Talmazapublicv2

1# yaml-language-server: $schema=../../../schema/design.schema.json
2# Imported 2026-09-24 from source/Talmaza - 02.drawio.html, the user's own draw.io diagram
3# (HTML export; source/Talmaza - 02.drawio is the XML decoded from its data-mxgraph attribute).
4# Decisions, all recorded in mapping.yaml and notes.md:
5#   - Labels are the drawn text with line breaks joined by one space and runs of spaces collapsed.
6#   - Six dashed sub-frames (Secretless Layer, Monitoring & Alerts Tools, Storage, DB & Cache,
7#     AI, Secret Store) are visual clusters with no topology meaning; they are not groups. Their
8#     members are nodes in the VNet they are drawn in.
9#   - All sixteen drawn arrows end on a frame, not a box, at one end or both. Each such end is
10#     attached to the box nearest the point where the arrow meets the frame, except where the
11#     diagram's own text names the end ("dialed OUTBOUND by cloudflared"). Every choice is in
12#     mapping.yaml.
13#   - The Cloudflare Tunnel is a double-headed arrow, so two edges; protocol quic from its caption.
14#   - The cloudflared -> web pod / api pod arrows carry hostnames, not a protocol; http is assumed
15#     for the in-cluster hop.
16#   - Duplicate boxes (two cloudflared pods, two web pods, two api pods, two Service ClusterIP)
17#     are separate nodes, as drawn.
18#   - "Azure Alerts" maps to azure-monitor: the inventory lists Alerts as a feature of Azure
19#     Monitor, not a resource.
20#   - "External Systems" is an empty frame in the source; kept as an empty trust-zone group.
21schemaVersion: "1"
22type: "design"
23id: "talmaza"
24
25groups:
26  - { id: "cloudflare-edge", kind: "point-of-presence", label: "Cloudflare Edge" }
27  - { id: "microsoft-azure", kind: "region", label: "Microsoft Azure" }
28  - { id: "vnet", kind: "vpc", label: "VNet", parent: "microsoft-azure" }
29  - { id: "aks-cluster", kind: "system", label: "AKS cluster (private API server)", parent: "vnet" }
30  - { id: "ns-cloudflared", kind: "namespace", label: "ns: cloudflared — Deployment, 2+ replicas", parent: "aks-cluster" }
31  - { id: "ns-frontend", kind: "namespace", label: "ns: frontend", parent: "aks-cluster" }
32  - { id: "ns-api", kind: "namespace", label: "ns: api", parent: "aks-cluster" }
33  - { id: "external-systems", kind: "trust-zone", label: "External Systems" }
34  - { id: "system", kind: "system", parent: "vnet", label: "Secretless Layer" }
35  - { id: "system-2", kind: "system", parent: "vnet", label: "Egress" }
36  - { id: "system-3", kind: "system", parent: "vnet", label: "Storage" }
37  - { id: "system-6", kind: "system", parent: "vnet", label: "Monitoring & Alerts Tools" }
38  - { id: "system-4", kind: "system", parent: "vnet", label: "DB & Cache" }
39  - { id: "system-7", kind: "system", parent: "vnet", label: "Secret Store" }
40  - { id: "system-8", kind: "system", parent: "vnet", label: "Background Jobs & Triggers" }
41  - { id: "system-5", kind: "system", parent: "vnet", label: "AI" }
42
43nodes:
44  - { id: "applicant", component: "user-device", label: "Applicant" }
45  - { id: "visitor", component: "user-device", label: "Visitor" }
46  - { id: "ssl-tls-termination", component: "cloudflare-ssl-tls", label: "SSL / TLS termination (Full strict)", group: "cloudflare-edge", props: { encryptionMode: "full-strict" } }
47  - { id: "cdn", component: "cloudflare-cdn", label: "CDN", group: "cloudflare-edge" }
48  - { id: "waf", component: "cloudflare-waf", label: "WAF", group: "cloudflare-edge" }
49  - { id: "ddos-protection", component: "cloudflare-ddos-protection", label: "DDoS", group: "cloudflare-edge" }
50  - { id: "bot-detection", component: "cloudflare-bot-management", label: "Bot Detection", group: "cloudflare-edge" }
51  - { id: "rate-limiting", component: "cloudflare-rate-limiting", label: "Rate Limiting", group: "cloudflare-edge" }
52  - { id: "access", component: "cloudflare-access", label: "SSO - Admin Apps", group: "cloudflare-edge" }
53  - { id: "nsg", component: "azure-network-security-group", label: "NSG", group: "vnet", props: { defaultAction: "deny" } }
54  - { id: "key-vault-tunnel-token", component: "azure-key-vault", group: "vnet" }
55  - { id: "deployment", component: "k8s-deployment", group: "ns-cloudflared", props: { instances: 2 } }
56  - { id: "cloudflared", component: "cloudflare-tunnel", group: "ns-cloudflared", label: "cloudflared" }
