%% Atlas service access architecture.
%% Domains, identity profiles, entry services, and selected internal dependencies.
%% Node placement and short labels carry the detail.
%%{init: {"flowchart": {"defaultRenderer": "elk", "curve": "stepAfter", "nodeSpacing": 30, "rankSpacing": 65, "useMaxWidth": false}, "elk": {"mergeEdges": true, "nodePlacementStrategy": "LINEAR_SEGMENTS", "forceNodeModelOrder": true, "considerModelOrder": "NODES_AND_EDGES"}, "themeVariables": {"background": "#000000", "lineColor": "#8b95a5", "primaryTextColor": "#ffffff", "clusterBkg": "#03040d", "clusterBorder": "#6d7485"}, "themeCSS": "& { background-color: #000000 !important; }"}}%%
flowchart TB
    subgraph system["Atlas Service Access Architecture"]
        direction TB

        subgraph legend["Legend"]
            direction LR

            subgraph node_key["Nodes"]
                direction LR
                key_domain["DNS name"]:::domain
                key_access["OIDC access"]:::access
                key_oauth["Access proxy"]:::oauth
                key_directory["LDAP or synced account"]:::directory
                key_entry["Entry service"]:::user
                key_internal["Internal service"]:::support
                key_data["Data service"]:::data
                key_job["Job or worker"]:::ephemeral
                key_external["Outside Kubernetes"]:::external
            end

            subgraph link_key["Links"]
                direction LR
                key_ingress["Blue<br/>Domain to identity"]:::linkIngress
                key_service["Green<br/>Identity to service"]:::linkService
                key_direct["Gold<br/>Direct access"]:::linkDirect
                key_auth["Purple<br/>Identity control"]:::linkAuth
                key_data_link["Violet<br/>Data flow"]:::linkData
                key_telemetry["Teal<br/>Telemetry"]:::linkTelemetry
                key_control["Orange<br/>Delivery and control"]:::linkControl
                key_internal_link["Gray<br/>Internal flow"]:::linkInternal
            end
        end

        subgraph application_band["Applications and Communications"]
            direction LR

            subgraph application_domains["Domains"]
                direction TB
                portal_domain["bstein.dev"]:::domain
                portal_chat_domain["chat.ai.bstein.dev"]:::domain
                cassandra_domain["cassandra.bstein.dev"]:::domain
                element_domain["live.bstein.dev"]:::domain
                matrix_domain["matrix.live.bstein.dev"]:::domain
                call_domain["call.live.bstein.dev"]:::domain
                livekit_domain["kit.live.bstein.dev"]:::domain
                turn_domain["turn.live.bstein.dev"]:::domain
            end

            subgraph application_access["Keycloak Access"]
                direction LR

                subgraph application_atlas_access["atlas realm"]
                    direction TB
                    portal_oidc_access["Portal API<br/>OIDC token"]:::access
                    portal_chat_oidc_access["Portal Chat<br/>OIDC"]:::access
                    element_oidc_access["Element Web<br/>OIDC through MAS"]:::access
                    matrix_oidc_access["Matrix<br/>OIDC through MAS"]:::access
                end

                subgraph application_cassandra_access["cassandra realm"]
                    direction TB
                    cassandra_oidc_access["Cassandra<br/>OIDC"]:::access
                end
            end

            subgraph application_services["Cluster Services"]
                direction TB

                application_delivery["Flux delivery<br/>Application workloads"]:::control
                application_state_clients["Shared PostgreSQL<br/>Portal and Matrix"]:::control

                subgraph website_ns["bstein-dev-home"]
                    direction LR
                    website_frontend["Portal"]:::user
                    website_chat_gateway["Chat gateway"]:::user
                    website_backend["Backend"]:::support

                    website_frontend --> website_backend
                    website_chat_gateway --> website_backend
                end

                subgraph cassandra_ns["cassandra"]
                    direction LR
                    cassandra_frontend["Cassandra UI"]:::user
                    cassandra_backend["API"]:::support
                    cassandra_postgres["PostgreSQL"]:::data
                    cassandra_generator["Generator"]:::ephemeral
                    cassandra_simulation["Simulation jobs"]:::ephemeral
                    cassandra_retention["Retention job"]:::ephemeral
                    cassandra_artifacts["Artifacts"]:::data

