diff --git a/assets/architecture-trust-depth.svg b/assets/architecture-trust-depth.svg index 95425ae..4600d64 100644 --- a/assets/architecture-trust-depth.svg +++ b/assets/architecture-trust-depth.svg @@ -1,4 +1,4 @@ -
WAN
untrusted
Edge Firewall
LAN Browsers
User-Facing Proxy
mTLS + SSO
INSIDE THE NETWORK — not automatically trusted
App Host
Internal Proxy Zone
app-to-app
Automation Host
Host Firewall
per-flow rule
File Server
Two independent entry paths — public (red) and LAN-facing (blue) — both terminate at backend services. Once inside, traffic between hosts still crosses its own boundary: app-to-app (green) through the Internal Proxy Zone, non-HTTP infra traffic (yellow) through the Host Firewall. Being "inside the network" was never automatically trusted.
Public ingress
LAN-facing ingress
App-to-app (east-west)
LAN infra-to-infra
 \ No newline at end of file +
WAN
untrusted
Edge Firewall
LAN Browsers
User-Facing Proxy
mTLS + SSO
INSIDE THE NETWORK — not automatically trusted
App Host
Internal Proxy Zone
app-to-app
Automation Host
Host Firewall
per-flow rule
File Server
Two independent entry paths — public (red) and LAN-facing (blue) — both terminate at backend services. Once inside, traffic between hosts still crosses its own boundary: app-to-app (green) through the Internal Proxy Zone, non-HTTP infra traffic (yellow) through the Host Firewall. Being "inside the network" was never automatically trusted.
Public ingress
LAN-facing ingress
App-to-app (east-west)
LAN infra-to-infra
 \ No newline at end of file