Overview 29148 §5.2
This specification defines the technology infrastructure required to deploy the Symphonix Health platform. It covers compute, storage, networking, security, and supporting services across three deployment profiles. All requirements trace to ISO/IEC/IEEE 29148:2018 (system requirements), TOGAF Technology Architecture, and applicable healthcare regulations.
Platform Components
BulletTrain
Health Information Exchange microservices. Core registries, clinical workflows, AI/ML, integrations, and administrative services. Ports 8000-8310.
Nexus A2A
Agent-to-Agent protocol agents across 6 demo groups. JSON-RPC 2.0, clinician avatar, command centre, on-demand gateway. Ports 8021-8100.
GHARRA
Global Healthcare Agent Registry & Routing Authority. API server, Next.js frontend, Prometheus, Grafana, Redis, Kafka. Ports 3000-9092.
Deployment Profile Summary TOGAF ADM Phase D
| Resource | Small (Dev / PoC) | Medium (Regional) | Large (Enterprise) |
|---|---|---|---|
| Kubernetes Nodes | 1 node (or Docker Compose) | 3–5 nodes | 9–15 nodes (multi-region) |
| Total vCPUs | 8 | 32–48 | 128–192 |
| Total RAM | 32 GB | 128–192 GB | 512–768 GB |
| GPU | None (cloud API) | 1× NVIDIA T4 16 GB | 2–4× NVIDIA A10G 24 GB |
| Concurrent Users | 5–10 | 50–200 | 1,000+ |
| Active Services | ~20 | ~80 | 200+ |
| Database | SQLite (file-based) | PostgreSQL 16 single node | PostgreSQL 16 HA + 2 replicas |
| Cache | Single Redis 256 MB | Single Redis 2 GB | 3-node Redis Cluster, 6 GB/node |
| Event Streaming | In-memory EventBus | Kafka single broker 50 GB | Kafka 3–5 brokers, 100 GB/broker |
| Authentication | JWT HS256 (dev secret) | OIDC + JWT RS256 | OIDC + mTLS + DPoP + MFA |
| Availability Target | — | 99.5% | 99.99% |
| Estimated Monthly Cost | $50–200 (dev) | $2,000–5,000 | $15,000–50,000+ |
Compute Platform Services
CPU, memory, and GPU requirements per service category. All values are Kubernetes resource requests and limits derived from production manifests.
Per-Service Resource Allocation
| Service Category | Instances (S/M/L) | CPU Request | CPU Limit | Mem Request | Mem Limit |
|---|---|---|---|---|---|
| BulletTrain Core (per svc) | 10 / 50 / 168 | 100m | 500m | 256Mi | 512Mi |
| Nexus A2A Agent (per agent) | 5 / 25 / 32 | 100m | 500m | 256Mi | 512Mi |
| GHARRA API Server | 1 / 2 / 4 | 100m | 500m | 256Mi | 512Mi |
| API Gateway | 1 / 2 / 4 | 200m | 1000m | 256Mi | 512Mi |
| SignalBox Control Plane | 1 / 2 / 3 | 200m | 1000m | 512Mi | 1Gi |
| MCP Servers (per server) | 2 / 5 / 7 | 100m | 500m | 256Mi | 512Mi |
| GHARRA Frontend (Next.js) | 1 / 2 / 3 | 100m | 250m | 128Mi | 256Mi |
| BulletTrain Frontend (React) | 1 / 2 / 3 | 50m | 200m | 128Mi | 256Mi |
| Command Centre | 1 / 1 / 2 | 100m | 500m | 256Mi | 512Mi |
| Computer Use Session (each) | 0 / 1 / 5 | 200m | 1000m | 512Mi | 1Gi |
