706 lines
36 KiB
Plaintext
706 lines
36 KiB
Plaintext
%% Atlas service access architecture.
|
|
%% Domains, identity profiles, entry services, and selected internal dependencies.
|
|
%% Node placement and short labels carry the detail.
|
|
%%{init: {"flowchart": {"defaultRenderer": "elk", "curve": "stepAfter", "nodeSpacing": 30, "rankSpacing": 65, "useMaxWidth": false}, "elk": {"mergeEdges": true, "nodePlacementStrategy": "LINEAR_SEGMENTS", "forceNodeModelOrder": true, "considerModelOrder": "NODES_AND_EDGES"}, "themeVariables": {"background": "#000000", "lineColor": "#8b95a5", "primaryTextColor": "#ffffff", "clusterBkg": "#03040d", "clusterBorder": "#6d7485"}, "themeCSS": "& { background-color: #000000 !important; }"}}%%
|
|
flowchart TB
|
|
subgraph system["Atlas Service Access Architecture"]
|
|
direction TB
|
|
|
|
subgraph legend["Legend"]
|
|
direction LR
|
|
|
|
subgraph node_key["Nodes"]
|
|
direction LR
|
|
key_domain["DNS name"]:::domain
|
|
key_access["OIDC access"]:::access
|
|
key_oauth["Access proxy"]:::oauth
|
|
key_directory["LDAP or synced account"]:::directory
|
|
key_entry["Entry service"]:::user
|
|
key_internal["Internal service"]:::support
|
|
key_data["Data service"]:::data
|
|
key_job["Job or worker"]:::ephemeral
|
|
key_external["Outside Kubernetes"]:::external
|
|
end
|
|
|
|
subgraph link_key["Links"]
|
|
direction LR
|
|
key_ingress["Blue<br/>Domain to identity"]:::linkIngress
|
|
key_service["Green<br/>Identity to service"]:::linkService
|
|
key_direct["Gold<br/>Direct access"]:::linkDirect
|
|
key_auth["Purple<br/>Identity control"]:::linkAuth
|
|
key_data_link["Violet<br/>Data flow"]:::linkData
|
|
key_telemetry["Teal<br/>Telemetry"]:::linkTelemetry
|
|
key_control["Orange<br/>Delivery and control"]:::linkControl
|
|
key_internal_link["Gray<br/>Internal flow"]:::linkInternal
|
|
end
|
|
end
|
|
|
|
subgraph application_band["Applications and Communications"]
|
|
direction LR
|
|
|
|
subgraph application_domains["Domains"]
|
|
direction TB
|
|
portal_domain["bstein.dev"]:::domain
|
|
portal_chat_domain["chat.ai.bstein.dev"]:::domain
|
|
cassandra_domain["cassandra.bstein.dev"]:::domain
|
|
element_domain["live.bstein.dev"]:::domain
|
|
matrix_domain["matrix.live.bstein.dev"]:::domain
|
|
call_domain["call.live.bstein.dev"]:::domain
|
|
livekit_domain["kit.live.bstein.dev"]:::domain
|
|
turn_domain["turn.live.bstein.dev"]:::domain
|
|
end
|
|
|
|
subgraph application_access["Keycloak Access"]
|
|
direction LR
|
|
|
|
subgraph application_atlas_access["atlas realm"]
|
|
direction TB
|
|
portal_oidc_access["Portal API<br/>OIDC token"]:::access
|
|
portal_chat_oidc_access["Portal Chat<br/>OIDC"]:::access
|
|
element_oidc_access["Element Web<br/>OIDC through MAS"]:::access
|
|
matrix_oidc_access["Matrix<br/>OIDC through MAS"]:::access
|
|
end
|
|
|
|
subgraph application_cassandra_access["cassandra realm"]
|
|
direction TB
|
|
cassandra_oidc_access["Cassandra<br/>OIDC"]:::access
|
|
end
|
|
end
|
|
|
|
subgraph application_services["Cluster Services"]
|
|
direction TB
|
|
|
|
application_delivery["Flux delivery<br/>Application workloads"]:::control
|
|
application_state_clients["Shared PostgreSQL<br/>Portal and Matrix"]:::control
|
|
|
|
subgraph website_ns["bstein-dev-home"]
|
|
direction LR
|
|
website_frontend["Portal"]:::user
|
|
website_chat_gateway["Chat gateway"]:::user
|
|
website_backend["Backend"]:::support
|
|
|
|
website_frontend --> website_backend
|
|
website_chat_gateway --> website_backend
|
|
end
|
|
|
|
subgraph cassandra_ns["cassandra"]
|
|
direction LR
|
|
cassandra_frontend["Cassandra UI"]:::user
|
|
cassandra_backend["API"]:::support
|