                    cassandra_frontend --> cassandra_backend
                    cassandra_backend --> cassandra_postgres
                    cassandra_generator --> cassandra_backend
                    cassandra_simulation --> cassandra_backend
                    cassandra_simulation --> cassandra_artifacts
                    cassandra_retention --> cassandra_artifacts
                end

                subgraph comms_ns["comms"]
                    direction LR
                    comms_element_web["Element Web"]:::user
                    comms_element_call["Element Call"]:::user
                    comms_wellknown["Matrix discovery"]:::support
                    comms_guest["Guest registration"]:::support
                    comms_mas["Matrix auth service"]:::support
                    comms_synapse["Synapse"]:::support
                    comms_replication["Synapse replication"]:::support
                    comms_redis["Redis"]:::data
                    comms_livekit_token["LiveKit token service"]:::support
                    comms_livekit["LiveKit"]:::support
                    comms_coturn["Coturn"]:::support
                    comms_atlasbot["Atlasbot"]:::support

                    comms_element_web --> comms_mas
                    comms_element_web --> comms_synapse
                    comms_element_call --> comms_livekit_token
                    comms_livekit_token --> comms_livekit
                    comms_mas --> comms_synapse
                    comms_synapse --> comms_replication
                    comms_synapse --> comms_redis
                    comms_guest --> comms_synapse
                    comms_atlasbot --> comms_synapse
                end
            end

            portal_domain portal_identity@-->|HTTPS| portal_oidc_access
            portal_oidc_access portal_entry@--> website_frontend
            portal_chat_domain portal_chat_identity@-->|HTTPS| portal_chat_oidc_access
            portal_chat_oidc_access portal_chat_entry@--> website_chat_gateway
            cassandra_domain cassandra_identity@-->|HTTPS| cassandra_oidc_access
            cassandra_oidc_access cassandra_entry@--> cassandra_frontend
            element_domain element_identity@-->|HTTPS| element_oidc_access
            element_oidc_access element_entry@--> comms_element_web
            matrix_domain matrix_identity@-->|HTTPS| matrix_oidc_access
            matrix_oidc_access matrix_entry@--> comms_synapse
            matrix_domain matrix_api@-->|Matrix API| comms_synapse
            call_domain call_entry@-->|HTTPS| comms_element_call
            livekit_domain livekit_entry@-->|HTTPS and WebRTC| comms_livekit
            turn_domain turn_entry@-->|TURN| comms_coturn
        end

        subgraph personal_band["Personal Services"]
            direction LR

            subgraph personal_domains["Domains"]
                direction LR

                subgraph personal_domains_a["Accounts and Health"]
                    direction TB
                    budget_domain["budget.bstein.dev"]:::domain
                    firefly_domain["money.bstein.dev"]:::domain
                    wolf_domain["wolf.bstein.dev"]:::domain
                    moonlight_domain["moonlight.bstein.dev"]:::domain
                    wger_domain["health.bstein.dev"]:::domain
                    chat_domain["chat.bstein.dev"]:::domain
                end

                subgraph personal_domains_b["Media and Productivity"]
                    direction TB
                    jellyfin_domain["stream.bstein.dev"]:::domain
                    pegasus_domain["pegasus.bstein.dev"]:::domain
                    mailu_domain["mail.bstein.dev"]:::domain
                    cloud_domain["cloud.bstein.dev"]:::domain
                    office_domain["office.bstein.dev"]:::domain
                    outline_domain["notes.bstein.dev"]:::domain
                    planka_domain["tasks.bstein.dev"]:::domain
                    vaultwarden_domain["vault.bstein.dev"]:::domain
                    monero_domain["monero.bstein.dev"]:::domain
                end
            end

            subgraph personal_access["atlas realm and directory access"]
                direction LR

                subgraph personal_access_a["Accounts"]
                    direction TB
                    budget_oidc_access["Actual Budget<br/>OpenID"]:::access
                    firefly_synced_access["Firefly<br/>Synced account"]:::directory
                    wolf_oauth_access["Wolf<br/>Access proxy"]:::oauth
                    wger_synced_access["Wger<br/>Synced account"]:::directory
                    chat_oidc_access["Hermes Chat<br/>OIDC"]:::access
                end

