3-Node Cluster & Air-Gapped Deployment

For high-assurance sovereign defense, intelligence, and critical national infrastructure, Aarkam is designed to install and operate with zero outbound internet dependencies.

1. 3-Node Cluster Production Topology

In a standard high-availability 3-node cluster, each physical server runs the three synchronized core daemons:

┌────────────────────────────────────────────────────────┐
│               Node 1 (192.168.1.11)                    │
│   • Rokka.Coordinator (Port 7774 / 57774)              │
│   • Rokka.StorageNode (Port 7775 / 57775)              │
│   • Abodi.Agent       (Port 7776 / 57776)              │
└──────────────────────────┬─────────────────────────────┘
                           │ Backplane Mesh (mTLS)
┌──────────────────────────┴─────────────────────────────┐
│               Node 2 (192.168.1.12)                    │
│   • Rokka.Coordinator (Port 7774 / 57774)              │
│   • Rokka.StorageNode (Port 7775 / 57775)              │
│   • Abodi.Agent       (Port 7776 / 57776)              │
└──────────────────────────┬─────────────────────────────┘
                           │ Backplane Mesh (mTLS)
┌──────────────────────────┴─────────────────────────────┐
│               Node 3 (192.168.1.13)                    │
│   • Rokka.Coordinator (Port 7774 / 57774)              │
│   • Rokka.StorageNode (Port 7775 / 57775)              │
│   • Abodi.Agent       (Port 7776 / 57776)              │
└────────────────────────────────────────────────────────┘

2. Air-Gapped Offline Installation Bundle

In an air-gapped facility, internet access is strictly prohibited. Deployment utilizes the cryptographically signed Aarkam Air-Gapped Archive:

aarkam-v2-airgapped-bundle.tar.gz
├── binaries/
│   ├── Aarkam.IO.tar.gz
│   ├── Rokka.Coordinator.tar.gz
│   ├── Rokka.StorageNode.tar.gz
│   ├── Abodi.Agent.tar.gz
│   └── am-cli-linux-x64
├── root-ca/
│   └── aarkam-internal-ca.crt
├── systemd/
│   └── *.service
└── manifest.sig (Ed25519 Cryptographic Signature)

Verification & Extraction

# Verify cryptographic signature using internal government HSM key
openssl dgst -sha256 -verify internal-gov-pubkey.pem -signature manifest.sig manifest.json

# Extract bundle to optical air-gap staging directory
tar -zxvf aarkam-v2-airgapped-bundle.tar.gz -C /opt/aarkam-offline/

3. End-to-End Cluster Provisioning Sequence

1. Distribute Binaries: Copy offline binaries to /opt/ across all 3 nodes via secure USB-HSM bridge or physical optical media.
2. Bootstrap PKI Certificates: Generate node-specific mTLS certificates signed by your enterprise Root CA.
3. Start Coordinators: Start rokka-coordinator on Node 1, Node 2, and Node 3.
4. Start Storage Daemons: Start rokka-storagenode and abodi-agent on all 3 nodes.
5. Form Hash Ring: Execute initialization commands via the interactive CLI:

   am cluster init --name "sovereign-vault-01" --quorum-size 3
   am node add node1 --address "https://192.168.1.11:57775" --rack "Rack-1"
   am node add node2 --address "https://192.168.1.12:57775" --rack "Rack-2"
   am node add node3 --address "https://192.168.1.13:57775" --rack "Rack-3"
   am pool create default-ec --profile "ahmodi-8-3"
   

6. Launch Aarkam.IO: Point Aarkam.IO to https://192.168.1.11:57774 and open the Web Portal at https://<aarkam-io-ip>:57771.