|
cassandra_postgres["PostgreSQL"]:::data
|
|
cassandra_generator["Generator"]:::ephemeral
|
|
cassandra_simulation["Simulation jobs"]:::ephemeral
|
|
cassandra_retention["Retention job"]:::ephemeral
|
|
cassandra_artifacts["Artifacts"]:::data
|
|
|
|
cassandra_frontend --> cassandra_backend
|
|
cassandra_backend --> cassandra_postgres
|
|
cassandra_generator --> cassandra_backend
|
|
cassandra_simulation --> cassandra_backend
|
|
cassandra_simulation --> cassandra_artifacts
|
|
cassandra_retention --> cassandra_artifacts
|
|
end
|
|
|
|
subgraph comms_ns["comms"]
|
|
direction LR
|
|
comms_element_web["Element Web"]:::user
|
|
comms_element_call["Element Call"]:::user
|
|
comms_wellknown["Matrix discovery"]:::support
|
|
comms_guest["Guest registration"]:::support
|
|
comms_mas["Matrix auth service"]:::support
|
|
comms_synapse["Synapse"]:::support
|
|
comms_replication["Synapse replication"]:::support
|
|
comms_redis["Redis"]:::data
|
|
comms_livekit_token["LiveKit token service"]:::support
|
|
comms_livekit["LiveKit"]:::support
|
|
comms_coturn["Coturn"]:::support
|
|
comms_atlasbot["Atlasbot"]:::support
|
|
|
|
comms_element_web --> comms_mas
|
|
comms_element_web --> comms_synapse
|
|
comms_element_call --> comms_livekit_token
|
|
comms_livekit_token --> comms_livekit
|
|
comms_mas --> comms_synapse
|
|
comms_synapse --> comms_replication
|
|
comms_synapse --> comms_redis
|
|
comms_guest --> comms_synapse
|
|
comms_atlasbot --> comms_synapse
|
|
end
|
|
end
|
|
|
|
portal_domain portal_identity@-->|HTTPS| portal_oidc_access
|
|
portal_oidc_access portal_entry@--> website_frontend
|
|
portal_chat_domain portal_chat_identity@-->|HTTPS| portal_chat_oidc_access
|
|
portal_chat_oidc_access portal_chat_entry@--> website_chat_gateway
|
|
cassandra_domain cassandra_identity@-->|HTTPS| cassandra_oidc_access
|
|
cassandra_oidc_access cassandra_entry@--> cassandra_frontend
|
|
element_domain element_identity@-->|HTTPS| element_oidc_access
|
|
element_oidc_access element_entry@--> comms_element_web
|
|
matrix_domain matrix_identity@-->|HTTPS| matrix_oidc_access
|
|
matrix_oidc_access matrix_entry@--> comms_synapse
|
|
matrix_domain matrix_api@-->|Matrix API| comms_synapse
|
|
call_domain call_entry@-->|HTTPS| comms_element_call
|
|
livekit_domain livekit_entry@-->|HTTPS and WebRTC| comms_livekit
|
|
turn_domain turn_entry@-->|TURN| comms_coturn
|
|
end
|
|
|
|
subgraph personal_band["Personal Services"]
|
|
direction LR
|
|
|
|
subgraph personal_domains["Domains"]
|
|
direction LR
|
|
|
|
subgraph personal_domains_a["Accounts and Health"]
|
|
direction TB
|
|
budget_domain["budget.bstein.dev"]:::domain
|
|
firefly_domain["money.bstein.dev"]:::domain
|
|
wolf_domain["wolf.bstein.dev"]:::domain
|
|
moonlight_domain["moonlight.bstein.dev"]:::domain
|
|
wger_domain["health.bstein.dev"]:::domain
|
|
chat_domain["chat.bstein.dev"]:::domain
|
|
end
|
|
|
|
subgraph personal_domains_b["Media and Productivity"]
|
|
direction TB
|
|
jellyfin_domain["stream.bstein.dev"]:::domain
|
|
pegasus_domain["pegasus.bstein.dev"]:::domain
|
|
mailu_domain["mail.bstein.dev"]:::domain
|
|
cloud_domain["cloud.bstein.dev"]:::domain
|
|
office_domain["office.bstein.dev"]:::domain
|
|
outline_domain["notes.bstein.dev"]:::domain
|
|
planka_domain["tasks.bstein.dev"]:::domain
|
|
vaultwarden_domain["vault.bstein.dev"]:::domain
|
|
monero_domain["monero.bstein.dev"]:::domain
|
|
end
|
|
end
|
|
|
|
subgraph personal_access["atlas realm and directory access"]
|
|
direction LR
|
|
|
|
subgraph personal_access_a["Accounts"]
|
|
direction TB
|
|
budget_oidc_access["Actual Budget<br/>OpenID"]:::access
|
|
