# Runtime Architecture & Network Topology

```mermaid
flowchart TD
    %% Internet & External Ingress
    User([WAN / Client Traffic]) -->|Port 80 / 443| IngressRule
    Attacker([Malicious Actor / Brute Force]) -.->|wp-login / xmlrpc / exploits| IngressRule

    %% Bare Host Hardening & Security Layer
    subgraph BareHost["Bare Proxmox / Debian Host"]
        IngressRule["Host Firewall: nftables / UFW\n(Deny All Incoming except 80, 443, 3000, 48222)"]
        SSHD["Hardened OpenSSH\n(Port 48222)"]
        F2B["Fail2ban Engine\n(jail: ingress-wordpress, sshd)"]
        LogWatcher[("/server/websites/proxy/logs/*.log")]
        
        IngressRule -->|Port 48222| SSHD
        LogWatcher -->|Inspects Access Logs| F2B
        F2B -->|Bans IP via UFW / nftables| IngressRule
    end

    %% Ingress Proxy Tier
    subgraph NetProxy["Docker / Podman Network: proxy-net (External)"]
        IngressProxy["Ingress Reverse Proxy\n(Caddy / Traefik v3 / NPM)"]
        IngressRule -->|Forward 80/443| IngressProxy
        IngressProxy -.->|Writes Client Access Logs| LogWatcher
    end

    %% WordPress Multi-Tenant Tier
    subgraph NetBackend["Docker / Podman Network: shared-backend (Isolated)"]
        subgraph Tenant1["Tenant: Site 1 (e.g. teetimeprints)"]
            WP1["WordPress 6.7 Container\n(PHP 8.3 / Apache)"]
            RedisDropin1["Redis Object Cache Drop-in\n(Key Salt: teetimeprints_)"]
            WP1 --- RedisDropin1
        end

        subgraph Tenant2["Tenant: Site N (e.g. kellcreations)"]
            WPN["WordPress Container\n(PHP 8.3 / Apache)"]
            RedisDropinN["Redis Object Cache Drop-in\n(Key Salt: siteN_)"]
            WPN --- RedisDropinN
        end

        %% Centralized Core Data Tier
        subgraph CoreData["Centralized Core Stack"]
            CoreDB[("core_mariadb\n(MariaDB 11.4)\n- Isolated DB per site\n- Scoped DB user per site\n- Buffer Pool: 2GB")]
            CoreRedis[("core_redis\n(Redis 7 Alpine)\n- DB Index 0..15 per site\n- Maxmemory: 512MB / LRU")]
        end

        WP1 -->|MySQL: Port 3306| CoreDB
        WP1 -->|TCP: Port 6379 / DB 0| CoreRedis
        WPN -->|MySQL: Port 3306| CoreDB
        WPN -->|TCP: Port 6379 / DB N| CoreRedis
    end

    %% Proxy to WP App Connections
    IngressProxy -->|Reverse Proxy / HTTPS Term| WP1
    IngressProxy -->|Reverse Proxy / HTTPS Term| WPN

    %% Observability Stack
    subgraph NetMon["Docker / Podman Network: monitoring-net (Isolated)"]
        NodeExp["node_exporter:9100\n(Host CPU, RAM, Disk I/O)"]
        CAdvisor["cadvisor:8080\n(Per-container cgroup usage)"]
        Prometheus[("prometheus:9090\n(Time Series DB)")]
        Grafana["grafana:3000\n(Pre-provisioned Dashboards)"]

        NodeExp -->|Scraped| Prometheus
        CAdvisor -->|Scraped| Prometheus
        Prometheus -->|Datasource| Grafana
    end

    IngressRule -->|Port 3000| Grafana

    %% Styling
    classDef security fill:#ffebee,stroke:#c62828,stroke-width:2px,color:#b71c1c;
    classDef proxy fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#1b5e20;
    classDef app fill:#e3f2fd,stroke:#1565c0,stroke-width:2px,color:#0d47a1;
    classDef db fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#e65100;
    classDef monitor fill:#f3e5f5,stroke:#6a1b9a,stroke-width:2px,color:#4a148c;

    class F2B,IngressRule,SSHD security;
    class IngressProxy proxy;
    class WP1,WPN app;
    class CoreDB,CoreRedis db;
    class Grafana,Prometheus,NodeExp,CAdvisor monitor;
    ```