GPU Requirements
| Workload | Small | Medium | Large |
|---|---|---|---|
| LLM Inference (local) | None — OpenAI API | 1× T4 16 GB (llama.cpp, port 18080) | 2× A10G 24 GB |
| Whisper STT (local) | None — cloud API | Shared with LLM GPU | 1× A10G dedicated |
| TTS (local) | None — OpenAI TTS | Shared with LLM GPU | 1× A10G dedicated |
| Playwright / Chromium | N/A | CPU-only, 200m / 512Mi per session | CPU-only, 200m / 1Gi per session |
Runtime Versions 29148 §6.3
| Runtime | Version | Notes |
|---|---|---|
| Python | ≥3.11 (3.12 recommended) | Docker base: python:3.11-slim |
| Node.js | 20 LTS | Frontend builds, Playwright, Mermaid |
| PostgreSQL | 16 | Production database (asyncpg driver) |
| Redis | 7 | Alpine image, hiredis client |
| Kafka | ≥3.5 | aiokafka Python client |
| Elasticsearch | 8.11+ | Optional, for SNOMED CT (Snowstorm) |
| Docker | ≥20.10 | Docker Compose v2+ |
| Kubernetes | ≥1.28 | Medium/Large deployments |
Storage Data Architecture
Database, object storage, and file storage sizing per deployment profile. All persistent volumes require SSD/NVMe-class storage for production workloads.
| Component | Small | Medium | Large |
|---|---|---|---|
| Primary Database | SQLite (file) | PostgreSQL 16, 100 GB SSD | PostgreSQL 16 HA, 500 GB–1 TB NVMe, primary + 2 replicas |
| Redis | Single, 256 MB | Single, 2 GB, AOF | 3-node cluster, 6 GB/node, AOF + RDB |
| Elasticsearch | N/A | Single node, 50 GB | 3-node cluster, 200 GB/node |
| Kafka Logs | N/A (in-memory) | 50 GB, 7-day retention | 100 GB/broker, 30-day retention |
| Object Storage (DICOM, docs) | Local filesystem, 10 GB | Azure Blob / S3, 500 GB | Multi-region replicated, 5 TB+ |
| FHIR Data (HAPI) | Embedded H2, 5 GB | PostgreSQL backend, 50 GB | PostgreSQL HA, 200 GB |
| JSONL Event Logs | Local, 5 GB (2 MB rotation) | Persistent volume, 50 GB | Centralised log store, 200 GB |
| Audit Trail (immutable) | SQLite, 1 GB | PostgreSQL table, 20 GB | Dedicated PostgreSQL, 100 GB |
| Prometheus Metrics | N/A | 5 GB, 15-day retention | 20 GB, 30-day retention |
| Grafana Data | N/A | 100 MB | 500 MB |
Backup & Retention 164.312(c)
| Policy | Small | Medium | Large |
|---|---|---|---|
| Database Backup | Manual / none | Daily automated, 7-day retention | Hourly incremental, 30-day + annual archive |
| Point-in-Time Recovery | N/A | 7-day window | 30-day window |
| Audit Log Retention | 30 days | 1 year | 7 years (HIPAA minimum) |
| Clinical Data Retention | Session only | Per-jurisdiction (typically 6–10 years) | Per-jurisdiction, configurable |
| Disaster Recovery | N/A | Cold standby, 4-hour RPO | Hot standby, 15-min RPO, multi-region |
Networking SP 800-53 SC
Port allocations, load balancing, service mesh, and firewall configuration. All internal traffic should use private subnets; only ports 80/443 are exposed to the internet.
