Production Deployment

What you will learn

How to deploy ISCL Core for production use
Security hardening checklist
Docker deployment with proper configuration
Monitoring, backup, and maintenance procedures

Deployment architecture

┌─────────────────────────────────────────┐
│  Production Host                        │
│                                         │
│  ┌──────────────────────────────┐       │
│  │ Docker Compose               │       │
│  │  ┌─────────┐  ┌───────────┐ │       │
│  │  │ ISCL    │  │ Adapter   │ │       │
│  │  │ Core    │  │ (optional)│ │       │
│  │  └────┬────┘  └─────┬─────┘ │       │
│  │       │ internal     │       │       │
│  │       └──────────────┘       │       │
│  └──────────────────────────────┘       │
│       │ 127.0.0.1:3100 (localhost only) │
│       ▼                                 │
│  RPC Provider (Alchemy, Infura, etc.)   │
└─────────────────────────────────────────┘

Step 1: Docker setup

Build the image

docker build -f docker/Dockerfile.core -t clavion-core:latest .

Docker Compose configuration

services:
  iscl-core:
    image: clavion-core:latest
    ports:
      - "127.0.0.1:3100:3100"
    environment:
      ISCL_HOST: "0.0.0.0"
      ISCL_PORT: "3100"
      ISCL_APPROVAL_MODE: "web"
      ISCL_RPC_URL_8453: "${ISCL_RPC_URL_8453}"
      ISCL_KEYSTORE_PATH: "/home/iscl/.iscl/keystore"
      ISCL_AUDIT_DB: "/home/iscl/.iscl/data/audit.sqlite"
    volumes:
      - keystore-data:/home/iscl/.iscl/keystore
      - audit-data:/home/iscl/.iscl/data
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3100/v1/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped

volumes:
  keystore-data:
  audit-data:

Key points:

127.0.0.1:3100:3100 — port is only accessible from localhost on the host
0.0.0.0 inside the container so other containers can reach it on the Docker network
Named volumes for persistent keystore and audit data
Resource limits prevent runaway memory usage

Step 2: Security hardening

Checklist

Never use ISCL_APPROVAL_MODE=auto in production. Use web or cli.

Set ISCL_TELEGRAM_ALLOWED_CHATS if using the Telegram bot.

Configure a restrictive PolicyConfig with appropriate value limits, token allowlists, and recipient allowlists.

Use a paid RPC provider with authentication. Public endpoints are rate-limited and less reliable.

Do not expose port 3100 to the internet. The API has no authentication by design.

Back up the keystore volume. Keys are encrypted but irreplaceable if lost.

Set appropriate maxTxPerHour to limit blast radius if an adapter is compromised.

Review audit logs regularly. Look for unexpected policy_evaluated events or failed signing attempts.

Policy configuration

Create a production policy file:

{
  "version": "1",
  "maxValueWei": "1000000000000000000",
  "maxApprovalAmount": "500000000000000000",
  "contractAllowlist": [
    "0x2626664c2603336E57B271c5C0b26F421741e481"
  ],
  "tokenAllowlist": [
    "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "0x4200000000000000000000000000000000000006"
  ],
  "allowedChains": [8453],
  "recipientAllowlist": [],
  "maxRiskScore": 30,
  "requireApprovalAbove": { "valueWei": "100000000000000000" },
  "maxTxPerHour": 10
}

Step 3: RPC configuration

Use a paid provider for production. Configure per-chain:

ISCL_RPC_URL_1=https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY
ISCL_RPC_URL_8453=https://base-mainnet.g.alchemy.com/v2/YOUR_KEY

Step 4: Monitoring

Health checks

Poll the health endpoint:

curl -f http://localhost:3100/v1/health

Log monitoring

ISCL Core uses pino for structured JSON logging. Forward logs to your monitoring stack:

# Follow logs
docker compose logs -f iscl-core

# Pipe to a log aggregator
docker compose logs -f iscl-core | your-log-forwarder

Set log level via environment:

LOG_LEVEL=warn  # Options: trace, debug, info, warn, error, fatal

Key metrics

Metric	Source	Warning Threshold
RPC response time	Application logs	>500ms average
Pending approvals	`GET /v1/approvals/pending`	>10 stale requests
SQLite DB size	File system	>1GB
Memory usage	Docker stats	>400MB

Step 5: Backup

Keystore backup

The keystore contains encrypted private keys. Back up the Docker volume:

# Backup
docker run --rm -v keystore-data:/data -v $(pwd):/backup alpine \
  tar czf /backup/keystore-backup-$(date +%Y%m%d).tar.gz -C /data .

# Restore
docker run --rm -v keystore-data:/data -v $(pwd):/backup alpine \
  tar xzf /backup/keystore-backup-20250214.tar.gz -C /data

Audit database backup

docker run --rm -v audit-data:/data -v $(pwd):/backup alpine \
  cp /data/audit.sqlite /backup/audit-backup-$(date +%Y%m%d).sqlite

When backing up SQLite in WAL mode, copy all three files: audit.sqlite, audit.sqlite-wal, and audit.sqlite-shm. Or use the SQLite .backup command for a consistent copy.

Step 6: Maintenance

Database vacuuming

SQLite does not automatically reclaim space from deleted rate limit entries:

sqlite3 /path/to/audit.sqlite "VACUUM;"

Run during maintenance windows. VACUUM temporarily doubles disk usage.

Log rotation

Docker handles log rotation via the logging driver. Configure in daemon.json:

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

Verification

ISCL Core starts and passes health checks

Port 3100 is only accessible from localhost

Approval mode is web or cli (not auto)

Policy config has appropriate limits

Keystore backup procedure works and can be restored

Logs are forwarded to your monitoring system

Next steps

Configuration Reference — All configuration options
Policy Engine — Tuning policy rules
Approval Model — Choosing the right approval mode

Walkthroughs

Advanced

Production Deployment

What you will learn

Deployment architecture

Step 1: Docker setup

Build the image

Docker Compose configuration

Step 2: Security hardening

Checklist

Policy configuration

Step 3: RPC configuration

Step 4: Monitoring

Health checks

Log monitoring

Key metrics

Step 5: Backup

Keystore backup

Audit database backup

Step 6: Maintenance

Database vacuuming

Log rotation

Verification

Next steps

​What you will learn

​Deployment architecture

​Step 1: Docker setup

​Build the image

​Docker Compose configuration

​Step 2: Security hardening

​Checklist

​Policy configuration

​Step 3: RPC configuration

​Step 4: Monitoring

​Health checks

​Log monitoring

​Key metrics

​Step 5: Backup

​Keystore backup

​Audit database backup

​Step 6: Maintenance

​Database vacuuming

​Log rotation

​Verification

​Next steps

What you will learn

Deployment architecture

Step 1: Docker setup

Build the image

Docker Compose configuration

Step 2: Security hardening

Checklist

Policy configuration

Step 3: RPC configuration

Step 4: Monitoring

Health checks

Log monitoring

Key metrics

Step 5: Backup

Keystore backup

Audit database backup

Step 6: Maintenance

Database vacuuming

Log rotation

Verification

Next steps