# Requirements

Hardware, software, and certificate requirements for deploying FluxiQ PIX across different environments.

## Prerequisites

- Understanding of your target deployment environment (Docker, Kubernetes, or bare metal)
- Access to network infrastructure documentation
- Knowledge of your institution's BACEN participant status

## Hardware Requirements

### Development / Testing

| Resource | Minimum | Recommended |
|----------|---------|-------------|
| CPU | 4 cores | 8 cores |
| RAM | 8 GB | 16 GB |
| Disk | 50 GB SSD | 100 GB SSD |
| Network | 100 Mbps | 1 Gbps |

### Production (Single Node)

| Resource | Minimum | Recommended |
|----------|---------|-------------|
| CPU | 8 cores | 16 cores |
| RAM | 32 GB | 64 GB |
| Disk | 500 GB NVMe | 1 TB NVMe |
| Network | 1 Gbps | 10 Gbps |

### Production (Kubernetes Cluster)

| Component | Nodes | Per Node | Total |
|-----------|-------|----------|-------|
| Application | 3 | 8 CPU / 32 GB RAM | 24 CPU / 96 GB |
| PostgreSQL | 2 (primary + replica) | 8 CPU / 32 GB RAM | 16 CPU / 64 GB |
| NATS | 3 (cluster) | 4 CPU / 8 GB RAM | 12 CPU / 24 GB |
| Redis | 1 (or Sentinel) | 2 CPU / 8 GB RAM | 2 CPU / 8 GB |

## Software Requirements

| Component | Version | Purpose |
|-----------|---------|---------|
| Elixir | 1.17.x | Backend runtime |
| Erlang/OTP | 27.x | VM and concurrency |
| PostgreSQL | 16.x | Primary database |
| Redis | 7.x | Cache, rate limiting, token blacklist |
| NATS Server | 2.10.x | JetStream messaging |
| Docker | 24.x+ | Container runtime |
| Kubernetes | 1.28+ | Orchestration (if applicable) |
| Node.js | 20.x LTS | Frontend build only |
| nginx | 1.25+ | Frontend reverse proxy |

::: warning ELIXIR VERSION
Elixir 1.19 does NOT exist. The latest stable release is 1.17.x on OTP 27. Do not attempt to use a version higher than 1.17.
:::

## Network Requirements

### Ports

| Port | Protocol | Direction | Purpose |
|------|----------|-----------|---------|
| 4001 | TCP | Internal | Dict Service HTTP |
| 4002 | TCP | Internal | SPI Service HTTP |
| 4003 | TCP | Internal/External | Settlement Service (API Gateway) |
| 5432 | TCP | Internal | PostgreSQL |
| 6379 | TCP | Internal | Redis |
| 4222 | TCP | Internal | NATS client connections |
| 6222 | TCP | Internal | NATS cluster routing |
| 16522 | TCP | Outbound | BACEN DICT API (homolog) |
| 17522 | TCP | Outbound | BACEN SPI secondary (homolog) |
| 443 | TCP | Inbound | HTTPS (frontend + API) |

### Firewall Rules

```
# Internal services (allow within cluster)
ALLOW TCP 4001-4003 FROM internal_network
ALLOW TCP 5432 FROM application_nodes
ALLOW TCP 6379 FROM application_nodes
ALLOW TCP 4222 FROM application_nodes

# BACEN connectivity (outbound only)
ALLOW TCP 16522 TO dict-h.pi.rsfn.net.br
ALLOW TCP 17522 TO icom-sec-h.pi.rsfn.net.br

# Public access (through load balancer)
ALLOW TCP 443 FROM 0.0.0.0/0
```

## Certificate Requirements

### ICP-Brasil Certificates (BACEN)

| Certificate | Type | Purpose | Validity |
|-------------|------|---------|----------|
| CPIC | A1 or A3 | mTLS client authentication with BACEN | 1-3 years |
| CPIA | A1 or A3 | XMLDSig message signing (RSA-SHA256) | 1-3 years |
| BACEN CA | Root CA | Server certificate validation | N/A |

::: tip CERTIFICATE FORMATS
FluxiQ PIX expects PEM-encoded certificates. Convert from PKCS#12 if needed:
```bash
# Extract certificate
openssl pkcs12 -in cert.p12 -clcerts -nokeys -out cpic.pem
# Extract private key
openssl pkcs12 -in cert.p12 -nocerts -out cpic-key.pem
```
:::

### TLS Certificates (HTTPS)

For production, obtain TLS certificates for your domain. Options include:
- Let's Encrypt (free, automated via cert-manager on K8s)
- Commercial CA (DigiCert, GlobalSign)
- Internal PKI (for on-premises deployments)

## Database Requirements

| Parameter | Development | Production |
|-----------|-------------|------------|
| `max_connections` | 200 | 6,000+ |
| `shared_buffers` | 256 MB | 8 GB |
| `effective_cache_size` | 1 GB | 24 GB |
| `work_mem` | 16 MB | 64 MB |
| Extensions required | `uuid-ossp`, `pg_trgm` | `uuid-ossp`, `pg_trgm` |

## Expected Outcome

After reviewing these requirements, you can:

- Size your infrastructure for the target deployment environment
- Plan network connectivity including BACEN RSFN access
- Procure the required ICP-Brasil certificates
- Configure PostgreSQL and Redis with appropriate parameters