Port Registry
Colour key: Nexus A2A · GHARRA · BulletTrain · Infrastructure
| Port(s) | Service | Protocol | Category |
|---|---|---|---|
| 80, 443 | Production Load Balancer / CDN | HTTPS | Frontend + API |
| 5173 | Vite Dev Server (BulletTrain) | HTTP | Frontend Dev |
| 8000–8009 | BT Core Registries (API GW, Client, HW, Facility, SHR, Terminology, Finance, FHIR, Consent) | HTTP/REST | Core (10 svcs) |
| 8010–8069 | BT Workflow, Clinical, Scheduling (Conductor, Orchestration, Diagnostic, Telemedicine, etc.) | HTTP/REST | Workflow (30+ svcs) |
| 8021–8023 | Nexus ED Triage (triage, diagnosis, OpenHIE mediator) | JSON-RPC 2.0 | A2A Agents |
| 8024–8029 | Nexus HelixCare (imaging, pharmacy, bed, discharge, followup, coordinator) | JSON-RPC 2.0 | A2A Agents |
| 8031–8033 | Nexus Telemed Scribe (transcriber, summariser, EHR writer) | JSON-RPC 2.0 | A2A Agents |
| 8034–8039 | Nexus HelixCare (primary care, specialty, telehealth, home visit, CCM, avatar) | JSON-RPC/WS/SSE | A2A Agents |
| 8041–8044 | Nexus Consent Verification (insurer, provider, analyser, HITL UI) | JSON-RPC 2.0 | A2A Agents |
| 8051–8053 | Nexus Public Health (hospital reporter, OSINT, central surveillance) | JSON-RPC 2.0 | A2A Agents |
| 8060–8067 | Nexus Interop Gateways (FHIR profile, X12, NCPDP, audit, HL7v2, CDA, DICOM) | JSON-RPC 2.0 | A2A Agents |
| 8080 | HAPI FHIR Server (Mock) | HTTP/REST | FHIR |
| 8090 | Compliance HITL Agent | HTTP | Governance |
| 8099 | Nexus Command Centre | HTTP/WS | Monitoring |
| 8100 | Nexus On-Demand Gateway | JSON-RPC 2.0 | Routing |
| 8100–8123 | BT AI/ML (LLM Router, Guardrail, Bevan LLM, Prompt Constructor) | HTTP/REST | AI/ML (16 svcs) |
| 8115–8130 | BT Media & Comms (DICOM, Image, OCR, Voice, WhatsApp, Email/SMS, Notifications) | HTTP/REST/WS | Media (10 svcs) |
| 8150–8172 | BT Integration Connectors (HL7v2, FHIR, X12, Clearinghouse, Connector Registry) | HTTP/REST | Connectors (15 svcs) |
| 8180–8190 | BT Security & Policy (Policy DP, Secrets Mgr, Rate Limiter, Audit Store) | HTTP/REST | Security (11 svcs) |
| 8200–8216 | BT Public Health & MCP Servers (Surveillance, Terminology MCP, FHIR MCP, etc.) | HTTP/REST/MCP | Public Health + MCP (12 svcs) |
| 8220–8231 | BT Control Plane (SignalBox Control Plane, Session Supervisor, Temporal Worker) | HTTP/WS | Orchestration (5 svcs) |
| 3000 | GHARRA Frontend (Next.js) | HTTP | Frontend |
| 8400 | GHARRA API Server | HTTP/REST | Registry API |
| 5432 | PostgreSQL 16 | TCP | Database |
| 6379 | Redis 7 | TCP | Cache / Sessions |
| 9092 | Kafka | TCP | Event Streaming |
| 9200 | Elasticsearch 8 | HTTP | Search (SNOMED) |
| 1883, 9001 | MQTT Broker (Mosquitto) + WebSocket | TCP/WS | IoT Events |
| 9090 | Prometheus | HTTP | Metrics |
| 3001 | Grafana | HTTP | Dashboards |
| 16686 | Jaeger | HTTP | Tracing |
| 18080 | Local LLM (llama.cpp) | HTTP | AI Inference |
Load Balancing
| Layer | Small | Medium | Large |
|---|---|---|---|
| L7 (HTTP/HTTPS) | Direct access (no LB) | Nginx reverse proxy or cloud ALB | Cloud ALB + WAF + CDN |
| L4 (TCP) | N/A | N/A | NLB for PostgreSQL, Kafka, Redis |
| Ingress Controller | N/A | nginx-ingress or Traefik | nginx-ingress + cert-manager |