                subgraph personal_access_b["Media and Productivity"]
                    direction TB
                    jellyfin_ldap_access["Jellyfin<br/>LDAP"]:::directory
                    cloud_oidc_access["Nextcloud<br/>OIDC"]:::access
                    outline_oidc_access["Outline<br/>OIDC"]:::access
                    planka_oidc_access["Planka<br/>OIDC"]:::access
                end
            end

            subgraph personal_services["Cluster Services"]
                direction LR

                personal_delivery["Flux delivery<br/>Personal workloads"]:::control
                personal_state_clients["Shared PostgreSQL<br/>Personal services"]:::control

                subgraph personal_services_a["Accounts, Health, and Media"]
                    direction TB

                    subgraph finance_ns["finance"]
                        direction LR
                        finance_budget["Actual Budget"]:::user
                        finance_firefly["Firefly"]:::user
                        finance_sync["Account sync"]:::ephemeral
                        finance_import["Import job"]:::ephemeral
                        finance_sync --> finance_firefly
                        finance_import --> finance_firefly
                    end

                    subgraph game_ns["game-stream"]
                        direction LR
                        game_proxy["Wolf access proxy"]:::oauth
                        game_manager["Wolf manager"]:::support
                        game_api["Wolf API"]:::support
                        game_wolf["Wolf"]:::support
                        game_gatekeeper["Gatekeeper"]:::support
                        game_moonlight["Moonlight"]:::user
                        game_proxy --> game_manager
                        game_manager --> game_api
                        game_api --> game_wolf
                        game_gatekeeper --> game_wolf
                        game_moonlight --> game_wolf
                    end

                    subgraph health_ns["health"]
                        direction LR
                        health_wger["Wger"]:::user
                        health_sync["Account sync"]:::ephemeral
                        health_admin["Admin sync"]:::ephemeral
                        health_sync --> health_wger
                        health_admin --> health_wger
                    end

                    subgraph hermes_chat_ns["hermes-chat"]
                        direction LR
                        hermes_chat["Hermes Chat"]:::user
                    end

                    subgraph jellyfin_ns["jellyfin"]
                        direction LR
                        streaming_pegasus["Pegasus"]:::user
                        streaming_jellyfin["Jellyfin"]:::user
                        streaming_pegasus --> streaming_jellyfin
                    end
                end

                subgraph personal_services_b["Mail and Productivity"]
                    direction TB

                    subgraph mail_ns["mailu-mailserver"]
                        direction LR
                        mail_front["Mail web"]:::user
                        mail_protocols["Mail protocols"]:::user
                        mail_admin["Admin"]:::support
                        mail_dovecot["Dovecot"]:::support
                        mail_postfix["Postfix"]:::support
                        mail_rspamd["Rspamd"]:::support
                        mail_clamav["ClamAV"]:::support
                        mail_extractors["Tika and oletools"]:::support
                        mail_redis["Redis"]:::data
                        mail_front --> mail_admin
                        mail_protocols --> mail_dovecot
                        mail_protocols --> mail_postfix
                        mail_postfix --> mail_rspamd
                        mail_rspamd --> mail_clamav
                        mail_rspamd --> mail_extractors
                        mail_admin --> mail_redis
                    end

                    subgraph cloud_ns["nextcloud"]
                        direction LR
                        cloud_nextcloud["Nextcloud"]:::user
                        cloud_collabora["Collabora"]:::support
                        cloud_mail_sync["Mail sync"]:::ephemeral
                        cloud_maintenance["Maintenance job"]:::ephemeral
                        cloud_nextcloud --> cloud_collabora
                        cloud_mail_sync --> cloud_nextcloud
                        cloud_maintenance --> cloud_nextcloud
                    end

                    subgraph notes_tasks_ns["Notes and Tasks"]
                        direction LR
                        outline_service["Outline"]:::user
                        outline_redis["Redis"]:::data
                        planka_service["Planka"]:::user
                        outline_service --> outline_redis
                    end

                    subgraph vaultwarden_ns["vaultwarden"]
                        direction LR
                        vaultwarden_service["Vaultwarden"]:::user
                    end

                    subgraph crypto_ns["crypto"]
                        direction LR
                        crypto_wallet["Wallet RPC"]:::support
                        crypto_p2pool["P2Pool"]:::support
                        crypto_monerod["Monerod"]:::user
                        crypto_wallet --> crypto_monerod
                        crypto_p2pool --> crypto_monerod
                    end
                end
            end

