Deployment

Deployment

0xSCADA deploys from a laptop to a production Kubernetes cluster. Pick the tier that matches where you are; the full production guides live in docs/k8s/ (16 docs) and docs/deploy/.

Tier 1 — Local (Docker Compose)

Fastest path to a running stack:

git clone https://github.com/flaukowski/0xSCADA.git
cd 0xSCADA
npm install
npm run db:migrate
docker compose up -d      # client · server · gateway · edge · validator + Grafana
docker compose logs -f

Brings up the full multi-container stack (docker/) with pre-configured Grafana dashboards. See Getting Started for dev commands and the CLI.

Tier 2 — Helm

Two charts under helm/:

Chart	Use
helm/oxscada	The core application (server, client, gateway)
helm/oxscada-full	Self-contained full stack (adds validator, observability, dependencies)

helm install 0xscada helm/oxscada
# or the full stack:
helm install 0xscada helm/oxscada-full

Guides: docs/k8s/helm-chart.md and docs/deploy/full-stack-helm.md. The charts default to hardened pod security (runAsNonRoot, readOnlyRootFilesystem, dropped capabilities, seccomp).

Tier 3 — Production Kubernetes

The full production playbook, in the order you'd typically apply it:

Step	Guide
Bootstrap the cluster	cluster-bootstrap.md
Build & publish images	container-images.md
Deploy the application	application-deployment.md
PostgreSQL	postgresql.md
Ingress + TLS	ingress-tls.md
Zero-trust network policies	network-policies.md
Container security	container-security.md
GitOps (ArgoCD)	gitops-argocd.md
Observability (Prometheus + Grafana)	observability-stack.md
Blockchain validator	blockchain-validator.md
Real-time scheduler (PREEMPT_RT)	realtime-scheduler.md
Industrial device plugin	device-plugin.md

Field-protocol deployment specifics: protocol-opcua.md, protocol-modbus.md (and Protocols and Vendors for the fail-closed exposure rules).

Real-time workloads

Deterministic control loops run on the forked Linux PREEMPT_RT kernel (kernel/), scheduled via the real-time scheduler above. Real-time scheduling is explicit and fail-closed: it is applied only when explicitly enabled with a dedicated control process — never pinned to the API/main thread — and misconfiguration degrades to normal scheduling rather than blocking boot.

Operations

Once running, the day-2 material is under docs/operations/:

• capacity-planning-guide.md
• disaster-recovery.md
• SRE playbooks — docs/operations/sre-playbooks/

Observability is Prometheus metrics at /metrics on every service plus pre-built Grafana dashboards (Alarms · Gateway Status · System Overview). Security hardening (mTLS, fuzzing) is under docs/security/; compliance mappings (IEC 62443, NIST CSF, 21 CFR Part 11) under docs/compliance/.

---

See Stack and Components for what each deployed service does, and Architecture for how the pieces fit.