| SSL Termination | Self-signed / Let’s Encrypt | Managed certificates | Private CA + auto-rotation |
| WebSocket Support | Direct (20 clients max) | ALB with sticky sessions | ALB + connection draining |
Firewall Rules AC-4
| Direction | Source / Destination | Ports | Protocol | Purpose |
|---|---|---|---|---|
| Ingress | Internet → LB | 443, 80 | HTTPS/HTTP | Frontend + API |
| Ingress | LB → Services | 8000–8400 | HTTP | Internal microservices |
| Ingress | Monitoring subnet | 9090, 3001, 16686 | HTTP | Observability stack |
| Egress | Services → api.openai.com | 443 | HTTPS | LLM inference + TTS |
| Egress | Services → SMTP relay | 587 | TLS | Email notifications |
| Egress | Services → Twilio / LiveKit | 443 | HTTPS/WSS | Voice, video, SMS |
| Egress | GHARRA → Federation peers | 443 | HTTPS | Registry federation |
| Internal | Service mesh | All internal | mTLS | Service-to-service |
| Default | All other | All | * | DENY |
Security HIPAA §164.312 SP 800-53
Identity, access management, encryption, and compliance requirements. The platform enforces zero-trust: every request is re-authenticated regardless of network location.
Authentication & Authorisation
| Requirement | Small | Medium | Large |
|---|---|---|---|
| User Authentication | JWT HS256 (dev secret) | OIDC via Keycloak | OIDC + MFA + SSO |
| Service-to-Service | Shared JWT secret | JWT RS256 + optional mTLS | Mandatory mTLS + SPIFFE |
| Agent Auth (Nexus) | JWT HS256 | JWT RS256 + DID verify | JWT + DID + DPoP |
| Registry Auth (GHARRA) | Auth disabled | JWT + rate limiting | JWT + mTLS + DPoP + WAF |
| API Keys | N/A | SHA-256 hashed, scoped | SHA-256, rotation 90d, KV-backed |
| Token Expiry | 1h browser tokens | 15m access / 24h refresh | 5m access / 1h refresh / rotation |
| IAM Groups | 1 (admin) | 3 (admin, clinical, ops) | 5+ (admin, clinical-high, clinical-med, ops, governance, connector) |
| RBAC / ABAC | Basic role checks | RBAC per service | Full ABAC policy engine with PDP |
Encryption & Data Protection
| Requirement | Small | Medium | Large |
|---|---|---|---|
| In Transit | TLS 1.2+ (optional) | TLS 1.3, mTLS internal | TLS 1.3 mandatory, mTLS all services |
| At Rest | OS-level encryption | AES-256 managed keys | AES-256 + customer-managed keys (CMK) |
| PHI Scanning | Disabled | Ingress middleware (GHARRA gateway) | All ingress + egress paths |
| Secrets Store | .env files | Azure Key Vault / AWS Secrets Manager | HSM-backed KV + auto-rotation |
| Audit Ledger | JSONL file | PostgreSQL hash-chained table | Immutable, tamper-evident, WORM |
| Audit Retention | 30 days | 1 year | 7 years (HIPAA 164.530(j)) |
Rate Limiting (GHARRA Tiers)
| Tier | Req/min | Req/day | Max Agents | Federation | SLA |
|---|---|---|---|---|---|
| developer | 60 | 1,000 | 5 | No | — |
| team | 300 | 25,000 | 50 | No | 99.5% |
| business | 1,000 | 100,000 | 500 | Yes | 99.9% |
| scale | 5,000 | 500,000 | 5,000 | Yes | 99.95% |
| enterprise | 50,000 | 5,000,000 | 100,000 | Yes | 99.99% |
Observability Operational
Monitoring, tracing, logging, and alerting infrastructure. SLO target: 99.9% availability, P99 latency <500ms.