            budget_domain budget_identity@-->|HTTPS| budget_oidc_access
            budget_oidc_access budget_entry@--> finance_budget
            firefly_domain firefly_identity@-->|HTTPS| firefly_synced_access
            firefly_synced_access firefly_entry@--> finance_firefly
            wolf_domain wolf_identity@-->|HTTPS| wolf_oauth_access
            wolf_oauth_access wolf_entry@--> game_manager
            moonlight_domain moonlight_entry@-->|Streaming| game_moonlight
            wger_domain wger_identity@-->|HTTPS| wger_synced_access
            wger_synced_access wger_entry@--> health_wger
            chat_domain chat_identity@-->|HTTPS| chat_oidc_access
            chat_oidc_access chat_entry@--> hermes_chat
            jellyfin_domain jellyfin_identity@-->|HTTPS| jellyfin_ldap_access
            jellyfin_ldap_access jellyfin_entry@--> streaming_jellyfin
            pegasus_domain pegasus_entry@-->|HTTPS| streaming_pegasus
            mailu_domain mail_web_entry@-->|HTTPS| mail_front
            mailu_domain mail_protocol_entry@-->|Mail protocols| mail_protocols
            cloud_domain cloud_identity@-->|HTTPS| cloud_oidc_access
            cloud_oidc_access cloud_entry@--> cloud_nextcloud
            office_domain office_entry@-->|WOPI| cloud_collabora
            outline_domain outline_identity@-->|HTTPS| outline_oidc_access
            outline_oidc_access outline_entry@--> outline_service
            planka_domain planka_identity@-->|HTTPS| planka_oidc_access
            planka_oidc_access planka_entry@--> planka_service
            vaultwarden_domain vaultwarden_entry@-->|HTTPS and local auth| vaultwarden_service
            monero_domain monero_entry@-->|RPC| crypto_monerod
        end

        subgraph platform_band["Platform Services"]
            direction LR

            subgraph platform_domains["Domains"]
                direction LR

                subgraph platform_domains_a["Delivery"]
                    direction TB
                    gitops_domain["cd.bstein.dev"]:::domain
                    gitea_domain["scm.bstein.dev"]:::domain
                    harbor_domain["registry.bstein.dev"]:::domain
                    hermes_domain["agent.bstein.dev"]:::domain
                    jenkins_domain["ci.bstein.dev"]:::domain
                end

                subgraph platform_domains_b["Operations"]
                    direction TB
                    logs_domain["logs.bstein.dev"]:::domain
                    longhorn_domain["longhorn.bstein.dev"]:::domain
                    grafana_domain["metrics.bstein.dev"]:::domain
                    alerts_domain["alerts.bstein.dev"]:::domain
                    quality_domain["quality.bstein.dev"]:::domain
                    keycloak_domain["sso.bstein.dev"]:::domain
                    vault_domain["secret.bstein.dev"]:::domain
                end
            end

            subgraph platform_access["Keycloak Access"]
                direction LR

                subgraph platform_access_a["atlas realm delivery"]
                    direction TB
                    gitops_oidc_access["Weave GitOps<br/>OIDC"]:::access
                    gitea_atlas_oidc_access["Gitea<br/>atlas realm"]:::access
                    harbor_oidc_access["Harbor UI<br/>OIDC"]:::access
                    hermes_oidc_access["Hermes Agent<br/>OIDC"]:::access
                    jenkins_oidc_access["Jenkins<br/>OIDC"]:::access
                end

                subgraph platform_access_b["atlas realm operations"]
                    direction TB
                    logs_oauth_access["OpenSearch Dashboards<br/>Access proxy"]:::oauth
                    longhorn_oauth_access["Longhorn<br/>Admin proxy"]:::oauth
                    grafana_oidc_access["Grafana<br/>OIDC"]:::access
                    quality_oauth_access["SonarQube<br/>Admin and developer proxy"]:::oauth
                    keycloak_admin_access["Keycloak console<br/>Realm admin"]:::access
                    vault_oidc_access["Vault<br/>Admin OIDC"]:::access
                end

                subgraph platform_access_c["cassandra realm client"]
                    direction TB
                    gitea_cassandra_oidc_access["Gitea<br/>OIDC"]:::access
                end
            end