firefly_synced_access["Firefly<br/>Synced account"]:::directory
|
|
wolf_oauth_access["Wolf<br/>Access proxy"]:::oauth
|
|
wger_synced_access["Wger<br/>Synced account"]:::directory
|
|
chat_oidc_access["Hermes Chat<br/>OIDC"]:::access
|
|
end
|
|
|
|
subgraph personal_access_b["Media and Productivity"]
|
|
direction TB
|
|
jellyfin_ldap_access["Jellyfin<br/>LDAP"]:::directory
|
|
cloud_oidc_access["Nextcloud<br/>OIDC"]:::access
|
|
outline_oidc_access["Outline<br/>OIDC"]:::access
|
|
planka_oidc_access["Planka<br/>OIDC"]:::access
|
|
end
|
|
end
|
|
|
|
subgraph personal_services["Cluster Services"]
|
|
direction LR
|
|
|
|
personal_delivery["Flux delivery<br/>Personal workloads"]:::control
|
|
personal_state_clients["Shared PostgreSQL<br/>Personal services"]:::control
|
|
|
|
subgraph personal_services_a["Accounts, Health, and Media"]
|
|
direction TB
|
|
|
|
subgraph finance_ns["finance"]
|
|
direction LR
|
|
finance_budget["Actual Budget"]:::user
|
|
finance_firefly["Firefly"]:::user
|
|
finance_sync["Account sync"]:::ephemeral
|
|
finance_import["Import job"]:::ephemeral
|
|
finance_sync --> finance_firefly
|
|
finance_import --> finance_firefly
|
|
end
|
|
|
|
subgraph game_ns["game-stream"]
|
|
direction LR
|
|
game_proxy["Wolf access proxy"]:::oauth
|
|
game_manager["Wolf manager"]:::support
|
|
game_api["Wolf API"]:::support
|
|
game_wolf["Wolf"]:::support
|
|
game_gatekeeper["Gatekeeper"]:::support
|
|
game_moonlight["Moonlight"]:::user
|
|
game_proxy --> game_manager
|
|
game_manager --> game_api
|
|
game_api --> game_wolf
|
|
game_gatekeeper --> game_wolf
|
|
game_moonlight --> game_wolf
|
|
end
|
|
|
|
subgraph health_ns["health"]
|
|
direction LR
|
|
health_wger["Wger"]:::user
|
|
health_sync["Account sync"]:::ephemeral
|
|
health_admin["Admin sync"]:::ephemeral
|
|
health_sync --> health_wger
|
|
health_admin --> health_wger
|
|
end
|
|
|
|
subgraph hermes_chat_ns["hermes-chat"]
|
|
direction LR
|
|
hermes_chat["Hermes Chat"]:::user
|
|
end
|
|
|
|
subgraph jellyfin_ns["jellyfin"]
|
|
direction LR
|
|
streaming_pegasus["Pegasus"]:::user
|
|
streaming_jellyfin["Jellyfin"]:::user
|
|
streaming_pegasus --> streaming_jellyfin
|
|
end
|
|
end
|
|
|
|
subgraph personal_services_b["Mail and Productivity"]
|
|
direction TB
|
|
|
|
subgraph mail_ns["mailu-mailserver"]
|
|
direction LR
|
|
mail_front["Mail web"]:::user
|
|
mail_protocols["Mail protocols"]:::user
|
|
mail_admin["Admin"]:::support
|
|
mail_dovecot["Dovecot"]:::support
|
|
mail_postfix["Postfix"]:::support
|
|
mail_rspamd["Rspamd"]:::support
|
|
mail_clamav["ClamAV"]:::support
|
|
mail_extractors["Tika and oletools"]:::support
|
|
mail_redis["Redis"]:::data
|
|
mail_front --> mail_admin
|
|
mail_protocols --> mail_dovecot
|
|
mail_protocols --> mail_postfix
|
|
mail_postfix --> mail_rspamd
|
|
mail_rspamd --> mail_clamav
|
|
mail_rspamd --> mail_extractors
|
|
mail_admin --> mail_redis
|
|
end
|
|
|
|
subgraph cloud_ns["nextcloud"]
|
|
direction LR
|
|
cloud_nextcloud["Nextcloud"]:::user
|
|
cloud_collabora["Collabora"]:::support
|
|
cloud_mail_sync["Mail sync"]:::ephemeral
|
|
cloud_maintenance["Maintenance job"]:::ephemeral
|
|
cloud_nextcloud --> cloud_collabora
|
|
cloud_mail_sync --> cloud_nextcloud
|
|
cloud_maintenance --> cloud_nextcloud
|
|
end
|
|
|
|
subgraph notes_tasks_ns["Notes and Tasks"]
|
|
direction LR
|
|
outline_service["Outline"]:::user
|
|
outline_redis["Redis"]:::data
|
|
planka_service["Planka"]:::user
|
|
outline_service --> outline_redis
|
|
end
|
|
|
|
subgraph vaultwarden_ns["vaultwarden"]
|
|
direction LR
|
|
vaultwarden_service["Vaultwarden"]:::user
|
|
end
|
|
|
|
subgraph crypto_ns["crypto"]
|
|
