# Phase 1: Next Steps Execution Plan

## 📋 Task Checklist

### ✅ Completed Tasks
- [x] Infrastructure deployment (104 resources)
- [x] Nginx backend configuration
- [x] Cloudflare Tunnel setup
- [x] DNS configuration
- [x] SSL/TLS setup
- [x] Endpoint verification

### 📋 Pending Tasks

#### Task 1: Besu Node Configuration (5 VMs)
- [ ] Central US (10.3.1.4)
- [ ] East US (10.1.1.4)
- [ ] East US 2 (10.4.1.4)
- [ ] West US (10.2.1.4)
- [ ] West US 2 (10.5.1.4)

#### Task 2: Cross-Region Connectivity
- [ ] Choose connectivity solution (VPN/ExpressRoute/Cloudflare Tunnel)
- [ ] Implement connectivity
- [ ] Test connectivity from Nginx to backend VMs
- [ ] Update Nginx configuration if needed

#### Task 3: Besu Genesis Configuration
- [ ] Generate/obtain genesis file
- [ ] Upload to storage/Key Vault
- [ ] Configure on all backend VMs

#### Task 4: Security Hardening
- [ ] Review NSG rules
- [ ] Configure Key Vault access policies
- [ ] Enable security recommendations
- [ ] Rotate secrets

#### Task 5: Monitoring Setup
- [ ] Configure Log Analytics queries
- [ ] Set up alerts
- [ ] Create dashboards

#### Task 6: Backup Configuration
- [ ] Configure backup policies
- [ ] Test backup/restore
- [ ] Document procedures

---

## 🎯 Immediate Next Steps (Priority Order)

### 1. Configure Besu Nodes (REQUIRED)
**Why**: Backend VMs need Besu to provide RPC functionality  
**Effort**: ~15 minutes per VM  
**Blockers**: Requires VPN/Bastion access

**Action Items:**
- [ ] Establish VPN/Bastion access to backend VMs
- [ ] For each VM: SSH, download script, run setup
- [ ] Verify Besu is running on all 5 VMs
- [ ] Test RPC endpoints locally on each VM

### 2. Implement Cross-Region Connectivity (REQUIRED)
**Why**: Nginx needs to reach backend VMs via private IPs  
**Effort**: 1-4 hours (depending on solution)  
**Blockers**: Network infrastructure decision

**Action Items:**
- [ ] Decide on connectivity solution:
  - Option A: Azure VPN/ExpressRoute (recommended)
  - Option B: Cloudflare Tunnel on backend VMs
  - Option C: Azure Private Link
- [ ] Implement chosen solution
- [ ] Test connectivity: `ping 10.1.1.4` from Nginx proxy
- [ ] Verify Nginx can reach all backend VMs

### 3. Configure Besu Genesis (REQUIRED)
**Why**: Besu needs genesis file to start blockchain  
**Effort**: ~30 minutes  
**Blockers**: Need genesis file

**Action Items:**
- [ ] Generate or obtain genesis file for Chain ID 138
- [ ] Upload to Azure Storage or Key Vault
- [ ] Update Besu config on all backend VMs
- [ ] Restart Besu services

### 4. Security Hardening (HIGH PRIORITY)
**Why**: Production security requirements  
**Effort**: 2-4 hours  
**Blockers**: None

**Action Items:**
- [ ] Review and tighten NSG rules
- [ ] Configure Key Vault network ACLs
- [ ] Enable Azure Security Center
- [ ] Review access policies
- [ ] Rotate secrets if needed

---

## 📝 Detailed Execution Steps

### Step 1: Besu Node Configuration

**Prerequisites:**
- VPN/Bastion access to backend VMs
- SSH keys configured

**For Each Backend VM:**

```bash
# 1. Connect to VM
ssh besuadmin@<backend-vm-ip>

# 2. Download setup script
wget https://raw.githubusercontent.com/your-repo/terraform/phases/phase1/scripts/setup-besu-node.sh
chmod +x setup-besu-node.sh

# 3. Run setup (replace <region> with actual region)
sudo ./setup-besu-node.sh besu-node 0 <region>

# 4. Verify
sudo systemctl status besu.service
docker ps
curl http://localhost:8545
curl http://localhost:9545/metrics
```

