DEFONEOS — Deployment Architecture Comparison

☁️ 1. Cloud Deployment

DEFONEOS runs on a UK-sovereign cloud provider (AWS London, Azure UK South, or GCP London).

Pros

✅ Fastest setup (30min) · ✅ Elastic GPU scaling · ✅ Automatic updates · ✅ Zero hardware capex

Cons

❌ Data physically on cloud provider hardware · ❌ Internet dependency · ❌ Ongoing opex · ❌ Cloud provider can technically access

Use When

Development, testing, pilot projects, non-sensitive data processing, rapid prototyping.

Cost Breakdown

🏢 2. On-Premise Deployment

DEFONEOS runs on dedicated UK-owned hardware in your facility. Full control, maximum practical sovereignty.

Pros

✅ Data never leaves your building · ✅ No internet dependency · ✅ One-time hardware cost · ✅ Full physical control

Cons

❌ Hardware capex upfront · ❌ You maintain everything · ❌ Limited scaling (buy more iron) · ❌ Requires physical security

Reference Hardware

📡 3. Edge Deployment

DEFONEOS runs on Jetson Orin or ruggedised edge hardware. 12 core MCPs, optimised for field use.

Pros

✅ Ultra-low latency (3ms ISR) · ✅ 15-60W power · ✅ Rugged (MIL-STD-810H) · ✅ Disconnected operation · ✅ Man-portable

Cons

❌ Only 12/30 MCPs · ❌ No GPU training (inference only) · ❌ Limited storage (128GB) · ❌ No BFT-33 (single agent)

Hardware Options

🔌 4. Air-Gapped Deployment

Maximum sovereignty. Zero network connectivity. Updates via signed physical media only.

Pros

✅ Impossible to remotely hack · ✅ Zero data egress · ✅ Physical control = total control · ✅ Works in SCIF environments

Cons

❌ No real-time SIGIL sync (batch) · ❌ Manual updates via USB · ❌ No cloud services integration · ❌ Tedious maintenance

Air-Gap Update Procedure

# ON CONNECTED NODE:
$ defoneos export-update --version v1.2.3 --output /mnt/usb/update.pkg
$ sha256sum /mnt/usb/update.pkg > /mnt/usb/update.pkg.sha256
$ defoneos sign-update --key ed25519.priv --file update.pkg
# Verify: update.pkg.sig

# TRANSFER USB (chain of custody)

# ON AIR-GAPPED NODE:
$ defoneos verify-update --file /mnt/usb/update.pkg --sig update.pkg.sig
✓ Ed25519 signature valid
✓ SHA-256 matches
$ defoneos install-update --file /mnt/usb/update.pkg
✓ 30 MCP servers updated
✓ SIGIL chain continues (0 gap)

🐳 5. Containerised Deployment

All DEFONEOS services in Docker containers. Portable across any Linux environment.

Pros

✅ Portable (laptop↔server↔cloud) · ✅ Easy rollback · ✅ Service isolation · ✅ Reproducible builds

Cons

❌ Docker overhead (~5%) · ❌ Storage double (images + data) · ❌ Container security knowledge required

Docker Compose Stack

version: '3.8'
services:
  mcp-federation:
    image: defoneos/mcp-federation:v1.0
    ports: ["3101:3101"]
    volumes: ["./sigil:/data/sigil"]
  yolo-detect:
    image: defoneos/yolov8-detect:v1.0
    deploy:
      resources:
        reservations:
          devices:
            - capabilities: ["gpu"]
  cesium-cop:
    image: defoneos/cesium-cop:v1.0
    ports: ["8080:8080"]
  freetak-c2:
    image: defoneos/freetak-c2:v1.0
    ports: ["8087:8087", "8089:8089"]
  sigil-chain:
    image: defoneos/sigil-chain:v1.0
    volumes: ["./sigil:/data/sigil"]
  bft-council:
    image: defoneos/bft-33:v1.0
    ports: ["3200:3200"]

☸️ 6. Kubernetes Deployment

DEFONEOS on K8s. Auto-scaling, self-healing, rolling updates. Enterprise-grade.

Pros

✅ Auto-scaling (MCP pods scale on demand) · ✅ Self-healing (failed pods restart) · ✅ Rolling zero-downtime updates · ✅ Horizontal MCP scaling

Cons

❌ Requires 3+ nodes minimum · ❌ K8s expertise needed · ❌ Resource overhead (~15%) · ❌ Most expensive option

Resource Requirements

🔄 7. Hybrid Deployment (Recommended for Production)

HQ on-prem + field edge nodes + optional cloud burst. The best of all architectures.

Architecture

┌─────────────────────────────────────────────────────┐
│  HQ NODE (On-Prem, UK Data Centre)                  │
│  • 30/30 MCP servers                               │
│  • Full BFT-33 council                              │
│  • SIGIL chain master (PostgreSQL)                  │
│  • Cesium COP server                                │
│  • FreeTAKServer (C2 master)                        │
│  • GPU cluster (YOLOv8 training)                    │
└──────────────┬──────────────────────────────────────┘
               │ VPN / SD-WAN (Encrypted)
    ┌──────────┴──────────┐
    ▼                     ▼
┌─────────────┐   ┌─────────────┐
│ FIELD NODE A│   │ FIELD NODE B│
│ (Edge,      │   │ (Edge,      │
│  12 MCPs)   │   │  12 MCPs)   │
│ Jetson Orin │   │ Jetson Orin │
│ SIGIL: batch│   │ SIGIL: batch│
└──────┬──────┘   └──────┬──────┘
       │ Mesh/LTE        │ Mesh/LTE
    ┌──┴──┐           ┌──┴──┐
    ▼     ▼           ▼     ▼
  Drone  Drone      Drone  Drone
  Nodes  Nodes      Nodes  Nodes
  (4 MCP)(4 MCP)    (4 MCP)(4 MCP)

Pros

✅ HQ has full capability · ✅ Field nodes have low latency · ✅ Cloud burst for heavy compute · ✅ No single point of failure · ✅ Graceful degradation

Cons

❌ Most complex to set up · ❌ Requires VPN/SD-WAN expertise · ❌ Chain sync conflicts possible (resolved by SIGIL CRDT)