| Component | Small | Medium | Large |
|---|---|---|---|
| Metrics | Console logs only | Prometheus (100m CPU, 512Mi), 15s scrape | Prometheus HA (Thanos/Cortex), 15s scrape |
| Dashboards | N/A | Grafana (50m CPU, 256Mi) | Grafana HA + custom dashboards |
| Tracing | N/A | Jaeger + OpenTelemetry (OTLP) | Jaeger/Tempo HA + OpenTelemetry Collector |
| Logging | stdout / stderr | Structured JSON, 30-day retention | Structured JSON, SIEM integration, 1-year retention |
| Alerting | N/A | Prometheus Alertmanager (basic rules) | Multi-burn-rate SLO alerts (fast 1h / medium 6h / slow 24h) |
| Health Checks | Manual | /health + /ready probes, 30s interval | /health + /ready, 15s interval, auto-remediation |
| Key Alert Rules | — | Error budget fast-burn, high latency P99 | Error budget 3-tier, rate limit spikes, federation circuit open, auth failure spike, PHI block spike |
AI/ML Infrastructure Application Services
Large language model access, local inference, voice processing, and browser automation requirements.
LLM Models
| Model | Provider | Used By | Purpose |
|---|---|---|---|
| gpt-4o-mini | OpenAI API | Nexus agents (default) | Clinical reasoning, diagnosis, summarisation |
| gpt-4o-mini-tts | OpenAI API | Clinician Avatar | Text-to-speech (PCM 24kHz 16-bit mono) |
| gpt-5.1 | OpenAI API | BulletTrain LLM Router | Clinical decision support, governance |
| gpt-5-mini | OpenAI API | BulletTrain Guardrail | Safety guardrails, NER extraction |
| claude-opus-4-6 | Anthropic API | GHARRA Computer Use | Browser automation via Playwright |
| smollm2 (GGUF) | Local llama.cpp | Nexus (offline profile) | Air-gapped / low-latency inference |
| whisper (base.en) | Local / OpenAI | BulletTrain Voice | Speech-to-text transcription |
| VCTK VITS | Local TTS | BulletTrain Voice | Local text-to-speech |
API Key Requirements
| API | Small | Medium | Large |
|---|---|---|---|
| OpenAI API | 1 key, pay-as-you-go | 1 key, $200-500/mo budget | Enterprise agreement, $2,000-10,000/mo |
| Anthropic API | N/A | 1 key (computer use only) | 1 key, dedicated quota |
| Local Inference | N/A | 1× T4 GPU node | Dedicated GPU pool |
Browser Automation (Computer Use)
Playwright Chromium Sessions
GHARRA computer use requires headless Chromium via Playwright. Each session: 200m–1000m CPU, 512Mi–1Gi RAM, display 1280×800 (configurable 800-1920 × 600-1200). Max 50 turns per task. Requires ANTHROPIC_API_KEY server-side.
Message Brokers & Events
Event streaming, caching, and IoT messaging infrastructure. The platform uses a tiered fallback: Kafka → Redis pub/sub → in-memory EventBus.
| Component | Small | Medium | Large |
|---|---|---|---|
| Kafka Brokers | N/A (in-memory EventBus) | 1 broker, 3 partitions/topic | 3–5 brokers, 6+ partitions, replication factor 3 |
| Kafka Storage | — | 50 GB, 7-day retention | 100 GB/broker, 30-day retention |
| Kafka Security | — | PLAINTEXT | SASL_PLAIN + TLS |
| Redis Mode | Single instance, 256 MB | Single + AOF, 2 GB | 3-node Sentinel or Cluster, 6 GB/node |
| Redis Use Cases | Basic caching | Sessions, rate limiting, pub/sub | Distributed state, event bus, CRI cache |
| MQTT Broker | N/A | Mosquitto single, port 1883 + WS 9001 | Mosquitto clustered or EMQX |
| WebSocket (Command Centre) | Direct, 20 clients max | 20 clients, 5s poll cycle | 50+ clients via LB, 2s poll cycle |
| SSE Streams | Per-agent, 64 events buffer | Per-agent, cursor resume, 300s retention | Per-agent, cursor resume, Redis-backed |
Container Orchestration
Kubernetes cluster, Docker, and autoscaling configuration.