            subgraph platform_services["Cluster Services"]
                direction LR

                platform_delivery["Flux delivery<br/>Platform workloads"]:::control
                platform_state_clients["Shared PostgreSQL<br/>Platform services"]:::control

                subgraph delivery_services["Delivery and Automation"]
                    direction TB

                    subgraph flux_ns["flux-system"]
                        direction LR
                        flux_source["Source controller"]:::support
                        flux_kustomize["Kustomize controller"]:::support
                        flux_helm["Helm controller"]:::support
                        flux_image_reflector["Image reflector"]:::support
                        flux_image_automation["Image automation"]:::support
                        flux_notification["Notification controller"]:::support
                        flux_webhook["Webhook receiver"]:::support
                        flux_weave["Weave GitOps"]:::user
                        flux_source --> flux_kustomize
                        flux_source --> flux_helm
                        flux_image_reflector --> flux_image_automation
                        flux_webhook --> flux_notification
                        flux_weave --> flux_source
                    end

                    subgraph gitea_ns["gitea"]
                        direction LR
                        gitea_http["Gitea web"]:::user
                        gitea_ssh["Gitea SSH"]:::support
                    end

                    subgraph harbor_ns["harbor"]
                        direction LR
                        harbor_portal["Harbor portal"]:::user
                        harbor_core["Harbor core"]:::support
                        harbor_jobservice["Job service"]:::support
                        harbor_registry["OCI registry"]:::data
                        harbor_redis["Redis"]:::data
                        harbor_portal --> harbor_core
                        harbor_jobservice --> harbor_core
                        harbor_core --> harbor_registry
                        harbor_core --> harbor_redis
                    end

                    subgraph hermes_ns["hermes"]
                        direction LR
                        hermes_agent["Hermes Agent"]:::user
                        hermes_model_gate["Model gate"]:::support
                        hermes_gpt_oss["gpt-oss:20b<br/>Fallback model"]:::support
                        hermes_agent --> hermes_model_gate
                        hermes_model_gate --> hermes_gpt_oss
                    end

                    subgraph jenkins_ns["jenkins"]
                        direction LR
                        jenkins_service["Jenkins"]:::user
                        jenkins_agents["Build agents"]:::ephemeral
                        jenkins_service --> jenkins_agents
                    end
                end

                subgraph operations_services["Operations"]
                    direction TB

                    subgraph logging_ns["logging"]
                        direction LR
                        logging_oauth_proxy["Dashboard proxy"]:::oauth
                        logging_dashboards["OpenSearch Dashboards"]:::user
                        logging_opensearch["OpenSearch"]:::data
                        logging_fluent_bit["Fluent Bit"]:::support
                        logging_otel["OpenTelemetry"]:::support
                        logging_data_prepper["Data Prepper"]:::support
                        logging_oauth_proxy --> logging_dashboards
                        logging_dashboards --> logging_opensearch
                        logging_fluent_bit --> logging_opensearch
                        logging_otel --> logging_data_prepper
                        logging_data_prepper --> logging_opensearch
                    end

                    subgraph longhorn_ns["longhorn-system"]
                        direction LR
                        longhorn_oauth_proxy["Longhorn proxy"]:::oauth
                        longhorn_frontend["Longhorn UI"]:::user
                        longhorn_backend["Longhorn manager"]:::data
                        longhorn_webhooks["Admission and recovery"]:::support
                        longhorn_oauth_proxy --> longhorn_frontend
                        longhorn_frontend --> longhorn_backend
                        longhorn_webhooks --> longhorn_backend
                    end

                    subgraph monitoring_ns["monitoring"]
                        direction LR
                        monitoring_grafana["Grafana"]:::user
                        monitoring_victoria["VictoriaMetrics"]:::data
                        monitoring_exporters["Cluster and node exporters"]:::support
                        monitoring_gpu_exporters["GPU exporters"]:::support
                        monitoring_quality_gateway["Quality gateway"]:::support
                        monitoring_postmark["Postmark exporter"]:::support
                        monitoring_vmalert["vmalert"]:::support
                        monitoring_alertmanager["Alertmanager"]:::user
                        monitoring_exporters --> monitoring_victoria
                        monitoring_gpu_exporters --> monitoring_victoria
                        monitoring_quality_gateway --> monitoring_victoria
                        monitoring_postmark --> monitoring_victoria
                        monitoring_victoria --> monitoring_grafana
                        monitoring_vmalert --> monitoring_alertmanager
                    end
                end

