frontdesk — System Architecture

frontdesk — System Architecture An architecture diagram generated by Archify. Google / GitHub OAuth · Auth.js providers · Architecture component Google / GitHub OAuth Auth.js providers Requester & Staff · Browser · Architecture component Requester & Staff Browser web · Next.js + Auth.js · k3s on Hetzner cx23 · single node · form · tracking · staff UI web Next.js + Auth.js form · tracking · staff UI OpenRouter · Claude Haiku 4.5 · Architecture component · live · $10/mo cap OpenRouter Claude Haiku 4.5 live · $10/mo cap Cloudflare · WAF · Turnstile · Architecture component · ADR-0002 Cloudflare WAF · Turnstile ADR-0002 ingress-nginx · cert-manager · k3s on Hetzner cx23 · single node · F1 limit-rpm ingress-nginx cert-manager F1 limit-rpm Postgres · pgvector + pgmq · k3s on Hetzner cx23 · single node › RLS-scoped tenant data · RLS enforced Postgres pgvector + pgmq RLS enforced worker · Python · asyncpg · k3s on Hetzner cx23 · single node · single process worker Python · asyncpg single process Integration Partner · API client (F3) · Architecture component Integration Partner API client (F3) api · Fastify · k3s on Hetzner cx23 · single node · sole queue producer api Fastify sole queue producer AWS Bedrock · Claude Haiku 4.5 · Architecture component · switch-proof · not live AWS Bedrock Claude Haiku 4.5 switch-proof · not live Amazon SQS · LocalStack-tested · k3s on Hetzner cx23 · single node · switch-proof · not live Amazon SQS LocalStack-tested switch-proof · not live sealed-secrets · controller · k3s on Hetzner cx23 · single node · ciphertext in git sealed-secrets controller ciphertext in git frontdesk-db-migrate · Helm hook Job · k3s on Hetzner cx23 · single node · drizzle migrate + seed frontdesk-db-migrate Helm hook Job drizzle migrate + seed node-exporter · hostNetwork :9100 · k3s on Hetzner cx23 · single node node-exporter hostNetwork :9100 GitHub Actions · CI · review · deploy · Architecture component · 6 guardrails GitHub Actions CI · review · deploy 6 guardrails Prometheus + Grafana · VPS, off-node · Architecture component · ADR-0026 Prometheus + Grafana VPS, off-node ADR-0026 HTTPS POST /api/v1/orgs/:slug/requests TLS strict / and /api/auth /api OAuth sign-in (staff) submit intake (server-side) reads/writes via forOrg() enqueue via pgmq (send) dequeue (pgmq) · for_org() complete() — LLMProvider LLM_PROVIDER=bedrock QUEUE_PROVIDER=sqs SealedSecret → Secret migrate + seed helm upgrade over the tailnet, images pinned by digest scrape :9100 over the tailnet k3s on Hetzner cx23 · single node RLS-scoped tenant data

Request path & tenancy

  • • One Ingress splits /api to Fastify; / and /api/auth to Next.js
  • • web submits through api server-side — api is the sole queue producer (ADR-0021)
  • • RLS compares org_id to current_org_id() on every tenant table (ADR-0018)

Switch-proof adapters

  • • LLM_PROVIDER swaps OpenRouter ↔ Bedrock behind one interface (ADR-0006)
  • • QUEUE_PROVIDER swaps pgmq ↔ SQS behind one interface (ADR-0004)
  • • A provider-parity CI job proves the unwired adapters still match

Delivery & operations

  • • Deploy runs only after CI is green on main, over the tailnet (ADR-0014)
  • • Secrets live in git as SealedSecret ciphertext, decrypted in-cluster
  • • Prometheus and Grafana run off-node, so graphs outlive the node (ADR-0026)