✅ Theme and modules: commercial theme, live search, UX/UI improvements, SMS authentication, AJAX catalog
✅ Integrations: CDEK, Boxberry, Russian Post, Faster Payments System (SBP), and dual-environment 1C exchange
✅ Documentation: wiki on docs.* subdomain with a complete project structure
✅ Automation: n8n + ChatGPT API for routine operations
✅ Backups: Yandex Object Storage + mirrored copy on office Synology NAS
✅ Git: self-hosted Forgejo on NAS with runner and full project repositories
✅ Archival handover: project fully transferred to the client’s on-premise Synology NAS, including a private Forgejo Git server.

Terraform on DevOps Engineer & CloudAdmin

Geo-Distributed Blockchain Node Cluster in Kubernetes