# AEGIS — Reference Deployment Models

- **Document ID:** ARCH-26
- **Phase:** D — Deployment & Long View
- **Status:** Draft for review (post four-reviewer discipline)
- **Version:** 0.1
- **Date:** 2026-07-10
- **Owner:** Chief Security Architect
- **Depends on:** ARCH-25

---

## 1. Purpose

Enumerate the deployment topologies AEGIS supports at v0-GA, sized and tested. Each Reference Model has: components, sizing, network diagram, admission policy set, upgrade procedure, RTO/RPO, assurance level, and cloud-off test coverage.

## 2. Reference Models Summary

| ID | Model | Target | Assurance Level (v0-GA) | Notes |
|---|---|---|---|---|
| R-1 | **Single-node VPS** | Individuals, small teams, dev | L1 Basic | 1 host; software-emulated HSM in dev; PKCS#11 device recommended for production |
| R-2 | **Single-node Docker** | Prosumer, small on-prem | L1 Basic | Docker Compose supervision; same as R-1 substrate-wise |
| R-3 | **Kubernetes small (self-hosted)** | Small enterprise | L2 Independent | 3–6 nodes, single region, single AZ |
| R-4 | **Kubernetes HA (self-hosted)** | Mid to large enterprise | L3 Continuous | Multi-AZ, HA Kernel replicas, separate Recovery Domain namespace |
| R-5 | **Air-gapped Kubernetes** | Regulated / gov-adjacent | L3 Continuous | No egress; signed-bundle updates; L1+L2 AI only |
| R-6 | **Cloud-native customer-owned (AWS/Azure/GCP)** | Cloud-first customers | L2–L3 | Uses cloud KMS/HSM; still customer-owned account |
| R-7 | **Hosted multi-tenant (future v1+)** | SMB SaaS + MSSP | L4 High | Per-region cluster; per-tenant partition; not in v0-GA |

## 3. R-1 Single-node VPS

- **Sizing (target):** 16 vCPU, 64 GB RAM, 1 TB NVMe. Meets NF-3.1 (10M events/day baseline).
- **Substrates:** PostgreSQL + ClickHouse local; NATS + Redpanda local; MinIO object store; PKCS#11 or YubiHSM for keys.
- **Kernel HA:** primary + warm standby in-process supervisor; RTO ≤ 1 s per ARCH-06.
- **Admission:** container-level image-signature verification via cosign hook in the supervisor.
- **Backups:** local snapshot + external S3-compatible target + off-media air-gap copy per week (ARCH-18).
- **Cloud-off test:** must pass.
- **Upgrade:** signed release bundle; blue/green via second supervisor slot; automatic rollback on health regression.

## 4. R-3 Kubernetes small (self-hosted)

- **Sizing:** 3 control-plane nodes, 3–6 worker nodes (16 vCPU / 64 GB each).
- **Namespaces:** `aegis-kernel`, `aegis-engines`, `aegis-data`, `aegis-observability`, `aegis-recovery` (isolated Recovery Domain).
- **Admission:** Kyverno policies from signed bundle; enforce image signatures, SLSA-3+, distroless base allow-list, network-policy defaults.
- **Substrates:** PostgreSQL operator (Zalando/CloudNative-PG), ClickHouse Operator, Redpanda Operator, NATS Operator, MinIO Operator.
- **HA:** Kernel StatefulSet with N ≥ 2 replicas; leader-elected writes; verification horizontally scaled.
- **RTO/RPO:** ≤ 4 h RTO; RPO per ARCH-02 NF-1.3.

## 5. R-4 Kubernetes HA (self-hosted)

- **Multi-AZ or multi-region.**
- **Per-tenant partitioning** on Kafka + ClickHouse.
- **Recovery Domain in a separate cluster + separate cloud account.**
- **Watchdogs distributed across engines** (ARCH-13 §6.2).
- **RTO ≤ 2 h; RPO ≤ 5 min control plane; ≤ 1 min audit chain.**

## 6. R-5 Air-gapped Kubernetes

- **No external egress from the runtime.**
- **AI:** L1 + L2 (Qwen primary, Llama fallback); L3 disabled at Kernel policy.
- **Updates:** signed bundles delivered via one-way transfer + physical media chain-of-custody.
- **Ceremony:** conducted on-site; hardened workstation; multi-party.
- **Telemetry:** internal only; no opt-in external export.
- **Assurance:** L3 Continuous — every release runs air-gap-variant integration test.

