Operations

VPS infrastructure

The shared VPS profile, the Docker service map with resource controls, the on-disk layout, segmented networks and the host-hardening baseline.

Clawlas runs on a single self-hosted VPS shared with other projects. The profile prioritizes RAM, fast NVMe storage, a stable network, predictable CPU and snapshot capability.

A shared, already-owned host

Clawlas runs on an existing Hostinger KVM 4 shared with other projects, on its own domain clawlas.com (one subdomain per service). There is therefore no new VPS or domain cash cost at launch — but Clawlas still records an allocated share of CPU, memory, disk and network in shared_infrastructure_allocations so profitability is not overstated.

Trading workers must not be starved

Services are isolated through Docker networks, resource limits, separate secrets and separate backup paths. Live execution and reconciliation get reserved headroom; backtests, search indexing and log processing must never starve them.

Docker services

Docker Compose isolates at least:

reverse-proxy (Traefik · existing)
frontend
convex-backend
convex-dashboard
api (FastAPI)
redis
prometheus · grafana · loki
portainer
backup (restic)

Resource controls

CPU & memory limits per service
reserved headroom for execution & reconciliation
disk-space alerts
memory-pressure alerts
load-average alerts
queue-depth alerts
process restart limits
priority classes: trading-critical vs non-critical

Large local models live elsewhere

The KVM 4 may run small quantized models for experiments or low-priority classification, but a serious open-source inference layer belongs on a separate GPU node or on-demand GPU service — never sharing the host that runs ingestion, risk and reconciliation.

Sizing

Capacity depends on the number of collectors, market-data volume, local model hosting and backtesting frequency, and is measured rather than assumed. Local LLM hosting may need a separate GPU server and is not assumed for the initial VPS.

Filesystem layout

/opt/clawlas/
├── compose/
├── config/
├── secrets/
├── data/
│   ├── convex/   memory/   lake/   duckdb/
│   ├── redis/    prometheus/   grafana/   loki/
├── backups/
└── scripts/

Compose, config and secrets alongside per-service data volumes, backups and scripts under /opt/clawlas.

Host hardening

non-root user
SSH keys only
password login disabled
firewall
only required ports
auto security updates
Fail2ban
Docker socket not exposed
disk-usage alerts
encrypted backups

Admin surfaces stay private

Grafana, Prometheus and Convex administration are never openly exposed to the internet — access is gated by authentication, VPN, IP allowlisting or an identity-aware proxy.

Networks (most restrictive last)

public — the existing Traefik network (root_default); only public-facing services join it.
application — frontend, Convex, FastAPI, agent workers.
data — storage services, Redis, analytical workers.
execution — execution engine and approved services only.
monitoring — Prometheus, Grafana, Loki.

What's actually live today

This page describes the full intended profile. For the subset deployed in Phase 1 — the exact services, networks and hosts now running behind Traefik — see VPS foundation (live).