| Requirement | Small | Medium | Large |
|---|---|---|---|
| Orchestration | Docker Compose v2 | Kubernetes 1.28+ | Kubernetes 1.28+, multi-cluster |
| Nodes | 1 (host machine) | 3–5 worker nodes | 9–15 workers (multi-AZ/region) |
| Node Size | 8 vCPU / 32 GB | 8–16 vCPU / 32–64 GB per node | 16–32 vCPU / 64–128 GB per node |
| Container Base | python:3.11-slim + tini (PID 1 handling) for all agents. node:20-alpine for frontends. | ||
| Container Registry | Local build only | Azure ACR / AWS ECR (Basic SKU) | ACR/ECR (Standard), geo-replicated |
| HPA (Autoscaling) | N/A | CPU-based, 70% threshold | Custom metrics (request rate, queue depth), 70% CPU |
| Min/Max Replicas | 1 / 1 per service | 1 / 3 per service | 2 / 10 per service |
| Health Probes | Docker HEALTHCHECK | K8s liveness (10s) + readiness (5s) | K8s liveness + readiness + startup (40s grace) |
| Namespaces | N/A | 3: platform, monitoring, data | 5+: platform, nexus, gharra, monitoring, data |
External Dependencies
Third-party services, cloud provider resources, and healthcare standards servers required for operation.
Cloud Provider Services
| Service | Azure | AWS | GCP | On-Premise |
|---|---|---|---|---|
| Compute | Container Apps | ECS / EKS | Cloud Run / GKE | Kubernetes / Docker |
| Database | Flexible Server PG 16 | RDS PostgreSQL | Cloud SQL | PostgreSQL 16 |
| Cache | Azure Cache for Redis | ElastiCache | Memorystore | Redis 7 |
| Event Streaming | Event Hubs (Kafka API) | MSK | Managed Kafka | Apache Kafka |
| Object Storage | Blob Storage | S3 | Cloud Storage | MinIO / NFS |
| Secrets | Key Vault | Secrets Manager | Secret Manager | HashiCorp Vault |
| Identity | Entra ID | Cognito / IAM | Identity Platform | Keycloak |
| Monitoring | Monitor / Log Analytics | CloudWatch | Cloud Monitoring | Prometheus + Grafana |
| DNS | DNS Zone | Route 53 | Cloud DNS | BIND / CoreDNS |
| CDN | Front Door | CloudFront | Cloud CDN | Nginx / Varnish |
Third-Party API Dependencies
| API | Purpose | Required | Env Variable |
|---|---|---|---|
| OpenAI | LLM inference + TTS | Required (unless local LLM) | OPENAI_API_KEY |
| Anthropic | Computer Use (browser automation) | Optional | ANTHROPIC_API_KEY |
| Twilio | SMS, WhatsApp, voice calls | Optional | TWILIO_ACCOUNT_SID |
| LiveKit | WebRTC video/audio (telemedicine) | Optional | LIVEKIT_URL |
| Stripe | Payment processing (marketplace) | Optional | STRIPE_SECRET_KEY |
| Exa Search | Research literature search | Optional | EXA_API_KEY |
| NHS TRUD | SNOMED CT terminology updates | Optional | TERMINOLOGY_TRUD_API_KEY |
Healthcare Standards Servers
| Server | Purpose | Small | Medium | Large |
|---|---|---|---|---|
| HAPI FHIR R4 | Clinical data store | Embedded H2 (port 8080) | HAPI + PostgreSQL | HAPI HA + PostgreSQL HA |
| Snowstorm (SNOMED CT) | Medical terminology | Offline mode | Single + Elasticsearch | HA + Elasticsearch cluster |
| Open Concept Lab | ICD, CVX, ATC codes | Offline mode | Single instance | HA instance |
Scalability
Horizontal scaling strategies, connection pooling, caching, and federation scaling for multi-region deployments.
