Skip to main content

​
Production hosting

KovaSwap is packaged as a globally distributed Cloudflare Worker with static assets and a managed D1 database. This keeps the app and relayer API available without maintaining a VPS, process manager, or operating-system patch schedule. The required Private Pay Merkle indexer runs in the browser.

​
Production architecture

  • Application: Cloudflare Worker generated by the Vinext build
  • Static files: Worker assets, including the hash-pinned proving WASM and zkey
  • Private Pay state: Cloudflare D1 database bound as DB
  • Domain: kovaswap.finance and www.kovaswap.finance
  • Deployments: Versioned kovaswap-production Worker releases from main
  • Health check: https://kovaswap.finance/api/health
  • Private Pay health: https://kovaswap.finance/api/veil/health
The deployer key is never hosted. The dedicated hot relayer key, Ed25519 quote key, RPC endpoint, and rotating rate-limit salt are installed directly as encrypted Cloudflare Worker secrets; they are not stored in GitHub and are never exposed through NEXT_PUBLIC_ variables. The quote verification key, pool address, artifact hashes, and API paths are intentionally public and pinned in the release.

​
Private Pay runtime

The same Worker exposes privacy-minimized, same-origin endpoints under /api/veil. D1 stores signed quotes, transaction hashes, relay locks, and rotating rate-limit hashes. It may also store public derived chain state when an operator uses the optional diagnostic indexer. Recipient CSV data, note secrets, witnesses, proofs, wallet signatures, and encrypted note vaults are not stored. The payment path rebuilds and verifies finalized public Merkle events through the connected wallet, then caches only public tree data on that device. The relayer is on-demand and is paid through proof-bound quotes. This architecture has no permanently running server and no paid hosted indexer requirement at launch.

​
Runtime secrets

Production requires KOVA_OPERATOR_PRIVATE_KEY, KOVA_QUOTE_PRIVATE_KEY_PKCS8_BASE64, and KOVA_RATE_LIMIT_SALT as encrypted runtime values. KOVA_RPC_HTTP_URL may remain the official Robinhood endpoint or be replaced with a dedicated endpoint. Rotating the Ed25519 quote key also requires publishing its new SPKI public key in the frontend release.

​
Validate before domain cutover

Validate wallet connection, disconnect, signed relay quotes, local proof generation, deposit confirmation, browser-verified finalized Merkle synchronization, self-submit, relayed settlement, nullifier replay rejection, and both health endpoints on the Worker URL before directing traffic to it.

​
Connect the domain

Do this only after the temporary Worker deployment passes testing:
Cloudflare Custom Domains cannot take over a hostname that still has a conflicting DNS record. Remove the old apex/www website records during the cutover, then attach both hostnames to the Worker. Cloudflare provisions the TLS certificate. Keep the prior hosting project available until the Worker has served production traffic successfully. DNS and certificate changes can take time to settle.

​
Rollback

Redeploy the prior known-good Worker commit, then fix the issue on the integration branch before publishing a replacement.

​
Routine operations

  • Check /api/health and /api/veil/health after each release.
  • Review Worker errors without enabling request-body logging.
  • Monitor the relayer balance and replenish it before it falls below the configured settlement reserve.
  • Review D1 growth and prune expired quotes.
  • Rotate the quote key and relayer key after any suspected exposure.
  • Keep Node and build dependencies pinned through package-lock.json.