                subgraph security_services["Identity and Security"]
                    direction TB

                    subgraph quality_ns["quality"]
                        direction LR
                        quality_oauth_proxy["SonarQube proxy"]:::oauth
                        quality_sonarqube["SonarQube"]:::user
                        quality_exporter["Quality exporter"]:::support
                        quality_oauth_proxy --> quality_sonarqube
                        quality_exporter --> quality_sonarqube
                    end

                    subgraph sso_ns["sso"]
                        direction LR
                        sso_oauth_proxy["Shared access proxy"]:::oauth
                        sso_keycloak["Keycloak"]:::user
                        atlas_realm["atlas realm"]:::control
                        cassandra_realm["cassandra realm"]:::control
                        sso_openldap["OpenLDAP"]:::directory
                        sso_jobs["Realm bootstrap and checks"]:::ephemeral
                        sso_keycloak --> atlas_realm
                        sso_keycloak --> cassandra_realm
                        sso_jobs --> sso_keycloak
                    end

                    subgraph vault_ns["vault"]
                        direction LR
                        vault_service["Vault"]:::user
                        vault_internal["Vault cluster service"]:::support
                        vault_injector["Secret injector"]:::support
                        vault_jobs["Configuration jobs"]:::ephemeral
                        vault_service --> vault_internal
                        vault_injector --> vault_service
                        vault_jobs --> vault_service
                    end
                end
            end

            gitops_domain gitops_identity@-->|HTTPS| gitops_oidc_access
            gitops_oidc_access gitops_entry@--> flux_weave
            gitea_domain gitea_atlas_identity@-->|HTTPS| gitea_atlas_oidc_access
            gitea_atlas_oidc_access gitea_atlas_entry@--> gitea_http
            gitea_domain gitea_cassandra_identity@-->|HTTPS| gitea_cassandra_oidc_access
            gitea_cassandra_oidc_access gitea_cassandra_entry@--> gitea_http
            gitea_domain gitea_ssh_entry@-->|SSH| gitea_ssh
            harbor_domain harbor_identity@-->|HTTPS| harbor_oidc_access
            harbor_oidc_access harbor_entry@--> harbor_portal
            harbor_domain harbor_registry_entry@-->|OCI| harbor_registry
            hermes_domain hermes_identity@-->|HTTPS| hermes_oidc_access
            hermes_oidc_access hermes_entry@--> hermes_agent
            jenkins_domain jenkins_identity@-->|HTTPS| jenkins_oidc_access
            jenkins_oidc_access jenkins_entry@--> jenkins_service
            logs_domain logs_identity@-->|HTTPS| logs_oauth_access
            logs_oauth_access logs_entry@--> logging_oauth_proxy
            longhorn_domain longhorn_identity@-->|HTTPS| longhorn_oauth_access
            longhorn_oauth_access longhorn_entry@--> longhorn_oauth_proxy
            grafana_domain grafana_identity@-->|HTTPS| grafana_oidc_access
            grafana_oidc_access grafana_entry@--> monitoring_grafana
            alerts_domain alerts_entry@-->|HTTPS| monitoring_alertmanager
            quality_domain quality_identity@-->|HTTPS| quality_oauth_access
            quality_oauth_access quality_entry@--> quality_oauth_proxy
            keycloak_domain keycloak_identity@-->|HTTPS| keycloak_admin_access
            keycloak_admin_access keycloak_entry@--> sso_keycloak
            vault_domain vault_identity@-->|HTTPS| vault_oidc_access
            vault_oidc_access vault_entry@--> vault_service
        end

        subgraph shared_plane["Shared Cluster Services"]
            direction LR

            subgraph ingress_plane["Ingress and Networking"]
                direction TB
                metallb_control["MetalLB<br/>Service addresses"]:::control
                traefik_service["Traefik<br/>Load balancer"]:::support
                traefik_controller["Traefik<br/>TLS and routing"]:::support
                cert_manager["cert-manager"]:::support
                cert_webhooks["Certificate webhooks"]:::support
                metallb_control --> traefik_service
                traefik_service --> traefik_controller
                cert_webhooks --> cert_manager
                cert_manager --> traefik_controller
            end

