KYC MCP Server

# Quick Deployment Guide - Existing EC2 Instance This guide provides step-by-step instructions to deploy the KYC MCP Server on your existing EC2 instance with Docker. ## Prerequisites - Existing EC2 instance (Ubuntu 22.04 or Amazon Linux 2) - SSH access to the instance - Security group allowing ports: 22, 80, 443, 9090 - KYC API credentials --- ## Step-by-Step Deployment ### Step 1: Connect to Your EC2 Instance ```bash ssh -i your-key.pem ubuntu@your-ec2-ip # or for Amazon Linux: ssh -i your-key.pem ec2-user@your-ec2-ip ``` ### Step 2: Install Docker and Docker Compose Run the setup script: ```bash # Download the repository or copy files to the instance cd /opt sudo git clone <your-repo-url> kyc-mcp-server sudo chown -R $USER:$USER kyc-mcp-server cd kyc-mcp-server # Make setup script executable and run it chmod +x deploy/ec2-setup.sh ./deploy/ec2-setup.sh ``` **What this script does:** - Installs Docker and Docker Compose - Installs essential tools (git, htop, vim, curl, etc.) - Configures firewall rules - Sets up log rotation - Installs CloudWatch agent - Installs monitoring tools (node_exporter) - Configures swap space - Sets up security settings **Note:** After the script completes, log out and log back in for Docker group changes to take effect. ```bash exit # Then reconnect ssh -i your-key.pem ubuntu@your-ec2-ip ``` ### Step 3: Configure Environment Variables ```bash cd /opt/kyc-mcp-server # Copy example environment file cp .env.example .env # Edit with your credentials nano .env ``` Update these required values: ```env # KYC API Configuration (REQUIRED) KYC_API_BASE_URL=https://api.sandbox.co.in KYC_API_KEY=your_actual_api_key_here KYC_JWT_SECRET=your_secure_jwt_secret_here # Redis Configuration (default values work) REDIS_HOST=redis REDIS_PORT=6379 REDIS_DB=0 # Cache Configuration CACHE_ENABLED=true CACHE_DEFAULT_TTL=3600 # Rate Limiting RATE_LIMIT_ENABLED=true RATE_LIMIT_PER_MINUTE=60 RATE_LIMIT_PER_HOUR=1000 # Logging LOG_LEVEL=INFO ENABLE_METRICS=true METRICS_PORT=9090 ``` Save and exit (Ctrl+X, then Y, then Enter). ### Step 4: Deploy the Application ```bash cd /opt/kyc-mcp-server # Make deploy script executable chmod +x deploy/deploy.sh # Run deployment ./deploy/deploy.sh ``` **What this script does:** - Creates backup of current deployment (if any) - Pulls latest code (if git repository) - Builds Docker images - Stops current containers - Starts new containers - Performs health checks - Automatic rollback on failure **Expected output:** ``` [INFO] Starting deployment of KYC MCP Server... [INFO] Prerequisites check passed [INFO] Backup created at /opt/kyc-mcp-server-backups/backup_YYYYMMDD_HHMMSS [INFO] Building Docker images... [INFO] Containers started [INFO] Service is healthy [INFO] Health checks passed [INFO] Deployment completed successfully! ``` ### Step 5: Verify Deployment Check if containers are running: ```bash docker ps ``` You should see: - `kyc-mcp-server` - Main application - `kyc-redis` - Redis cache View application logs: ```bash docker-compose logs -f kyc-mcp-server ``` Test the application: ```bash # Test from within the instance curl http://localhost:8080 # Check Redis docker exec kyc-redis redis-cli ping # Should return: PONG ``` ### Step 6: Configure Nginx (Optional but Recommended) Install and configure Nginx as reverse proxy: ```bash cd /opt/kyc-mcp-server/deploy/nginx # Make script executable chmod +x install-nginx.sh # Run installation sudo ./install-nginx.sh ``` When prompted: - Enter your domain name (or press Enter to skip SSL for now) **What this does:** - Installs Nginx - Configures reverse proxy - Sets up rate limiting - Adds security headers - Configures SSL (if domain provided) Test Nginx: ```bash sudo nginx -t curl http://your-ec2-ip ``` ### Step 7: Setup SSL Certificate (If you have a domain) ```bash # Install Certbot sudo apt-get install -y certbot python3-certbot-nginx # Obtain certificate sudo certbot --nginx -d your-domain.com # Test auto-renewal sudo certbot renew --dry-run ``` ### Step 8: Enable Auto-Start on Boot ```bash cd /opt/kyc-mcp-server/deploy/systemd # Make script executable chmod +x install-service.sh # Install systemd service sudo ./install-service.sh # Start the service sudo systemctl start kyc-mcp.service # Check status sudo systemctl status kyc-mcp.service ``` ### Step 9: Setup Automated Backups ```bash cd /opt/kyc-mcp-server/deploy/backup # Make scripts executable chmod +x backup.sh restore.sh setup-cron.sh # Setup automated backups sudo ./setup-cron.sh ``` When