direction LR
|
|
crypto_wallet["Wallet RPC"]:::support
|
|
crypto_p2pool["P2Pool"]:::support
|
|
crypto_monerod["Monerod"]:::user
|
|
crypto_wallet --> crypto_monerod
|
|
crypto_p2pool --> crypto_monerod
|
|
end
|
|
end
|
|
end
|
|
|
|
budget_domain budget_identity@-->|HTTPS| budget_oidc_access
|
|
budget_oidc_access budget_entry@--> finance_budget
|
|
firefly_domain firefly_identity@-->|HTTPS| firefly_synced_access
|
|
firefly_synced_access firefly_entry@--> finance_firefly
|
|
wolf_domain wolf_identity@-->|HTTPS| wolf_oauth_access
|
|
wolf_oauth_access wolf_entry@--> game_manager
|
|
moonlight_domain moonlight_entry@-->|Streaming| game_moonlight
|
|
wger_domain wger_identity@-->|HTTPS| wger_synced_access
|
|
wger_synced_access wger_entry@--> health_wger
|
|
chat_domain chat_identity@-->|HTTPS| chat_oidc_access
|
|
chat_oidc_access chat_entry@--> hermes_chat
|
|
jellyfin_domain jellyfin_identity@-->|HTTPS| jellyfin_ldap_access
|
|
jellyfin_ldap_access jellyfin_entry@--> streaming_jellyfin
|
|
pegasus_domain pegasus_entry@-->|HTTPS| streaming_pegasus
|
|
mailu_domain mail_web_entry@-->|HTTPS| mail_front
|
|
mailu_domain mail_protocol_entry@-->|Mail protocols| mail_protocols
|
|
cloud_domain cloud_identity@-->|HTTPS| cloud_oidc_access
|
|
cloud_oidc_access cloud_entry@--> cloud_nextcloud
|
|
office_domain office_entry@-->|WOPI| cloud_collabora
|
|
outline_domain outline_identity@-->|HTTPS| outline_oidc_access
|
|
outline_oidc_access outline_entry@--> outline_service
|
|
planka_domain planka_identity@-->|HTTPS| planka_oidc_access
|
|
planka_oidc_access planka_entry@--> planka_service
|
|
vaultwarden_domain vaultwarden_entry@-->|HTTPS and local auth| vaultwarden_service
|
|
monero_domain monero_entry@-->|RPC| crypto_monerod
|
|
end
|
|
|
|
subgraph platform_band["Platform Services"]
|
|
direction LR
|
|
|
|
subgraph platform_domains["Domains"]
|
|
direction LR
|
|
|
|
subgraph platform_domains_a["Delivery"]
|
|
direction TB
|
|
gitops_domain["cd.bstein.dev"]:::domain
|
|
gitea_domain["scm.bstein.dev"]:::domain
|
|
harbor_domain["registry.bstein.dev"]:::domain
|
|
hermes_domain["agent.bstein.dev"]:::domain
|
|
jenkins_domain["ci.bstein.dev"]:::domain
|
|
end
|
|
|
|
subgraph platform_domains_b["Operations"]
|
|
direction TB
|
|
logs_domain["logs.bstein.dev"]:::domain
|
|
longhorn_domain["longhorn.bstein.dev"]:::domain
|
|
grafana_domain["metrics.bstein.dev"]:::domain
|
|
alerts_domain["alerts.bstein.dev"]:::domain
|
|
quality_domain["quality.bstein.dev"]:::domain
|
|
keycloak_domain["sso.bstein.dev"]:::domain
|
|
vault_domain["secret.bstein.dev"]:::domain
|
|
end
|
|
end
|
|
|
|
subgraph platform_access["Keycloak Access"]
|
|
direction LR
|
|
|
|
subgraph platform_access_a["atlas realm delivery"]
|
|
direction TB
|
|
gitops_oidc_access["Weave GitOps<br/>OIDC"]:::access
|
|
gitea_atlas_oidc_access["Gitea<br/>atlas realm"]:::access
|
|
harbor_oidc_access["Harbor UI<br/>OIDC"]:::access
|
|
hermes_oidc_access["Hermes Agent<br/>OIDC"]:::access
|
|
jenkins_oidc_access["Jenkins<br/>OIDC"]:::access
|
|
end
|
|
|
|
subgraph platform_access_b["atlas realm operations"]
|
|
direction TB
|
|
logs_oauth_access["OpenSearch Dashboards<br/>Access proxy"]:::oauth
|
|
longhorn_oauth_access["Longhorn<br/>Admin proxy"]:::oauth
|
|
grafana_oidc_access["Grafana<br/>OIDC"]:::access
|
|
quality_oauth_access["SonarQube<br/>Admin and developer proxy"]:::oauth
|
|
keycloak_admin_access["Keycloak console<br/>Realm admin"]:::access
|
|
vault_oidc_access["Vault<br/>Admin OIDC"]:::access
|
|
end
|
|
|
|
subgraph platform_access_c["cassandra realm client"]
|
|
direction TB
|
|
gitea_cassandra_oidc_access["Gitea<br/>OIDC"]:::access