## 7. R-6 Cloud-native customer-owned

- **AWS:** EKS + RDS-Postgres + MSK-Kafka + KMS + S3 with Object Lock.
- **Azure:** AKS + Azure Database for Postgres + Event Hubs + Key Vault + Blob Storage with immutability.
- **GCP:** GKE + Cloud SQL + Pub/Sub + Cloud KMS + Cloud Storage with retention policies.
- **Note.** Managed Kafka/Pub-Sub substitutes must satisfy AEGIS's per-record integrity contract; adapter documented.
- **KMS:** customer-owned; cross-account for Recovery Domain.

## 8. R-2 / R-7 (deferred detail)

- R-2 is Docker Compose over R-1 substrate; documented for prosumer path; assurance L1.
- R-7 hosted multi-tenant: v1+; requires MSSP control plane + hosted-signed hierarchy + per-region isolation; ARCH-32 roadmap.

## 9. Sizing Reference

Per NF-3.1 (10M events/day baseline) on R-1: measured on 16 vCPU / 64 GB / NVMe; documented in a signed sizing spreadsheet updated per release.

## 10. Independent Architecture Review

- **F-1.** *Reference sizes drift from real workloads.* Sizing recomputed per release; canary tenants exercise against fresh baselines.
- **F-2.** *Managed cloud services differ subtly (e.g., MSK vs. Redpanda).* Adapter layer smooths; per-service test suite verifies contract adherence.
- **F-3.** *Air-gap workflow scale-up.* Documented in ARCH-23; drilled.

## 11. Adversarial Architect Review

- **A-1.** *Bad admission policy shipped for a topology.* Policies are signed configs (ARCH-22); drift detected; canary test verifies enforcement.
- **A-2.** *Cloud-provider KMS compromise (R-6).* Envelope encryption + separate Recovery KEK hierarchy in another region/account; drilled kill-switch.
- **A-3.** *Single-node R-1 with software HSM used in production.* Documented as L1 only; ceremony not permitted; Debt Register (ARCH-29) captures if used.

## 12. Operational Reliability Review

- **O-1.** Reference upgrade procedures per model; drilled per release channel.
- **O-2.** Sizing tables kept current; auto-scale tuning per topology.
- **O-3.** Per-topology observability dashboards.
- **O-4.** Air-gap has its own on-call playbook (limited external contact).

## 13. Self-Critique

- **S-1.** *R-1 straddles "dev" and "small prod".* Cleaner to distinguish — added: R-1 has a "prod profile" (PKCS#11 + external S3 + weekly air-gap copy) documented separately from dev.
- **S-2.** *R-2 Docker Compose easy to underinvest in.* Kept minimal; documented explicitly as a subset of R-1's controls.
- **S-3.** *Cloud-managed substrates create per-provider quirks.* Adapter layer surfaces this; documented in per-provider addenda.

Revising: added R-1 dev/prod profile distinction.

## 14. First-Target Analysis and Redesign

**Target:** managed-cloud substrate substitution (R-6). If customers substitute a managed service (e.g., managed Kafka) that silently deviates from the AEGIS per-record integrity contract, downstream security assumptions break without any obvious failure.

**Response:**
1. **Contract tests** for every substitutable substrate; run against the actual chosen backend at deployment time.
2. **Runtime contract assertions** on ingest and normalization paths; violations alarm.
3. **Provider trust vector** (ARCH-11) tracks provider deviations; automated fallback.
4. **Documented allow-list** per topology.

**Second target:** admission-policy drift. Response: signed policies + Kyverno diff monitor + canary test.

## 15. Decisions

### D-26-1. Seven reference models with graduated assurance

- **Advantages.** Clear customer guidance; assurance-visible.
- **Reason.** Mandate #36 (Assurance Levels).

### D-26-2. Contract tests for substitutable substrates

- **Advantages.** Structural defense against managed-substrate quirks.
- **Reason.** §14 first-target redesign.

## 16. Open Questions

- Q-26-1. R-7 detailed design deferred to v1 planning.
- Q-26-2. Windows Server variant for R-3 subset. Deferred per NF-8.3.

## 17. Change Log

- **0.1 (2026-07-10)** — Initial draft.