prompted: 1. Choose backup schedule (e.g., Daily at 2:00 AM) 2. Enter S3 bucket name (optional, press Enter to skip) Test backup manually: ```bash sudo ./backup.sh ``` ### Step 10: Configure Monitoring (Optional) Setup CloudWatch agent: ```bash sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \ -a fetch-config \ -m ec2 \ -s \ -c file:/opt/kyc-mcp-server/deploy/monitoring/cloudwatch-config.json ``` --- ## Verification Checklist After deployment, verify: - [ ] Docker containers are running: `docker ps` - [ ] Application responds: `curl http://localhost:8080` - [ ] Redis is working: `docker exec kyc-redis redis-cli ping` - [ ] Nginx is running: `sudo systemctl status nginx` - [ ] Application accessible via domain/IP - [ ] Logs are being generated: `docker-compose logs` - [ ] Systemd service enabled: `sudo systemctl is-enabled kyc-mcp.service` - [ ] Backups configured: `crontab -l` --- ## Quick Reference Commands ### Application Management ```bash # View logs docker-compose logs -f kyc-mcp-server # Restart application docker-compose restart kyc-mcp-server # Stop application docker-compose down # Start application docker-compose up -d # View container stats docker stats ``` ### Service Management ```bash # Check service status sudo systemctl status kyc-mcp.service # Restart service sudo systemctl restart kyc-mcp.service # View service logs sudo journalctl -u kyc-mcp.service -f ``` ### Nginx Management ```bash # Check status sudo systemctl status nginx # Test configuration sudo nginx -t # Reload configuration sudo systemctl reload nginx # View access logs sudo tail -f /var/log/nginx/kyc-mcp-access.log # View error logs sudo tail -f /var/log/nginx/kyc-mcp-error.log ``` ### Backup Management ```bash # Manual backup cd /opt/kyc-mcp-server/deploy/backup sudo ./backup.sh # List backups sudo ./restore.sh --list # Restore from backup sudo ./restore.sh --file /path/to/backup.tar.gz ``` ### Monitoring ```bash # View metrics curl http://localhost:9090/metrics # Check system resources htop # Check disk space df -h # Check memory free -h ``` --- ## Troubleshooting ### Application won't start ```bash # Check Docker service sudo systemctl status docker # Check logs docker-compose logs kyc-mcp-server # Verify environment variables cat .env # Rebuild containers docker-compose down docker-compose build --no-cache docker-compose up -d ``` ### Redis connection issues ```bash # Check Redis container docker ps | grep redis # Test Redis docker exec kyc-redis redis-cli ping # View Redis logs docker-compose logs redis # Restart Redis docker-compose restart redis ``` ### Port already in use ```bash # Check what's using port 8080 sudo lsof -i :8080 # Kill process if needed sudo kill -9 <PID> # Or change port in docker-compose.yml ``` ### Out of disk space ```bash # Check disk usage df -h # Clean Docker resources docker system prune -a # Clean old logs sudo journalctl --vacuum-time=7d # Clean old backups sudo find /opt/kyc-mcp-server-backups -name "*.tar.gz" -mtime +30 -delete ``` --- ## Updating the Application ### Standard Update ```bash cd /opt/kyc-mcp-server # Pull latest changes git pull origin main # Run deployment script ./deploy/deploy.sh ``` ### Zero-Downtime Update (Blue-Green) ```bash cd /opt/kyc-mcp-server # Make update script executable chmod +x deploy/update.sh # Run zero-downtime update ./deploy/update.sh ``` --- ## Security Checklist After deployment, ensure: - [ ] SSH key-based authentication only (no passwords) - [ ] Firewall configured (only necessary ports open) - [ ] SSL certificate installed (if using domain) - [ ] Environment variables secured (not in git) - [ ] Regular backups enabled - [ ] Monitoring and alerts configured - [ ] System updates enabled - [ ] Strong JWT secret configured - [ ] Rate limiting enabled --- ## Getting Help If you encounter issues: 1. Check application logs: `docker-compose logs -f` 2. Check system logs: `sudo journalctl -xe` 3. Verify configuration: `cat .env` 4. Review [Full Deployment Guide](README.md) 5. Check [Troubleshooting Section](README.md#troubleshooting) --- ## Next Steps After successful deployment: 1. **Test the API endpoints** using the Postman collection 2. **Configure monitoring alerts** in CloudWatch 3. **Setup DNS** if using a domain 4. **Document your configuration** for your team 5. **Schedule regular maintenance** windows 6. **Test backup restoration** procedure --- **Deployment Time:** ~15-20 minutes **Difficulty:** Beginner to Intermediate **Support:** Check main README.md for detailed documentation