|
|
end
|
|
end
|
|
|
|
subgraph platform_services["Cluster Services"]
|
|
direction LR
|
|
|
|
platform_delivery["Flux delivery<br/>Platform workloads"]:::control
|
|
platform_state_clients["Shared PostgreSQL<br/>Platform services"]:::control
|
|
|
|
subgraph delivery_services["Delivery and Automation"]
|
|
direction TB
|
|
|
|
subgraph flux_ns["flux-system"]
|
|
direction LR
|
|
flux_source["Source controller"]:::support
|
|
flux_kustomize["Kustomize controller"]:::support
|
|
flux_helm["Helm controller"]:::support
|
|
flux_image_reflector["Image reflector"]:::support
|
|
flux_image_automation["Image automation"]:::support
|
|
flux_notification["Notification controller"]:::support
|
|
flux_webhook["Webhook receiver"]:::support
|
|
flux_weave["Weave GitOps"]:::user
|
|
flux_source --> flux_kustomize
|
|
flux_source --> flux_helm
|
|
flux_image_reflector --> flux_image_automation
|
|
flux_webhook --> flux_notification
|
|
flux_weave --> flux_source
|
|
end
|
|
|
|
subgraph gitea_ns["gitea"]
|
|
direction LR
|
|
gitea_http["Gitea web"]:::user
|
|
gitea_ssh["Gitea SSH"]:::support
|
|
end
|
|
|
|
subgraph harbor_ns["harbor"]
|
|
direction LR
|
|
harbor_portal["Harbor portal"]:::user
|
|
harbor_core["Harbor core"]:::support
|
|
harbor_jobservice["Job service"]:::support
|
|
harbor_registry["OCI registry"]:::data
|
|
harbor_redis["Redis"]:::data
|
|
harbor_portal --> harbor_core
|
|
harbor_jobservice --> harbor_core
|
|
harbor_core --> harbor_registry
|
|
harbor_core --> harbor_redis
|
|
end
|
|
|
|
subgraph hermes_ns["hermes"]
|
|
direction LR
|
|
hermes_agent["Hermes Agent"]:::user
|
|
hermes_model_gate["Model gate"]:::support
|
|
hermes_gpt_oss["gpt-oss:20b<br/>Fallback model"]:::support
|
|
hermes_agent --> hermes_model_gate
|
|
hermes_model_gate --> hermes_gpt_oss
|
|
end
|
|
|
|
subgraph jenkins_ns["jenkins"]
|
|
direction LR
|
|
jenkins_service["Jenkins"]:::user
|
|
jenkins_agents["Build agents"]:::ephemeral
|
|
jenkins_service --> jenkins_agents
|
|
end
|
|
end
|
|
|
|
subgraph operations_services["Operations"]
|
|
direction TB
|
|
|
|
subgraph logging_ns["logging"]
|
|
direction LR
|
|
logging_oauth_proxy["Dashboard proxy"]:::oauth
|
|
logging_dashboards["OpenSearch Dashboards"]:::user
|
|
logging_opensearch["OpenSearch"]:::data
|
|
logging_fluent_bit["Fluent Bit"]:::support
|
|
logging_otel["OpenTelemetry"]:::support
|
|
logging_data_prepper["Data Prepper"]:::support
|
|
logging_oauth_proxy --> logging_dashboards
|
|
logging_dashboards --> logging_opensearch
|
|
logging_fluent_bit --> logging_opensearch
|
|
logging_otel --> logging_data_prepper
|
|
logging_data_prepper --> logging_opensearch
|
|
end
|
|
|
|
subgraph longhorn_ns["longhorn-system"]
|
|
direction LR
|
|
longhorn_oauth_proxy["Longhorn proxy"]:::oauth
|
|
longhorn_frontend["Longhorn UI"]:::user
|
|
longhorn_backend["Longhorn manager"]:::data
|
|
longhorn_webhooks["Admission and recovery"]:::support
|
|
longhorn_oauth_proxy --> longhorn_frontend
|
|
longhorn_frontend --> longhorn_backend
|
|
longhorn_webhooks --> longhorn_backend
|
|
end
|
|
|
|
subgraph monitoring_ns["monitoring"]
|
|
direction LR
|
|
monitoring_grafana["Grafana"]:::user
|
|
monitoring_victoria["VictoriaMetrics"]:::data
|
|
monitoring_exporters["Cluster and node exporters"]:::support
|
|
monitoring_gpu_exporters["GPU exporters"]:::support
|
|
monitoring_quality_gateway["Quality gateway"]:::support
|
|
monitoring_postmark["Postmark exporter"]:::support
|
|
monitoring_vmalert["vmalert"]:::support
|
|
monitoring_alertmanager["Alertmanager"]:::user
|
|
monitoring_exporters --> monitoring_victoria
|
|
monitoring_gpu_exporters --> monitoring_victoria
