documents/topology.architecture.json

Rama main · réplica de lectura del repositorio original.

{
  "schema_version": 1,
  "diagram_type": "architecture",
  "meta": {
    "title": "Docker homelab architecture",
    "quality_profile": "showcase",
    "repository": {
      "url": "https://github.com/bolens/homelab",
      "revision": "71c6aa5f84f733c257f7277799e90beef3e3ab1b"
    },
    "views": [
      { "id": "public-ingress", "label": "Public ingress", "focus": ["clients", "cloudflare", "caddy", "apps"], "note": "Public HTTPS crosses the optional Cloudflare tunnel, then Caddy routes by hostname to an attached stack." },
      { "id": "private-ingress", "label": "Private ingress", "focus": ["clients", "remote", "caddy", "apps"], "note": "VPN and mesh clients reach the same Caddy routing layer without using the public tunnel." },
      { "id": "selected-egress", "label": "Selected VPN egress", "focus": ["apps", "gluetun", "internet"], "note": "Only selected application stacks send outbound traffic through Gluetun and its VPN provider." },
      { "id": "operate-and-observe", "label": "Operate and observe", "focus": ["apps", "telemetry", "operations"], "note": "Observability reads workload signals while management, updates, and backups act on selected stacks." }
    ]
  },
  "components": [
    { "id": "clients", "type": "external", "label": "Clients", "sublabel": "LAN and Internet", "pos": [40, 300], "size": [130, 64], "sources": [{ "path": "documents/topology.yaml", "line": 315, "end_line": 331, "label": "client ingress relations" }] },
    { "id": "cloudflare", "type": "cloud", "label": "Cloudflare Tunnel", "sublabel": "Optional public ingress", "pos": [210, 150], "size": [160, 68], "sources": [{ "path": "documents/topology.yaml", "line": 10, "end_line": 14, "label": "ingress inventory" }] },
    { "id": "remote", "type": "security", "label": "Remote access", "sublabel": "Headscale / WireGuard / NetBird", "pos": [210, 450], "size": [180, 72], "sources": [{ "path": "documents/topology.yaml", "line": 16, "end_line": 24, "label": "VPN inventory" }] },
    { "id": "caddy", "type": "security", "label": "Caddy", "sublabel": "Reverse proxy :80 / :443", "pos": [450, 300], "size": [180, 72], "sources": [{ "path": "documents/topology.yaml", "line": 10, "end_line": 14, "label": "reverse proxy inventory" }] },
    { "id": "apps", "type": "backend", "label": "Application stacks", "sublabel": "Isolated Compose projects", "pos": [700, 300], "size": [180, 72], "sources": [{ "path": "documents/topology.yaml", "line": 26, "label": "application categories" }] },
    { "id": "shared", "type": "backend", "label": "Shared services", "sublabel": "DNS / mail / storage / AI", "pos": [700, 120], "size": [180, 68], "sources": [{ "path": "documents/topology.yaml", "line": 250, "end_line": 304, "label": "infrastructure inventory" }] },
    { "id": "gluetun", "type": "security", "label": "Gluetun", "sublabel": "Selected container egress", "pos": [930, 120], "size": [160, 68], "sources": [{ "path": "documents/topology.yaml", "line": 306, "end_line": 308, "label": "selected VPN egress" }] },
    { "id": "internet", "type": "external", "label": "Internet", "sublabel": "Outbound providers", "pos": [1160, 120], "size": [150, 64], "sources": [{ "path": "documents/topology.yaml", "line": 346, "end_line": 353, "label": "provider egress relation" }] },
    { "id": "telemetry", "type": "backend", "label": "Observability", "sublabel": "Prometheus / Loki / Grafana", "pos": [700, 500], "size": [190, 72], "sources": [{ "path": "documents/topology.yaml", "line": 267, "end_line": 290, "label": "observability inventory" }] },
    { "id": "operations", "type": "backend", "label": "Operations", "sublabel": "Portainer / updates / backup", "pos": [960, 500], "size": [190, 72], "sources": [{ "path": "documents/topology.yaml", "line": 285, "end_line": 304, "label": "operations inventory" }] }
  ],
  "boundaries": [
    { "kind": "region", "label": "Docker host", "wraps": ["caddy", "apps", "shared", "gluetun", "telemetry", "operations"], "pad": 28 },
    { "kind": "security-group", "label": "Ingress networks", "wraps": ["caddy", "apps"], "pad": 16 }
  ],
  "connections": [
    { "id": "public-ingress", "from": "clients", "to": "cloudflare", "label": "HTTPS", "variant": "emphasis" },
    { "id": "tunnel-to-caddy", "from": "cloudflare", "to": "caddy", "label": "tunnel", "variant": "emphasis" },
    { "id": "local-ingress", "from": "clients", "to": "caddy", "label": "local HTTP(S)", "variant": "emphasis", "labelAt": [300, 378] },
    { "id": "remote-access", "from": "clients", "to": "remote", "label": "VPN / mesh", "variant": "security" },
    { "id": "remote-to-caddy", "from": "remote", "to": "caddy", "label": "private access", "variant": "security" },
    { "id": "proxy-routing", "from": "caddy", "to": "apps", "label": "hostname routing", "variant": "emphasis", "labelAt": [665, 386] },
    { "id": "app-dependencies", "from": "apps", "to": "shared", "label": "DNS / SMTP / S3 / models", "variant": "dashed" },
    { "id": "vpn-egress", "from": "apps", "to": "gluetun", "label": "selected egress", "variant": "security" },
    { "id": "provider-egress", "from": "gluetun", "to": "internet", "label": "VPN provider", "variant": "security" },
    { "id": "telemetry-collection", "from": "apps", "to": "telemetry", "label": "metrics / logs / probes", "variant": "dashed", "fromSide": "bottom", "toSide": "top" },
    { "id": "stack-management", "from": "operations", "to": "apps", "label": "manage / update / back up", "variant": "dashed", "labelAt": [1020, 405] }
  ],
  "cards": [
    { "dot": "cyan", "title": "Ingress", "items": ["Caddy is the common HTTP(S) entry point", "Public tunnel and private network paths stay distinct"] },
    { "dot": "violet", "title": "Isolation", "items": ["Each stack remains an independent Compose project", "Shared networks are opt-in contracts"] },
    { "dot": "emerald", "title": "Operations", "items": ["Telemetry observes workloads", "Management and backup tools act on selected stacks"] }
  ]
}