            subgraph shared_state["Shared State and Models"]
                direction TB
                postgres_service["Shared PostgreSQL<br/>Application and platform databases"]:::data
                ai_ollama["Ollama<br/>Local model service"]:::support
                default_zot_proxy["Zot access proxy"]:::oauth
            end

            subgraph maintenance_ns["maintenance"]
                direction TB
                maintenance_ariadne["Ariadne"]:::support
                maintenance_metis_proxy["Metis proxy"]:::oauth
                maintenance_metis["Metis"]:::support
                maintenance_soteria_proxy["Soteria proxy"]:::oauth
                maintenance_soteria["Soteria"]:::support
                maintenance_node_ops["Node operations"]:::ephemeral
                maintenance_jobs["Repair and migration jobs"]:::ephemeral
                maintenance_metis_proxy --> maintenance_metis
                maintenance_soteria_proxy --> maintenance_soteria
                maintenance_ariadne --> maintenance_node_ops
                maintenance_ariadne --> maintenance_jobs
            end

            subgraph telemetry_services["Additional Telemetry"]
                direction TB
                climate_typhon["Typhon<br/>Tent climate"]:::support
                sui_metrics["SUI metrics"]:::support
            end
        end

        subgraph external_systems["Host and Physical Systems"]
            direction LR
            ananke_hosts["Ananke<br/>titan-db and titan-24"]:::external
            pyrphoros["Pyrphoros UPS"]:::external
            statera["Statera UPS"]:::external
            tent_system["AC Infinity<br/>Controller and cloud"]:::external
            ananke_hosts --> pyrphoros
            ananke_hosts --> statera
        end

        firefly_synced_access firefly_directory@-.-> sso_openldap
        wger_synced_access wger_directory@-.-> sso_openldap
        jellyfin_ldap_access jellyfin_directory@-.-> sso_openldap

        website_backend website_model@-.-> ai_ollama
        website_backend website_automation@-.-> maintenance_ariadne
        hermes_chat hermes_chat_model@-.-> hermes_model_gate
        hermes_agent hermes_jenkins@-.-> jenkins_service
        hermes_agent hermes_metrics@-.-> monitoring_victoria
        hermes_agent hermes_ariadne@-.-> maintenance_ariadne

        gitea_http gitea_jenkins@-.->|SCM webhook| jenkins_service
        gitea_http gitea_flux@-.->|Flux webhook| flux_webhook
        jenkins_agents jenkins_gitea@-.->|Clone and fetch| gitea_http
        jenkins_agents jenkins_quality@-.->|Quality scan| quality_sonarqube
        jenkins_agents jenkins_harbor@-.->|Images and artifacts| harbor_registry
        flux_source flux_gitea@-.->|Desired state| gitea_ssh
        flux_image_reflector flux_harbor@-.->|Image metadata| harbor_registry
        flux_image_automation flux_commit@-.->|Manifest update| gitea_ssh
        flux_kustomize flux_apps@-.-> application_delivery
        flux_kustomize flux_personal@-.-> personal_delivery
        flux_kustomize flux_platform@-.-> platform_delivery

        application_state_clients app_postgres@-.-> postgres_service
        personal_state_clients personal_postgres@-.-> postgres_service
        platform_state_clients platform_postgres@-.-> postgres_service
        cloud_nextcloud nextcloud_mail@-.->|Mail delivery| mail_protocols

        quality_exporter quality_metrics@-.-> monitoring_victoria
        sui_metrics sui_telemetry@-.-> monitoring_victoria
        monitoring_victoria ananke_telemetry@-.-> ananke_hosts
        climate_typhon climate_source@--> tent_system
        climate_typhon climate_telemetry@-.-> monitoring_victoria

