Manthan Phase 5 — `infra/` · AI Initiative review

Manthan Phase 5 — `infra/`

Infrastructure-as-code and container artifacts for the AWS deployment.

Layout

infra/
├── README.md           # this file
├── docker/             # D-001: testnet-node container image
│   ├── Dockerfile
│   ├── Dockerfile.dockerignore
│   └── docker-compose.yml      # local-dev 3-node ring
├── nats/               # phase-1 substrate dev infra (predates Phase 5)
├── postgres/           # phase-1 substrate dev infra (predates Phase 5)
└── terraform/          # D-002: AWS resources (TBD)

D-001 — Build & smoke-test the testnet-node image

From the repo root:

# Build (BuildKit picks up infra/docker/Dockerfile.dockerignore automatically)
docker build -f infra/docker/Dockerfile -t manthan-testnet-node:0.2.0 .

# Run a single node (mounts genesis-alpha's Charter/LOTS/privacy-policy)
docker run --rm \
  -p 9120:9120 -p 9220:9220 \
  -v "$PWD/herald-protocol/services/testnet/nodes/genesis-alpha/charter.md:/etc/manthan/charter.md:ro" \
  -v "$PWD/herald-protocol/services/testnet/nodes/genesis-alpha/lots.md:/etc/manthan/lots.md:ro" \
  -v "$PWD/herald-protocol/services/testnet/nodes/genesis-alpha/privacy-policy.md:/etc/manthan/privacy-policy.md:ro" \
  manthan-testnet-node:0.2.0

# In another shell:
curl -sS local-service/healthz
curl -sS local-service/readyz
curl -sS local-service/metrics | head -20

To run the full 3-node ring locally:

docker compose -f infra/docker/docker-compose.yml up --build

Env vars accepted by the container

Variable	Default	Notes
`MANTHAN_NODE_NAME`	`genesis-alpha`	Logical node identity. Must be one of `genesis-{alpha,beta,gamma}` unless `MANTHAN_NODE_SEED_HEX` is also set.
`MANTHAN_NODE_SEED_HEX`	(unset)	32-byte hex seed; production deploys source this from Secrets Manager (D-002).
`MANTHAN_HTTP_PORT`	`9120`	HTTP API port.
`MANTHAN_MWP_PORT`	`9220`	MWP (WebSocket) port for envelope gossip.
`MANTHAN_BIND_HOST`	`0.0.0.0`	Bind interface. The container forces `0.0.0.0`; ALB / Service Discovery fronts it.
`MANTHAN_DATA_DIR`	`/data`	SQLite ledger location. Mount EFS here in production.
`MANTHAN_BEHIND_TLS_PROXY`	`false`	Set `true` when ALB terminates TLS at the edge.
`MANTHAN_CHARTER_PATH`	`/etc/manthan/charter.md`	Charter document.
`MANTHAN_LOTS_PATH`	`/etc/manthan/lots.md`	Limits-of-Trust Statement.
`MANTHAN_PRIVACY_POLICY_PATH`	`/etc/manthan/privacy-policy.md`	Privacy policy.

Two deployment tracks

Track	Where	When to use
Compose / OSS (default)	`compose/`	Internal / research / pre-product. Runs on a single host (the genesis EC2 is the obvious target). Vanilla Prometheus + Alertmanager + Grafana. Zero managed-service spend.
Terraform / AWS managed (production roadmap)	`terraform/`	Once you have paying users / SLAs / compliance / cross-AZ HA needs. Fargate + AMP + ALB + EFS + KMS + Secrets Manager + Route 53. ~$80–120/mo for a 3-node testnet.

Both tracks consume the same manthan-testnet-node:0.2.0 image and the
same services/testnet/observability/alerts.yaml. The receivers
(PagerDuty + MS Teams + Slack) are identical end-points across both — only
the transport (managed AMP-Alertmanager vs. self-hosted Alertmanager) differs.

Compose track — quick start

See compose/README.md for the full guide.

docker build -f infra/docker/Dockerfile -t manthan-testnet-node:0.2.0 .
cp infra/compose/.env.example infra/compose/.env
$EDITOR infra/compose/.env       # paste real PagerDuty / Teams / Slack URLs
docker-compose -f infra/compose/docker-compose.yml up -d

Terraform track — quick start

terraform/ holds the full IaC for VPC + ALB + ECS Fargate + EFS + KMS +
Secrets Manager + S3 + ECR + Route 53 + CloudWatch + AMP. See
terraform/README.md for the apply workflow.

Quick checks (no AWS credentials required):

terraform -chdir=infra/terraform init -backend=false
terraform -chdir=infra/terraform validate

Both pass on the current tree; full terraform plan against a real (empty)
AWS account is the operator's production smoke test.

Manthan Phase 5 — `infra/`