diff --git a/assets/architecture-overview.svg b/assets/architecture-overview.svg index 6bda5dc..188188c 100644 --- a/assets/architecture-overview.svg +++ b/assets/architecture-overview.svg @@ -1,4 +1,4 @@ -
Internet
Edge Firewall
LAN
Internal DNS
two zones
Vault
PKI + secrets
File Server
User-Facing Proxy
mTLS
Automation VM
Git + orchestration
App Host
41 stacks
Monitoring
Security Monitoring
Internal Proxy Zone
SSO
proxies
auth
 \ No newline at end of file +
Internet
Edge Firewall
LAN
Internal DNS
two zones
Vault
PKI + secrets
File Server
User-Facing Proxy
mTLS
Automation VM
Git + orchestration
App Host
41 stacks
Monitoring
Security Monitoring
Internal Proxy Zone
SSO
proxies
auth
 \ No newline at end of file diff --git a/assets/trust-boundaries-blast-radius.svg b/assets/trust-boundaries-blast-radius.svg index e0386eb..9f33787 100644 --- a/assets/trust-boundaries-blast-radius.svg +++ b/assets/trust-boundaries-blast-radius.svg @@ -1,4 +1,4 @@ -
pfSense
Edge Firewall + Public HAProxy
Proxmox Node A
day-to-day applications
Internal Caddy
app-to-app zone
Docker Apps
LXC host, most of the fleet's stacks
Proxmox Node B
trust & sensitive infrastructure
Caddy VM
browser zone, mTLS
Vault + Technitium DNS
trust backbone
public traffic (direct, bypasses everything else)
app-to-app traffic
browser traffic
issues certs
issues certs
 \ No newline at end of file +
pfSense
Edge Firewall + Public HAProxy
Proxmox Node A
day-to-day applications
Internal Caddy
app-to-app zone
Docker Apps
LXC host, most of the fleet's stacks
Proxmox Node B
trust & sensitive infrastructure
Caddy VM
browser zone, mTLS
Vault + Technitium DNS
trust backbone
public traffic (direct, bypasses everything else)
app-to-app traffic
browser traffic
issues certs
issues certs
 \ No newline at end of file