System Requirements

This document outlines the minimum and recommended requirements for deploying Tamandua Sentinel components.

---

Overview

Tamandua Sentinel consists of three main deployment targets:

---

Server Requirements

The Tamandua Server handles agent connections, telemetry ingestion, detection, and alert management.

Minimum Requirements

Recommended (Production)

Scaling Guidelines

Required Software

# Elixir/Erlang
asdf plugin add erlang
asdf plugin add elixir
asdf install erlang 26.2
asdf install elixir 1.16.0-otp-26

# PostgreSQL 16 + TimescaleDB
sudo apt install postgresql-16
# Add TimescaleDB extension
sudo apt install timescaledb-2-postgresql-16

# Redis
sudo apt install redis-server

# RabbitMQ (optional, for advanced pipelines)
sudo apt install rabbitmq-server

---

Agent Requirements

The Tamandua Agent runs on each protected endpoint, collecting telemetry and executing response actions.

Windows

Optional for kernel driver:

• Windows Driver Kit (WDK) matching Windows SDK version
• Test signing enabled (development) or EV code signing (production)

Linux

For full visibility:

# Required capabilities
CAP_SYS_PTRACE      # Process inspection
CAP_NET_ADMIN       # Network monitoring
CAP_DAC_READ_SEARCH # File access monitoring

# Or run as root
sudo ./tamandua-agent

Auditd integration (recommended):

# Install auditd
sudo apt install auditd

# Tamandua auto-deploys audit rules on startup

macOS Preview

macOS endpoint support is Preview/Experimental. Use these requirements for lab evaluation; validate telemetry, permissions, system extension behavior, and rollback before any fleet use.

System Extension requirements for preview builds:

• System Integrity Protection (SIP) configuration may be required
• MDM approval for system extensions in enterprise deployments

---

ML Service Requirements

The ML Service provides the Malware-SMELL-inspired scoring path. Current model artifacts are smoke-scale and validation-ready only; production ML claims require the guarded ML-1..ML-6 benchmark chain.

CPU Inference

GPU Inference (Optional)

Performance comparison:

Installation

# Create virtual environment
cd apps/tamandua_ml
uv sync

# Or with pip
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt

# For GPU support
pip install torch --index-url https://download.pytorch.org/whl/cu118

---

Network Requirements

Ports

Agent -> Server Communication

Agent ----[WebSocket/TLS]----> Server:4443
       <---[Commands]--------

Firewall Rules

Server (inbound):

# Allow agent connections
ufw allow 4443/tcp

# Allow dashboard access (restrict to admin IPs)
ufw allow from <admin-ip> to any port 4000

Agent (outbound):

# Allow connection to server
# No inbound ports required on endpoints

mTLS Certificate Requirements

For production deployments with mTLS:

# Generate CA (one time)
openssl req -x509 -newkey rsa:4096 -days 3650 \
  -keyout ca-key.pem -out ca-cert.pem \
  -subj "/CN=Tamandua CA"

# Generate server certificate
openssl req -newkey rsa:2048 -keyout server-key.pem -out server.csr \
  -subj "/CN=tamandua-server.example.com"

openssl x509 -req -in server.csr -CA ca-cert.pem -CAkey ca-key.pem \
  -CAcreateserial -out server-cert.pem -days 365

# Generate agent certificate (CN must match agent_id)
openssl req -newkey rsa:2048 -keyout agent-key.pem -out agent.csr \
  -subj "/CN=<agent-uuid>"

openssl x509 -req -in agent.csr -CA ca-cert.pem -CAkey ca-key.pem \
  -CAcreateserial -out agent-cert.pem -days 365

---

Solana RPC Requirements

For on-chain attestations and bounty settlement.

Devnet (Testing)

# Configure for devnet
solana config set --url devnet

# Get free SOL
solana airdrop 2

Mainnet (Production)

Recommended RPC providers:

• Helius
• QuickNode
• Alchemy
• GenesysGo

Cost estimation:

Attestation Modes

# Configuration in config/runtime.exs
config :tamandua_server, TamanduaServer.Solana.AttestationMode,
  mode: :relay,  # :local_only | :relay | :self_pay
  relay_url: "https://relay.tamandua.treantlab.org/api/v1/attestations"

---

Database Storage Estimates

PostgreSQL + TimescaleDB

Retention policies:

-- Auto-compress data older than 7 days
SELECT add_compression_policy('telemetry_events', INTERVAL '7 days');

-- Drop data older than 90 days
SELECT add_retention_policy('telemetry_events', INTERVAL '90 days');

---

High Availability Configuration

For production deployments requiring high availability:

Database HA

           +----------------+
           |  HAProxy/PgBouncer  |
           +--------+-------+
                    |
    +---------------+---------------+
    |               |               |
+---v---+      +----v----+     +----v----+
| Primary |    | Replica 1|    | Replica 2|
+---------+    +----------+    +----------+

Recommended setup:

• 1 Primary + 2 Streaming Replicas
• PgBouncer for connection pooling
• Automatic failover with Patroni or pgautofailover

Server HA

           +----------------+
           |  Load Balancer |
           +--------+-------+
                    |
    +---------------+---------------+
    |               |               |
+---v---+      +----v----+     +----v----+
|Phoenix |     | Phoenix |     | Phoenix |
|Node 1  |     | Node 2  |     | Node 3  |
+---+----+     +----+----+     +----+----+
    |               |               |
    +---------------+---------------+
                    |
              +-----v------+
              |   Redis    |
              | (Cluster)  |
              +------------+

---

Development Environment

For local development and testing:

# Minimum development setup
CPU: 2 cores
RAM: 8 GB
Storage: 20 GB

# Required tools
- Docker & Docker Compose
- Rust 1.74+
- Elixir 1.15+ / Erlang 26+
- Python 3.11+
- Node.js 20+ (for assets)
- Git

# Quick start
make dev-up       # Start PostgreSQL, Redis, RabbitMQ
make backend-run  # Start Phoenix server
make agent-run    # Start agent (another terminal)

---

Verification Checklist

Before deployment, verify:

• [ ] PostgreSQL 16+ with TimescaleDB installed
• [ ] Redis 7+ running
• [ ] Elixir 1.15+ / Erlang 26+ installed
• [ ] Python 3.11+ with PyTorch installed
• [ ] Network ports open (4000, 4443, 8443)
• [ ] TLS certificates generated (production)
• [ ] Solana CLI installed (if using self_pay mode)
• [ ] Agent binaries available for target platforms
• [ ] Backup strategy configured for PostgreSQL

---

Last updated: May 2026