|
|
monitoring_quality_gateway --> monitoring_victoria
|
|
monitoring_postmark --> monitoring_victoria
|
|
monitoring_victoria --> monitoring_grafana
|
|
monitoring_vmalert --> monitoring_alertmanager
|
|
end
|
|
end
|
|
|
|
subgraph security_services["Identity and Security"]
|
|
direction TB
|
|
|
|
subgraph quality_ns["quality"]
|
|
direction LR
|
|
quality_oauth_proxy["SonarQube proxy"]:::oauth
|
|
quality_sonarqube["SonarQube"]:::user
|
|
quality_exporter["Quality exporter"]:::support
|
|
quality_oauth_proxy --> quality_sonarqube
|
|
quality_exporter --> quality_sonarqube
|
|
end
|
|
|
|
subgraph sso_ns["sso"]
|
|
direction LR
|
|
sso_oauth_proxy["Shared access proxy"]:::oauth
|
|
sso_keycloak["Keycloak"]:::user
|
|
atlas_realm["atlas realm"]:::control
|
|
cassandra_realm["cassandra realm"]:::control
|
|
sso_openldap["OpenLDAP"]:::directory
|
|
sso_jobs["Realm bootstrap and checks"]:::ephemeral
|
|
sso_keycloak --> atlas_realm
|
|
sso_keycloak --> cassandra_realm
|
|
sso_jobs --> sso_keycloak
|
|
end
|
|
|
|
subgraph vault_ns["vault"]
|
|
direction LR
|
|
vault_service["Vault"]:::user
|
|
vault_internal["Vault cluster service"]:::support
|
|
vault_injector["Secret injector"]:::support
|
|
vault_jobs["Configuration jobs"]:::ephemeral
|
|
vault_service --> vault_internal
|
|
vault_injector --> vault_service
|
|
vault_jobs --> vault_service
|
|
end
|
|
end
|
|
end
|
|
|
|
gitops_domain gitops_identity@-->|HTTPS| gitops_oidc_access
|
|
gitops_oidc_access gitops_entry@--> flux_weave
|
|
gitea_domain gitea_atlas_identity@-->|HTTPS| gitea_atlas_oidc_access
|
|
gitea_atlas_oidc_access gitea_atlas_entry@--> gitea_http
|
|
gitea_domain gitea_cassandra_identity@-->|HTTPS| gitea_cassandra_oidc_access
|
|
gitea_cassandra_oidc_access gitea_cassandra_entry@--> gitea_http
|
|
gitea_domain gitea_ssh_entry@-->|SSH| gitea_ssh
|
|
harbor_domain harbor_identity@-->|HTTPS| harbor_oidc_access
|
|
harbor_oidc_access harbor_entry@--> harbor_portal
|
|
harbor_domain harbor_registry_entry@-->|OCI| harbor_registry
|
|
hermes_domain hermes_identity@-->|HTTPS| hermes_oidc_access
|
|
hermes_oidc_access hermes_entry@--> hermes_agent
|
|
jenkins_domain jenkins_identity@-->|HTTPS| jenkins_oidc_access
|
|
jenkins_oidc_access jenkins_entry@--> jenkins_service
|
|
logs_domain logs_identity@-->|HTTPS| logs_oauth_access
|
|
logs_oauth_access logs_entry@--> logging_oauth_proxy
|
|
longhorn_domain longhorn_identity@-->|HTTPS| longhorn_oauth_access
|
|
longhorn_oauth_access longhorn_entry@--> longhorn_oauth_proxy
|
|
grafana_domain grafana_identity@-->|HTTPS| grafana_oidc_access
|
|
grafana_oidc_access grafana_entry@--> monitoring_grafana
|
|
alerts_domain alerts_entry@-->|HTTPS| monitoring_alertmanager
|
|
quality_domain quality_identity@-->|HTTPS| quality_oauth_access
|
|
quality_oauth_access quality_entry@--> quality_oauth_proxy
|
|
keycloak_domain keycloak_identity@-->|HTTPS| keycloak_admin_access
|
|
keycloak_admin_access keycloak_entry@--> sso_keycloak
|
|
vault_domain vault_identity@-->|HTTPS| vault_oidc_access
|
|
vault_oidc_access vault_entry@--> vault_service
|
|
end
|
|
|
|
subgraph shared_plane["Shared Cluster Services"]
|
|
direction LR
|
|
|
|
subgraph ingress_plane["Ingress and Networking"]
|
|
direction TB
|
|
metallb_control["MetalLB<br/>Service addresses"]:::control
|
|
traefik_service["Traefik<br/>Load balancer"]:::support
|
|
traefik_controller["Traefik<br/>TLS and routing"]:::support
|
|
cert_manager["cert-manager"]:::support
|
|
cert_webhooks["Certificate webhooks"]:::support
|
|
metallb_control --> traefik_service
|
|
traefik_service --> traefik_controller
|
|
cert_webhooks --> cert_manager
