1 · VM names and quantities, vCPUs, RAM, storage
One instance serves one country, and one machine runs all of it: the platform's 26 services as Docker containers, plus PostgreSQL, MongoDB and Redis. A physical server works as well as a VM.
| VM name | Qty | vCPU | RAM | Storage |
|---|---|---|---|---|
| ereg-prod-01Production: 26 platform services, databases, load balancer, TLS | 1 | 16 | 32 GB | 1 TB SSD |
| ereg-test-01 (optional but recommended)Test and training copy: same software, smaller | 1 | 8 | 16 GB | 200 GB SSD |
| ereg-backup-01 (required for backups)Daily backups, in a different location from the production machine | 1 | 2 | 4 GB | 1 TB |
One machine, deliberately. The live system runs exactly this way, and keeping the databases beside the application keeps the setup simple to install, back up and support.
If you expect very high traffic
- 32 CPU cores
- 64 GB RAM
- 6 TB SSD
Use this only for a large country with heavy daily volumes and many scanned documents. It is the same software on one machine.
If your policy separates the database
- Application server: 16 cores, 64 GB RAM, 1 TB SSD
- Database server: 8 cores, 32 GB RAM, 2 TB SSD
Supported, but not needed to go live: the services reach the databases by name, so the split is a configuration change.
2 · Required port numbers
Three ports must be reachable from the internet. The monitoring ports are opened only to UNCTAD's monitoring server, by IP address.
| Direction | Port | Purpose |
|---|---|---|
| Inbound from the internet | 443 | HTTPS — the platform itself |
| Inbound from the internet | 80 | Redirect to HTTPS, and certificate issuance |
| Inbound, administrators only | 22 | SSH administration, restricted to named networks |
| Inbound, monitoring server only | 8444 · 9200 · 10050 | Health and log monitoring by UNCTAD, restricted to its IP address |
| Outbound | 443 · 80 | Software images, updates and certificates |
| Outbound | 587 | Sending email through your mail relay |
| Outbound | 53 · 123 | DNS and time synchronisation |
| Outbound | 22 · 10051 | Support access and monitoring reports |
| Both directions | — | Established sessions must be allowed back through the firewall |
Not to be exposed. The databases (PostgreSQL 5432, MongoDB 27017, Redis 6379) and the platform's own services (ports such as 1337, 3001–3003, 4200–4205, 6009–6040, 7777, 8008–8011, 8080, 61616 and 12201) are used only inside the machine and must stay closed to the internet. On the live system they are: only 22, 80 and 443 answer from outside.
3 · Software, processor and network
Software
- Ubuntu Server 24.04 LTS, 64-bit (22.04 LTS also supported)
- Docker Engine with Swarm mode enabled — it runs the platform's 26 services
- PostgreSQL, MongoDB and Redis, installed on the machine itself
- A load balancer terminating HTTPS: HAProxy is used today, and your own load balancer works too
- ext4 or XFS file system
Processor and network
- The processor must support AVX — MongoDB refuses to start without it. Any Intel Haswell or newer, or AMD Bulldozer or newer, qualifies
- x86-64 (Intel or AMD); no ARM
- 1000 Mbit redundant network connectivity
- A dedicated, publicly routable IPv4 address
In a virtual machine, set the CPU type to host so AVX is visible inside it. Check with
grep -o avx /proc/cpuinfo | head -1 — it must print avx.4 · Backups
- A separate machine, in a different location from the production machine
- At least 1 TB of disk, which holds daily backups for one month
- Backups cover the databases and the uploaded documents
A backup on the same machine is not a backup. It must survive the loss of the production machine, including its building.
5 · DNS names
The platform serves different audiences on different names: the public portal, the application service, sign-in, and the back offices. All eight point to the same machine and share one certificate.
Type your own values — the names and records below update as you type.
| DNS name | Used by | What it serves |
|---|---|---|
example.gov | The public | The portal: information, guidance and the entry point |
services.example.gov | Applicants and officers | The Single Window itself: applications are filed and processed here |
login.example.gov | Everyone signing in | Sign-in and accounts |
admin-home.example.gov | Communication staff | Editing the public portal's content, in the content manager at /admin |
bpa.example.gov | Service designers | Configuring the registration services, forms and workflows |
gdb.example.gov | Registry staff | The registry database: records created by the services |
stats.example.gov | Managers | Statistics and performance dashboards |
graylog.example.gov | Your IT team | System logs, for troubleshooting |
Names are yours to choose, but keep them on one domain: the certificate, sign-in and the links between the parts are configured from them. The last two (
gdb and graylog) may be restricted to your internal network if you prefer.DNS records to create
Eight records of the same kind, all pointing at the one server. This is exactly how the live instance is configured: plain A records, no aliases and no wildcard.
| Type | Name | Full name | Value | TTL |
|---|---|---|---|---|
| A | @ | example.gov | 203.0.113.10 | 3600 |
| A | services | services.example.gov | 203.0.113.10 | 3600 |
| A | login | login.example.gov | 203.0.113.10 | 3600 |
| A | admin-home | admin-home.example.gov | 203.0.113.10 | 3600 |
| A | bpa | bpa.example.gov | 203.0.113.10 | 3600 |
| A | gdb | gdb.example.gov | 203.0.113.10 | 3600 |
| A | stats | stats.example.gov | 203.0.113.10 | 3600 |
| A | graylog | graylog.example.gov | 203.0.113.10 | 3600 |
Use a short TTL of 3600 (one hour) while you set the system up, so a correction takes effect quickly. Raise it to 86400 (one day) once the addresses are final — that is what the live instance uses. If your provider needs the apex written differently,
@ and the bare domain mean the same thing.6 · What to prepare
- The machine, with an administrator account that can use
sudo, reachable over SSH - A fixed public IPv4 address and the eight DNS names above, all pointing to it
- One HTTPS certificate covering all eight names, from a public authority or your own certificate authority
- An email relay account for notifications: server, port, username and password
- The backup machine, in another location
7 · Where these numbers come from
- Measured on a live country instance running the current platform (version 2.18) with 26 services and eight DNS names, in production since February 2024.
- Memory: the services use about 20 GB together; the databases and operating system bring the total to about 24 GB of the 32 GB fitted. The three largest services are the process engine and the two back ends, at roughly 3 GB each.
- Processor: average load is well under 1 core out of 16, so the core count is for peaks and for the databases, not for everyday traffic.
- Storage: after 19 months of real use the whole system uses 117 GB — 45 GB of PostgreSQL, 11 GB of MongoDB and 35 GB of software images — growing roughly 3 GB per month. 1 TB leaves years of margin; 6 TB is for countries expecting very high volumes of documents.