        class portal_identity,portal_chat_identity,cassandra_identity,element_identity,matrix_identity,budget_identity,firefly_identity,wolf_identity,wger_identity,chat_identity,jellyfin_identity,cloud_identity,outline_identity,planka_identity,gitops_identity,gitea_atlas_identity,gitea_cassandra_identity,harbor_identity,hermes_identity,jenkins_identity,logs_identity,longhorn_identity,grafana_identity,quality_identity,keycloak_identity,vault_identity routeIngress
        class portal_entry,portal_chat_entry,cassandra_entry,element_entry,matrix_entry,budget_entry,firefly_entry,wolf_entry,wger_entry,chat_entry,jellyfin_entry,cloud_entry,outline_entry,planka_entry,gitops_entry,gitea_atlas_entry,gitea_cassandra_entry,harbor_entry,hermes_entry,jenkins_entry,logs_entry,longhorn_entry,grafana_entry,quality_entry,keycloak_entry,vault_entry routeService
        class matrix_api,call_entry,livekit_entry,turn_entry,moonlight_entry,pegasus_entry,mail_web_entry,mail_protocol_entry,office_entry,vaultwarden_entry,monero_entry,gitea_ssh_entry,harbor_registry_entry,alerts_entry routeDirect
        class firefly_directory,wger_directory,jellyfin_directory routeAuth
        class app_postgres,personal_postgres,platform_postgres,nextcloud_mail,climate_source routeData
        class quality_metrics,sui_telemetry,ananke_telemetry,climate_telemetry routeTelemetry
        class website_automation,hermes_ariadne,gitea_jenkins,gitea_flux,jenkins_gitea,jenkins_quality,jenkins_harbor,flux_gitea,flux_harbor,flux_commit,flux_apps,flux_personal,flux_platform routeControl
        class website_model,hermes_chat_model,hermes_jenkins,hermes_metrics routeInternal
    end

    classDef domain fill:#16324f,stroke:#6cb6ff,color:#ffffff
    classDef user fill:#173f2b,stroke:#61d095,color:#ffffff
    classDef support fill:#30343b,stroke:#aab2bf,color:#ffffff
    classDef data fill:#3b2f52,stroke:#b79cff,color:#ffffff
    classDef ephemeral fill:#4a301e,stroke:#f0a35b,color:#ffffff,stroke-dasharray:6 3
    classDef control fill:#3b354e,stroke:#c1a7ff,color:#ffffff
    classDef access fill:#213a56,stroke:#6cb6ff,color:#ffffff
    classDef oauth fill:#3b2f52,stroke:#c1a7ff,color:#ffffff
    classDef directory fill:#344a2d,stroke:#8ed081,color:#ffffff
    classDef external fill:#44301f,stroke:#ffb86c,color:#ffffff

    classDef linkIngress fill:#101820,stroke:#4ea1ff,color:#ffffff
    classDef linkService fill:#101820,stroke:#61d095,color:#ffffff
    classDef linkDirect fill:#101820,stroke:#e4bd55,color:#ffffff
    classDef linkAuth fill:#101820,stroke:#c1a7ff,color:#ffffff
    classDef linkData fill:#101820,stroke:#b79cff,color:#ffffff
    classDef linkTelemetry fill:#101820,stroke:#55c8d3,color:#ffffff
    classDef linkControl fill:#101820,stroke:#f0a35b,color:#ffffff
    classDef linkInternal fill:#101820,stroke:#aab2bf,color:#ffffff

    classDef routeIngress stroke:#4ea1ff,stroke-width:2.5px,color:#4ea1ff
    classDef routeService stroke:#61d095,stroke-width:2.5px,color:#61d095
    classDef routeDirect stroke:#e4bd55,stroke-width:2.5px,color:#e4bd55
    classDef routeAuth stroke:#c1a7ff,stroke-width:2.2px,color:#c1a7ff,stroke-dasharray:6 4
    classDef routeData stroke:#b79cff,stroke-width:2.2px,color:#b79cff,stroke-dasharray:6 4
    classDef routeTelemetry stroke:#55c8d3,stroke-width:2.2px,color:#55c8d3,stroke-dasharray:6 4
    classDef routeControl stroke:#f0a35b,stroke-width:2.2px,color:#f0a35b,stroke-dasharray:6 4
    classDef routeInternal stroke:#aab2bf,stroke-width:2px,color:#aab2bf,stroke-dasharray:5 4

    style system fill:#000000,stroke:#8b95a5,stroke-width:2px
    style legend fill:#050505,stroke:#6d7485,stroke-width:1.5px
    style application_band fill:#02030d,stroke:#55c8d3,stroke-width:2px
    style personal_band fill:#06030d,stroke:#8ed081,stroke-width:2px
    style platform_band fill:#07040c,stroke:#c1a7ff,stroke-width:2px
    style shared_plane fill:#080604,stroke:#e4bd55,stroke-width:2px
    style external_systems fill:#080402,stroke:#ffb86c,stroke-width:2px