| Strategy | Small | Medium | Large |
|---|---|---|---|
| Horizontal Pod Autoscaling | N/A | CPU-based, 70% target, max 3 replicas | Custom metrics (RPS, queue depth), max 10 replicas |
| DB Connection Pooling | N/A (SQLite) | asyncpg pool, 10 connections | PgBouncer, 50–100 connections per service |
| Cache Strategy | In-process (dict) | Redis, 60s TTL (agent cards), 5min TTL (CRI) | Redis Cluster, tiered TTL, cache-aside pattern |
| GHARRA Federation | Single registry | Single sovereign registry | Root + sovereign + organisational (3-tier), Bloom filter CRI |
| Federation Circuit Breaker | N/A | Per-peer circuit breaker (CLOSED→OPEN→HALF_OPEN) | Per-peer CB + CRI cache + timeout 5s |
| Event Bus Scaling | In-memory (single process) | Redis pub/sub (single node) | Kafka multi-partition, consumer groups |
| Multi-Region | N/A | Single region | Active-active, data residency per jurisdiction |
| CDN / Edge | N/A | Static asset CDN | Full CDN + edge caching + geo-routing |
Deployment Checklist 29148 §6.6
Pre-implementation checklist by deployment profile. Complete all items before first deployment.
All Profiles (Required)
Python 3.11+ and Node.js 20 installed
Verify runtime versions. Docker base images use python:3.11-slim and node:20-alpine.
OpenAI API key provisioned
Required for LLM inference and TTS unless using local inference profile. Set OPENAI_API_KEY.
JWT secret configured (non-default)
Change NEXUS_JWT_SECRET from dev-secret-change-me. Use 32+ character random string.
Port ranges 8000-8400 available
Verify no port conflicts across the full service port registry. See Networking section.
Medium & Large (Additional)
PostgreSQL 16 provisioned
Migrate from SQLite to PostgreSQL. Set DATABASE_URL and GHARRA_DB_URL. Automated migrations run at startup.
Redis 7 deployed
Required for distributed rate limiting, session cache, and event bus. Set REDIS_URL and GHARRA_REDIS_URL.
OIDC identity provider configured
Keycloak or cloud OIDC. Set AUTH_MODE=oidc and GHARRA_AUTH_MODE=jwt.
TLS certificates provisioned
All external-facing endpoints must use TLS 1.3. Configure ingress controller or reverse proxy with SSL termination.
Observability stack deployed
Prometheus, Grafana, and Jaeger. Import GHARRA dashboard from infra/grafana/dashboards/gharra-overview.json.
Large Only (Additional)
Kafka cluster provisioned
3–5 brokers with replication factor 3. Set GHARRA_KAFKA_BOOTSTRAP_SERVERS. Required for federation events and metering.
mTLS service mesh enabled
Set BT_MTLS_ENABLED=true and GHARRA_AUTH_MODE=mtls. Provision service certificates via cert-manager or private CA.
Multi-region networking configured
Cross-region VPC peering or mesh. GHARRA federation peers: set GHARRA_KNOWN_PEERS with sovereign registry URLs.
HSM-backed secrets management
Azure Key Vault with purge protection or AWS CloudHSM. Auto-rotation for JWT signing keys (90-day cycle).
HIPAA compliance: For deployments handling Protected Health Information (PHI), enable GHARRA_ENV=production to activate PHI scanning middleware, strict CORS enforcement, and audit logging. Never store PHI in the GHARRA registry — it is a trust anchor and key directory only.
Specification version 1.0 — Last updated 2026-03-30 — Document ID: SYMPH-TA-001 — Classification: Public