85 lines
3.4 KiB
Markdown
85 lines
3.4 KiB
Markdown
# Runtime Architecture & Network Topology
|
|
|
|
```mermaid
|
|
flowchart TD
|
|
%% Internet & External Ingress
|
|
User([WAN / Client Traffic]) -->|Port 80 / 443| IngressRule
|
|
Attacker([Malicious Actor / Brute Force]) -.->|wp-login / xmlrpc / exploits| IngressRule
|
|
|
|
%% Bare Host Hardening & Security Layer
|
|
subgraph BareHost["Bare Proxmox / Debian Host"]
|
|
IngressRule["Host Firewall: nftables / UFW\n(Deny All Incoming except 80, 443, 3000, 48222)"]
|
|
SSHD["Hardened OpenSSH\n(Port 48222)"]
|
|
F2B["Fail2ban Engine\n(jail: ingress-wordpress, sshd)"]
|
|
LogWatcher[("/server/websites/proxy/logs/*.log")]
|
|
|
|
IngressRule -->|Port 48222| SSHD
|
|
LogWatcher -->|Inspects Access Logs| F2B
|
|
F2B -->|Bans IP via UFW / nftables| IngressRule
|
|
end
|
|
|
|
%% Ingress Proxy Tier
|
|
subgraph NetProxy["Docker / Podman Network: proxy-net (External)"]
|
|
IngressProxy["Ingress Reverse Proxy\n(Caddy / Traefik v3 / NPM)"]
|
|
IngressRule -->|Forward 80/443| IngressProxy
|
|
IngressProxy -.->|Writes Client Access Logs| LogWatcher
|
|
end
|
|
|
|
%% WordPress Multi-Tenant Tier
|
|
subgraph NetBackend["Docker / Podman Network: shared-backend (Isolated)"]
|
|
subgraph Tenant1["Tenant: Site 1 (e.g. teetimeprints)"]
|
|
WP1["WordPress 6.7 Container\n(PHP 8.3 / Apache)"]
|
|
RedisDropin1["Redis Object Cache Drop-in\n(Key Salt: teetimeprints_)"]
|
|
WP1 --- RedisDropin1
|
|
end
|
|
|
|
subgraph Tenant2["Tenant: Site N (e.g. kellcreations)"]
|
|
WPN["WordPress Container\n(PHP 8.3 / Apache)"]
|
|
RedisDropinN["Redis Object Cache Drop-in\n(Key Salt: siteN_)"]
|
|
WPN --- RedisDropinN
|
|
end
|
|
|
|
%% Centralized Core Data Tier
|
|
subgraph CoreData["Centralized Core Stack"]
|
|
CoreDB[("core_mariadb\n(MariaDB 11.4)\n- Isolated DB per site\n- Scoped DB user per site\n- Buffer Pool: 2GB")]
|
|
CoreRedis[("core_redis\n(Redis 7 Alpine)\n- DB Index 0..15 per site\n- Maxmemory: 512MB / LRU")]
|
|
end
|
|
|
|
WP1 -->|MySQL: Port 3306| CoreDB
|
|
WP1 -->|TCP: Port 6379 / DB 0| CoreRedis
|
|
WPN -->|MySQL: Port 3306| CoreDB
|
|
WPN -->|TCP: Port 6379 / DB N| CoreRedis
|
|
end
|
|
|
|
%% Proxy to WP App Connections
|
|
IngressProxy -->|Reverse Proxy / HTTPS Term| WP1
|
|
IngressProxy -->|Reverse Proxy / HTTPS Term| WPN
|
|
|
|
%% Observability Stack
|
|
subgraph NetMon["Docker / Podman Network: monitoring-net (Isolated)"]
|
|
NodeExp["node_exporter:9100\n(Host CPU, RAM, Disk I/O)"]
|
|
CAdvisor["cadvisor:8080\n(Per-container cgroup usage)"]
|
|
Prometheus[("prometheus:9090\n(Time Series DB)")]
|
|
Grafana["grafana:3000\n(Pre-provisioned Dashboards)"]
|
|
|
|
NodeExp -->|Scraped| Prometheus
|
|
CAdvisor -->|Scraped| Prometheus
|
|
Prometheus -->|Datasource| Grafana
|
|
end
|
|
|
|
IngressRule -->|Port 3000| Grafana
|
|
|
|
%% Styling
|
|
classDef security fill:#ffebee,stroke:#c62828,stroke-width:2px,color:#b71c1c;
|
|
classDef proxy fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#1b5e20;
|
|
classDef app fill:#e3f2fd,stroke:#1565c0,stroke-width:2px,color:#0d47a1;
|
|
classDef db fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#e65100;
|
|
classDef monitor fill:#f3e5f5,stroke:#6a1b9a,stroke-width:2px,color:#4a148c;
|
|
|
|
class F2B,IngressRule,SSHD security;
|
|
class IngressProxy proxy;
|
|
class WP1,WPN app;
|
|
class CoreDB,CoreRedis db;
|
|
class Grafana,Prometheus,NodeExp,CAdvisor monitor;
|
|
```
|