SecureServer/docs/Filesystem_and_Directory_Structure.md

Filesystem & Directory Structure

graph TD
    Root["/server/websites/"]

    %% Root Configuration & State Files
    StateFile[".engine-settings\n(Persisted: RUNTIME, PROXY_TYPE, SSH_PORT, GRAFANA_PASS)"]
    ScriptExec["/usr/local/bin/wp-engine.sh\n(Self-contained installer & provisioner)"]
    Root --- StateFile
    Root --- ScriptExec

    %% Core Shared Stack
    subgraph CoreDir["/server/websites/core/"]
        CoreEnv[".env (DB_ROOT_PASSWORD, REDIS_PASSWORD, NEXT_REDIS_INDEX)"]
        CoreCompose["docker-compose.yml (core_mariadb + core_redis)"]
        CoreConfig["config/mariadb/99-performance.cnf"]
        CoreDataMariaDB[("data/mariadb/ (Persistent MySQL data)")]
        CoreDataRedis[("data/redis/ (Persistent Redis dump)")]

        CoreEnv --- CoreCompose
        CoreCompose --- CoreConfig
        CoreCompose --- CoreDataMariaDB
        CoreCompose --- CoreDataRedis
    end
    Root --> CoreDir

    %% Proxy Stack
    subgraph ProxyDir["/server/websites/proxy/"]
        ProxyCompose["docker-compose.yml (ingress_proxy)"]
        ProxyData["data/ (NPM state / Caddy data)"]
        ProxyLE["letsencrypt/ (acme.json / certs)"]
        ProxyLogs["logs/access.log (Scanned by bare-host Fail2ban)"]
        ProxyCaddy["Caddyfile (If Caddy selected; dynamically updated)"]

        ProxyCompose --- ProxyData
        ProxyCompose --- ProxyLE
        ProxyCompose --- ProxyLogs
        ProxyCompose --- ProxyCaddy
    end
    Root --> ProxyDir

    %% Monitoring Stack
    subgraph MonDir["/server/websites/monitoring/"]
        MonCompose["docker-compose.yml (Prometheus, Node Exp, cAdvisor, Grafana)"]
        PromConfig["prometheus/prometheus.yml"]
        GrafanaProv["grafana/provisioning/datasources/prometheus.yaml"]
        MonData["prometheus_data / grafana_data (Named Volumes)"]

        MonCompose --- PromConfig
        MonCompose --- GrafanaProv
        MonCompose --- MonData
    end
    Root --> MonDir

    %% Template Stack
    subgraph TemplateDir["/server/websites/template/"]
        SiteTemplate["docker-compose.site.yml (Standard WP Compose definition)"]
    end
    Root --> TemplateDir

    %% Tenant Sites
    subgraph SitesDir["/server/websites/sites/"]
        subgraph SiteA["mysite/"]
            SiteAEnv[".env (Scoped DB user, password, Redis DB index)"]
            SiteACompose["docker-compose.yml"]
            SiteAConfig["config/wordpress.ini (OPcache, upload limits)"]
            SiteAData[("data/wp/ (Full WordPress document root)")]

            SiteAEnv --- SiteACompose
            SiteACompose --- SiteAConfig
            SiteACompose --- SiteAData
        end

        subgraph SiteB["teetimeprints/"]
            SiteBCompose["... (Identical isolated structure)"]
        end
    end
    Root --> SitesDir

    %% Host-level configurations
    subgraph HostConfig["Host-Level Configs (/etc/)"]
        F2BJail["/etc/fail2ban/jail.d/ingress-wordpress.local"]
        F2BFilter["/etc/fail2ban/filter.d/ingress-wordpress.conf"]
        UFWChain["/etc/ufw/after.rules (DOCKER-USER isolation chain)"]
        SSHDDropin["/etc/ssh/sshd_config.d/99-hardened.conf"]
    end

    ScriptExec -.->|Deploys & Controls| HostConfig

    %% Styling
    classDef dir fill:#eceff1,stroke:#455a64,stroke-width:2px,color:#263238;
    classDef compose fill:#e1f5fe,stroke:#0288d1,stroke-width:1px,color:#01579b;
    classDef data fill:#fff8e1,stroke:#ffa000,stroke-width:1px,color:#ff6f00;

    class Root,CoreDir,ProxyDir,MonDir,TemplateDir,SitesDir,SiteA,SiteB dir;
    class CoreCompose,ProxyCompose,MonCompose,SiteTemplate,SiteACompose compose;
    class CoreDataMariaDB,CoreDataRedis,SiteAData,MonData data;
    ```