Bare-Metal Optimization.

Scaling MeltyBase on physical hardware requires more than just installation. It requires precision tuning of the Linux networking stack, filesystem parameters, and security boundaries.

Network Optimization (BBR)

For high-speed CDC streaming and Voice AI, we recommend enabling **Google BBR** (Bottleneck Bandwidth and RTT). It significantly reduces latency during periods of congestion.

# Enable BBR Congestion Control

echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf

echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf

sysctl -p

HTTP/3 & QUIC Support

MeltyBase supports QUIC (HTTP/3) for ultra-low latency frontend communication. Ensure `443/udp` is open in your hardware firewall.

Hardening Pulse

A bare-metal server is a high-value target. Implement the following boundaries to ensure your data remains independent and secure.

SSH Key-Only

Disable password authentication in `sshd_config` and enforce `PubkeyAuthentication yes`.

Fail2Ban SSH Jail

Automatically ban IP addresses that fail more than 3 authentication attempts in 5 minutes.

Unattended Upgrades

Enable the `unattended-upgrades` package to ensure critical security patches are applied daily without intervention.

600 Permissions

Ensure all `.env` and `MB_LICENSE` files are owner-only (`chmod 600`) to prevent local discovery.

Disk Performance (I/O)

MeltyBase performs best on **NVMe** storage. To minimize Postgres WAL latency, we recommend the following tuning:

  • I/O Scheduler: For NVMe, set the scheduler to `none` or `mq-deadline`.
  • Mount Options: Use `noatime` and `nodiratime` in your `/etc/fstab` to reduce unnecessary writes.

Secure Studio Tunneling

For maximum security, you should not expose the MeltyBase Studio dashboard directly to the public internet. Instead, use an **SSH Tunnel** to bridge your local machine to the server.

# Tunnel local port 3000 to the server's Studio

$ ssh -L 3000:localhost:3000 root@your-server-ip

Multi-Node Node Clustering

If you are scaling beyond a single physical node, use a **Private Private Network** (e.g. Hetzner vSwitch or OVH vRack). Ensure that all inter-node communication (Hub-to-Portal) is protected by **mTLS**.

Clustering Tip

Use Keepalived with a virtual IP (VIP) to create a high-availability failover cluster for your MeltyBase Hub nodes.