diff --git a/assets/trust-boundaries-blast-radius.svg b/assets/trust-boundaries-blast-radius.svg index f74b458..4e4e1b3 100644 --- a/assets/trust-boundaries-blast-radius.svg +++ b/assets/trust-boundaries-blast-radius.svg @@ -1,4 +1,4 @@ -
pfSense
Edge Firewall + Public HAProxy
Proxmox Node A
day-to-day applications
Internal Caddy
app-to-app zone
Docker Apps
LXC host, most of the fleet's stacks
Proxmox Node B
trust & sensitive infrastructure
Caddy VM
browser zone, mTLS
Vault + Technitium DNS
trust backbone
public traffic (direct, bypasses everything else)
app-to-app traffic
browser traffic
issues certs
issues certs
Three independent routing authorities, split across two physical nodes — a failure in any one only takes out its own third of the traffic.
 \ No newline at end of file +
pfSense
Edge Firewall + Public HAProxy
Proxmox Node A
day-to-day applications
Internal Caddy
app-to-app zone
Docker Apps
LXC host, most of the fleet's stacks
Proxmox Node B
trust & sensitive infrastructure
Caddy VM
browser zone, mTLS
Vault + Technitium DNS
trust backbone
public traffic (direct, bypasses everything else)
app-to-app traffic
browser traffic
issues certs
issues certs
 \ No newline at end of file