**Backend VM IPs:**
- Central US: `ssh besuadmin@10.3.1.4` → `centralus`
- East US: `ssh besuadmin@10.1.1.4` → `eastus`
- East US 2: `ssh besuadmin@10.4.1.4` → `eastus2`
- West US: `ssh besuadmin@10.2.1.4` → `westus`
- West US 2: `ssh besuadmin@10.5.1.4` → `westus2`

### Step 2: Cross-Region Connectivity

**Option A: Azure VPN (Recommended)**

```bash
# 1. Create VPN Gateway (in hub region)
# 2. Configure site-to-site connections
# 3. Update route tables
# 4. Test from Nginx proxy
ssh besuadmin@20.160.58.99
ping 10.1.1.4
curl http://10.1.1.4:8545
```

**Option B: Cloudflare Tunnel on Backend VMs**

```bash
# For each backend VM (via VPN/Bastion)
ssh besuadmin@<backend-vm-ip>
/tmp/setup-cloudflare-tunnel-backend.sh <vm-name> <region>
# Then update Nginx to use Cloudflare Tunnel endpoints
```

### Step 3: Besu Genesis Configuration

```bash
# 1. Generate or obtain genesis file
# 2. Upload to storage
az storage blob upload \
  --account-name <storage-account> \
  --container-name config \
  --name genesis.json \
  --file genesis.json

# 3. Update Besu config on each VM
# Download from storage or copy from Key Vault
# Update /opt/besu/config/genesis.json
# Restart Besu
sudo systemctl restart besu.service
```

### Step 4: Security Hardening

```bash
# 1. Review NSG rules
az network nsg rule list --nsg-name <nsg-name> -g <rg>

# 2. Tighten rules (restrict SSH, RPC access)
# 3. Configure Key Vault network ACLs
# 4. Enable Security Center recommendations
# 5. Review access policies
```

---

## 🔍 Verification Steps

### After Besu Configuration
```bash
# On each backend VM
sudo systemctl status besu.service
docker ps
curl http://localhost:8545
curl http://localhost:9545/metrics
```

### After Connectivity Setup
```bash
# From Nginx proxy
ssh besuadmin@20.160.58.99
ping 10.1.1.4
curl http://10.1.1.4:8545
# Test all 5 backend VMs
```

### After Full Setup
```bash
# Test public endpoint
curl https://rpc.d-bis.org/health
curl -X POST https://rpc.d-bis.org/rpc \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
```

---

## 📊 Progress Tracking

### Current Status
- **Infrastructure**: ✅ 100% Complete
- **Services**: ✅ 50% Complete (Nginx ✅, Cloudflare ✅, Besu ⏳)
- **Connectivity**: ⏳ 0% Complete
- **Configuration**: ⏳ 0% Complete
- **Security**: ⏳ 0% Complete

### Estimated Completion
- **Minimum Viable**: 2-4 hours (Besu + Connectivity)
- **Production Ready**: 1-2 days (All tasks)

---

## 🎯 Success Criteria

### Minimum Viable Product
- [x] Infrastructure deployed
- [x] Cloudflare Tunnel working
- [ ] Besu running on all 5 backend VMs
- [ ] Nginx can reach backend VMs
- [ ] RPC endpoints responding

### Production Ready
- [x] All infrastructure deployed
- [x] Cloudflare Tunnel configured
- [ ] Besu configured and running
- [ ] Cross-region connectivity established
- [ ] Security hardened
- [ ] Monitoring configured
- [ ] Backups configured
- [ ] Documentation complete

---

**Next Action**: Configure Besu nodes on backend VMs (requires VPN/Bastion access)