|
|
cert_manager --> traefik_controller
|
|
end
|
|
|
|
subgraph shared_state["Shared State and Models"]
|
|
direction TB
|
|
postgres_service["Shared PostgreSQL<br/>Application and platform databases"]:::data
|
|
ai_ollama["Ollama<br/>Local model service"]:::support
|
|
default_zot_proxy["Zot access proxy"]:::oauth
|
|
end
|
|
|
|
subgraph maintenance_ns["maintenance"]
|
|
direction TB
|
|
maintenance_ariadne["Ariadne"]:::support
|
|
maintenance_metis_proxy["Metis proxy"]:::oauth
|
|
maintenance_metis["Metis"]:::support
|
|
maintenance_soteria_proxy["Soteria proxy"]:::oauth
|
|
maintenance_soteria["Soteria"]:::support
|
|
maintenance_node_ops["Node operations"]:::ephemeral
|
|
maintenance_jobs["Repair and migration jobs"]:::ephemeral
|
|
maintenance_metis_proxy --> maintenance_metis
|
|
maintenance_soteria_proxy --> maintenance_soteria
|
|
maintenance_ariadne --> maintenance_node_ops
|
|
maintenance_ariadne --> maintenance_jobs
|
|
end
|
|
|
|
subgraph telemetry_services["Additional Telemetry"]
|
|
direction TB
|
|
climate_typhon["Typhon<br/>Tent climate"]:::support
|
|
sui_metrics["SUI metrics"]:::support
|
|
end
|
|
end
|
|
|
|
subgraph external_systems["Host and Physical Systems"]
|
|
direction LR
|
|
ananke_hosts["Ananke<br/>titan-db and titan-24"]:::external
|
|
pyrphoros["Pyrphoros UPS"]:::external
|
|
statera["Statera UPS"]:::external
|
|
tent_system["AC Infinity<br/>Controller and cloud"]:::external
|
|
ananke_hosts --> pyrphoros
|
|
ananke_hosts --> statera
|
|
end
|
|
|
|
firefly_synced_access firefly_directory@-.-> sso_openldap
|
|
wger_synced_access wger_directory@-.-> sso_openldap
|
|
jellyfin_ldap_access jellyfin_directory@-.-> sso_openldap
|
|
|
|
website_backend website_model@-.-> ai_ollama
|
|
website_backend website_automation@-.-> maintenance_ariadne
|
|
hermes_chat hermes_chat_model@-.-> hermes_model_gate
|
|
hermes_agent hermes_jenkins@-.-> jenkins_service
|
|
hermes_agent hermes_metrics@-.-> monitoring_victoria
|
|
hermes_agent hermes_ariadne@-.-> maintenance_ariadne
|
|
|
|
gitea_http gitea_jenkins@-.->|SCM webhook| jenkins_service
|
|
gitea_http gitea_flux@-.->|Flux webhook| flux_webhook
|
|
jenkins_agents jenkins_gitea@-.->|Clone and fetch| gitea_http
|
|
jenkins_agents jenkins_quality@-.->|Quality scan| quality_sonarqube
|
|
jenkins_agents jenkins_harbor@-.->|Images and artifacts| harbor_registry
|
|
flux_source flux_gitea@-.->|Desired state| gitea_ssh
|
|
flux_image_reflector flux_harbor@-.->|Image metadata| harbor_registry
|
|
flux_image_automation flux_commit@-.->|Manifest update| gitea_ssh
|
|
flux_kustomize flux_apps@-.-> application_delivery
|
|
flux_kustomize flux_personal@-.-> personal_delivery
|
|
flux_kustomize flux_platform@-.-> platform_delivery
|
|
|
|
application_state_clients app_postgres@-.-> postgres_service
|
|
personal_state_clients personal_postgres@-.-> postgres_service
|
|
platform_state_clients platform_postgres@-.-> postgres_service
|
|
cloud_nextcloud nextcloud_mail@-.->|Mail delivery| mail_protocols
|
|
|
|
quality_exporter quality_metrics@-.-> monitoring_victoria
|
|
sui_metrics sui_telemetry@-.-> monitoring_victoria
|
|
monitoring_victoria ananke_telemetry@-.-> ananke_hosts
|
|
climate_typhon climate_source@--> tent_system
|
|
climate_typhon climate_telemetry@-.-> monitoring_victoria
|
|
|
|
class portal_identity,portal_chat_identity,cassandra_identity,element_identity,matrix_identity,budget_identity,firefly_identity,wolf_identity,wger_identity,chat_identity,jellyfin_identity,cloud_identity,outline_identity,planka_identity,gitops_identity,gitea_atlas_identity,gitea_cassandra_identity,harbor_identity,hermes_identity,jenkins_identity,logs_identity,longhorn_identity,grafana_identity,quality_identity,keycloak_identity,vault_identity routeIngress