57  - { id: "cloudflared-2", component: "cloudflare-tunnel", label: "cloudflared", group: "ns-cloudflared" }
58  - { id: "service-clusterip", component: "k8s-service", label: "Service ClusterIP", group: "ns-frontend", props: { serviceType: "cluster-ip" } }
59  - { id: "web-pod", component: "k8s-pod", label: "web pod", group: "ns-frontend" }
60  - { id: "web-pod-2", component: "k8s-pod", label: "web pod", group: "ns-frontend" }
61  - { id: "service-clusterip-2", component: "k8s-service", label: "Service ClusterIP", group: "ns-api", props: { serviceType: "cluster-ip" } }
62  - { id: "api-pod", component: "k8s-pod", label: "api pod", group: "ns-api" }
63  - { id: "api-pod-2", component: "k8s-pod", label: "api pod", group: "ns-api" }
64  - { id: "entra-id", component: "azure-entra-id", label: "Entra ID", group: "system" }
65  - { id: "managed-identity", component: "azure-managed-identity", label: "Managed Identity", group: "system" }
66  - { id: "azure-monitor", component: "azure-monitor", label: "Azure Monitor", group: "system-6" }
67  - { id: "log-analytics", component: "azure-log-analytics", label: "Log Analytics", group: "system-6" }
68  - { id: "azure-alerts", component: "azure-monitor", label: "Azure Alerts", group: "system-6" }
69  - { id: "communication-service", component: "azure-communication-services", label: "Communication Service", group: "system-6" }
70  - { id: "blob-storage", component: "azure-blob-storage", label: "Blob Storage", group: "system-3" }
71  - { id: "file-storage", component: "azure-files", label: "File Storage", group: "system-3" }
72  - { id: "table-storage", component: "azure-table-storage", label: "Table Storage", group: "system-3" }
73  - { id: "queue-storage", component: "azure-queue-storage", label: "Queue Storage", group: "system-3" }
74  - { id: "azure-sql", component: "azure-sql", label: "Azure SQL", group: "system-4" }
75  - { id: "redis", component: "azure-cache-for-redis", label: "Redis", group: "system-4" }
76  - { id: "cosmosdb", component: "azure-cosmos-db", label: "CosmosDB", group: "system-4" }
77  - { id: "key-vault-app-secrets", component: "azure-key-vault", label: "Key Vault App Secrets", group: "system-7" }
78  - { id: "azure-ai-foundary", component: "azure-ai-foundry", label: "Azure AI Foundary", group: "system-5" }
79  - { id: "ai-search", component: "azure-ai-search", label: "AI Search", group: "system-5" }
80  - { id: "azure-openai", component: "azure-openai", label: "Azure OpenAI", group: "system-5" }
81  - { id: "azure-container-registry", component: "azure-container-registry", group: "vnet" }
82  - { id: "azure-nat-gateway", component: "azure-nat-gateway", group: "system-2" }
83  - { id: "azure-public-ip", component: "azure-public-ip", group: "system-2" }
84  - { id: "azure-functions", component: "azure-functions", group: "system-8" }
85
86edges:
87  - { from: "applicant", to: "cloudflare-edge", protocol: "https", mode: "sync" }
88  - { from: "visitor", to: "cloudflare-edge", protocol: "https", mode: "sync" }
89  - { from: "cloudflare-edge", to: "aks-cluster", protocol: "quic", mode: "sync", label: "Cloudflare Tunnel" }
90  - { from: "ns-cloudflared", to: "ns-frontend", protocol: "http", mode: "sync", label: "talmaza.com" }
91  - { from: "ns-cloudflared", to: "ns-api", protocol: "http", mode: "sync", label: "api.talmaza.com" }
92  - { from: "ns-cloudflared", to: "key-vault-tunnel-token", protocol: "https", mode: "sync", label: "Secret Store" }
93  - { from: "aks-cluster", to: "system", protocol: "https", mode: "sync" }
94  - { from: "azure-container-registry", to: "aks-cluster", protocol: "http", mode: "sync" }
95  - { from: "system", to: "system-3", protocol: "http", mode: "sync" }
96  - { from: "system", to: "system-7", protocol: "http", mode: "sync" }
97  - { from: "system", to: "system-8", protocol: "http", mode: "sync" }
98  - { from: "system-5", to: "system-6", protocol: "http", mode: "sync" }
99  - { from: "system-5", to: "system-4", protocol: "http", mode: "sync" }
100  - { from: "system-5", to: "system-7", protocol: "http", mode: "sync" }
101  - { from: "system-5", to: "system-8", protocol: "http", mode: "sync" }
102  - { from: "aks-cluster", to: "system-2", protocol: "http", mode: "sync" }
103  - { from: "system", to: "system-4", protocol: "http", mode: "sync" }
104  - { from: "system", to: "system-6", protocol: "http", mode: "sync" }
105  - { from: "system-5", to: "system-3", protocol: "http", mode: "sync" }