How to deploy a hardened, secure, production-ready Substrate node?

Question

I'm currently looking for a way to deploy the blockchain I'm working on and it has been a struggle to find out the best practices for doing so. The chain is based on the substrate-node-template but it adds the contracts pallet. My goal is to have the node running as a validator on a cloud provider. The biggest problem I have currently is finding resources on how to properly handle the keys generation and management.

This is my first time ever trying to deploy something like this, so maybe my questions don't make any sense. But there are quite a few things that are not yet clear for me. For example:

• How many key-pairs do I need to have when running the node? Only the session keys? or do I need controller and stash keys as well? (Polkadot wiki for reference)
• How should these keys be generated? I know I can use Subkey to generate them, but when (during vs prior to deployment) and where (locally vs cloud) should that be done?
• Is it considered a bad practice to have the keys stored in the computer running the node?

Anyway, I'd appreciate if someone could explain me the steps necessary to have this all done in the proper way. I haven't found many resources online about deploying standalone substrate chains, mostly it regards deploying them as parachains.

Answer 1

For production ready I think the best guide is probably to crib as much of the validator setup as possible. This is designed to set you up with best security practices. (In fact I would read everything under the "Validator Guides" section as a lot of it is transferable)

In particular I would point you towards the suggested reference setup with ansible and terraform prepared for you.