|
|
class portal_entry,portal_chat_entry,cassandra_entry,element_entry,matrix_entry,budget_entry,firefly_entry,wolf_entry,wger_entry,chat_entry,jellyfin_entry,cloud_entry,outline_entry,planka_entry,gitops_entry,gitea_atlas_entry,gitea_cassandra_entry,harbor_entry,hermes_entry,jenkins_entry,logs_entry,longhorn_entry,grafana_entry,quality_entry,keycloak_entry,vault_entry routeService
|
|
class matrix_api,call_entry,livekit_entry,turn_entry,moonlight_entry,pegasus_entry,mail_web_entry,mail_protocol_entry,office_entry,vaultwarden_entry,monero_entry,gitea_ssh_entry,harbor_registry_entry,alerts_entry routeDirect
|
|
class firefly_directory,wger_directory,jellyfin_directory routeAuth
|
|
class app_postgres,personal_postgres,platform_postgres,nextcloud_mail,climate_source routeData
|
|
class quality_metrics,sui_telemetry,ananke_telemetry,climate_telemetry routeTelemetry
|
|
class website_automation,hermes_ariadne,gitea_jenkins,gitea_flux,jenkins_gitea,jenkins_quality,jenkins_harbor,flux_gitea,flux_harbor,flux_commit,flux_apps,flux_personal,flux_platform routeControl
|
|
class website_model,hermes_chat_model,hermes_jenkins,hermes_metrics routeInternal
|
|
end
|
|
|
|
classDef domain fill:#16324f,stroke:#6cb6ff,color:#ffffff
|
|
classDef user fill:#173f2b,stroke:#61d095,color:#ffffff
|
|
classDef support fill:#30343b,stroke:#aab2bf,color:#ffffff
|
|
classDef data fill:#3b2f52,stroke:#b79cff,color:#ffffff
|
|
classDef ephemeral fill:#4a301e,stroke:#f0a35b,color:#ffffff,stroke-dasharray:6 3
|
|
classDef control fill:#3b354e,stroke:#c1a7ff,color:#ffffff
|
|
classDef access fill:#213a56,stroke:#6cb6ff,color:#ffffff
|
|
classDef oauth fill:#3b2f52,stroke:#c1a7ff,color:#ffffff
|
|
classDef directory fill:#344a2d,stroke:#8ed081,color:#ffffff
|
|
classDef external fill:#44301f,stroke:#ffb86c,color:#ffffff
|
|
|
|
classDef linkIngress fill:#101820,stroke:#4ea1ff,color:#ffffff
|
|
classDef linkService fill:#101820,stroke:#61d095,color:#ffffff
|
|
classDef linkDirect fill:#101820,stroke:#e4bd55,color:#ffffff
|
|
classDef linkAuth fill:#101820,stroke:#c1a7ff,color:#ffffff
|
|
classDef linkData fill:#101820,stroke:#b79cff,color:#ffffff
|
|
classDef linkTelemetry fill:#101820,stroke:#55c8d3,color:#ffffff
|
|
classDef linkControl fill:#101820,stroke:#f0a35b,color:#ffffff
|
|
classDef linkInternal fill:#101820,stroke:#aab2bf,color:#ffffff
|
|
|
|
classDef routeIngress stroke:#4ea1ff,stroke-width:2.5px,color:#4ea1ff
|
|
classDef routeService stroke:#61d095,stroke-width:2.5px,color:#61d095
|
|
classDef routeDirect stroke:#e4bd55,stroke-width:2.5px,color:#e4bd55
|
|
classDef routeAuth stroke:#c1a7ff,stroke-width:2.2px,color:#c1a7ff,stroke-dasharray:6 4
|
|
classDef routeData stroke:#b79cff,stroke-width:2.2px,color:#b79cff,stroke-dasharray:6 4
|
|
classDef routeTelemetry stroke:#55c8d3,stroke-width:2.2px,color:#55c8d3,stroke-dasharray:6 4
|
|
classDef routeControl stroke:#f0a35b,stroke-width:2.2px,color:#f0a35b,stroke-dasharray:6 4
|
|
classDef routeInternal stroke:#aab2bf,stroke-width:2px,color:#aab2bf,stroke-dasharray:5 4
|
|
|
|
style system fill:#000000,stroke:#8b95a5,stroke-width:2px
|
|
style legend fill:#050505,stroke:#6d7485,stroke-width:1.5px
|
|
style application_band fill:#02030d,stroke:#55c8d3,stroke-width:2px
|
|
style personal_band fill:#06030d,stroke:#8ed081,stroke-width:2px
|
|
style platform_band fill:#07040c,stroke:#c1a7ff,stroke-width:2px
|
|
style shared_plane fill:#080604,stroke:#e4bd55,stroke-width:2px
|
|
style external_systems fill:#080402,stroke:#ffb86c,stroke-width:2px
|