## High-level Azure Deployment Networking Diagram

This diagram shows the overall wallet network topology of the Institutional Vault deployment:

```
Azure Region

VNet 10.1.0.0/16

DB Subnet 10.1.0.0/24

AKS Subnet 10.1.8.0/21

AKS Cluster 10.2.0.0/16

Internet

Azure DNS Zone

AKS Ingress / Load Balancer

Wallet Pods

PostgreSQL Flexible Server
```

### Network and Firewall Ports

The table below summarizes the minimum network and firewall rules required for the Institutional Vault AKS deployment.

| Source | Destination | Protocol / Port(s) | Purpose / Notes |
| --- | --- | --- | --- |
| External users / administrators (External Network) | `ingress-nginx` public IP (AKS Load Balancer) | TCP 443 _(HTTP 80 opt.)_ | Wallet UI / API, approval flows, and webhook endpoints. HTTP 80 is used only for HTTPS redirect. |
| Wallet pods, MPA policy-node pods (AKS subnet) | PostgreSQL Flexible Server (`DB Subnet 10.1.0.0/24`) | TCP 5432 | Application database traffic from wallet services and MPA policy nodes to Azure PostgreSQL Flexible Server. |
| Wallet pods, MPA policy-node pods (internal) | NATS pods / services inside AKS | TCP 4222, 8222, 8443 | Internal message bus (NATS) used by wallet services and MPA policy nodes for orchestration messaging. |
| Wallet pods, MPA policy-node pods | Cluster DNS (`kube-dns` in `kube-system` namespace) | UDP/TCP 53 | Pod DNS resolution inside the AKS cluster. |
| Wallet pods, MPA policy-node pods | Azure DNS / Azure public services (e.g. Key Vault, AAD/OIDC, ACR) | TCP 443 | Outbound HTTPS for identity, secrets, image pulls, and Azure control-plane APIs. MPA policy nodes use this for OIDC key discovery and optionally Azure Key Vault. |
| Wallet pods (application namespace) | External / internal blockchain node RPC endpoints | TCP 443, 8555–8556, 8546 | Node RPC connectivity for on-chain operations over HTTPS and WebSocket. |
| Wallet pods (application namespace) | Blockdaemon API (`https://svc.blockdaemon.com`) | TCP 443 | Blockchain data, staking, token, pricing, balance and transaction queries via Blockdaemon. |
| Wallet pods (application namespace) | WalletConnect relay (`wss://relay.walletconnect.com`) | TCP 443 (WSS) | WalletConnect v2 relay for dApp-to-wallet session and signing communication. |
| Wallet pods (application namespace) | WalletConnect Verify API (`https://verify.walletconnect.org`) | TCP 443 | Domain verification and anti-phishing checks for WalletConnect dApp sessions. |
| Wallet pods (application namespace) | ApproverApp Expo push service (`https://expo.host`) | TCP 443 | Outbound push notifications to mobile devices via Expo push notification service. |
| Wallet pods (application namespace) | Customer SMTP relay (configured `host:port`) _(optional)_ | TCP 587, 465, or as configured | Email notifications to approvers when SMTP relay is enabled. Required only when email notifications are configured. |
| Wallet pods (application namespace) | Chainalysis KYT API (`https://api.chainalysis.com`) _(optional)_ | TCP 443 | KYT compliance screening for withdrawal and deposit transactions. Required only when Chainalysis integration is enabled. |
| Wallet pods (application namespace) | Canton validator, scan API and DA Utilities (`https://api.utilities.digitalasset.com`) _(optional)_ | TCP 443, gRPC 443 | Canton ledger, validator and scan API access, plus Digital Asset utility services. Required only when Canton/Daml blockchain support is enabled. |

These ports should be reflected in any perimeter firewall, Azure NSG rules, and on-prem network controls used in the deployment.

### Recommended Service and Infrastructure Sizing

The following tables summarize the recommended sizing derived from the Azure Terraform and Helm configuration.

#### Kubernetes Workload Sizing (per pod)

| Service Name | Resource Type | CPU (cores) | Memory (GB) |
| --- | --- | --- | --- |
| Wallet UI / API (includes approval and WalletConnect) | microservice container | 1 | 1 |
| MPA Policy-node | microservice container | 1 | 1 |
| EVM tracker (per chain) | microservice container | 0.5 | 0.5 |
| NATS message broker | microservice container | 0.5 | 1 |

#### Azure Infrastructure Sizing

| Component | Resource Type | CPU Cores | Memory (GB) | Azure Specification |
| --- | --- | --- | --- | --- |
| AKS system node pool | Kubernetes worker node | 2 | 8 | `Standard_D2s_v5`, `node_count = 1` (default). |
| AKS application node pool | Kubernetes worker node | 2 | 8 | `Standard_D2s_v5`, autoscaling `1–3` nodes. |
| AKS confidential node pool | Kubernetes worker node (CVM) | 4 | 16 | `Standard_DC4s_v3`, autoscaling `1–3` nodes. |
| Relational Database (per replica) | Database PaaS | 4 | 16 | Azure PostgreSQL Flexible Server, SKU `GP_Standard_D4s_v3`. |
| Key Vault | Secrets management | N/A | N/A | Azure Key Vault, SKU `Standard`. |
| Container Registry | Container registry | N/A | N/A | Azure Container Registry, SKU `Standard`. |
| Log Analytics Workspace + Storage | Monitoring and log retention | N/A | N/A | `PerGB2018` workspace with export to a Standard LRS storage account.