External Traffic
Internet
Public users, automated clients and internet traffic accessing externally published services.
Engineering Platform
A connected platform, not a collection of isolated tools.
A layered view of the engineering environment, showing how public traffic, access controls, execution platforms, workloads, observability and security fit together.
06Architecture layers
13Platform components
04Engineering principles
Architecture Overview
Follow the request path
Public traffic moves from the edge through controlled access into the engineering platforms and hosted workloads.
Platform Map
Architecture layers
Each layer groups related capabilities while retaining direct links to projects and live operational dashboards.
Online
DNS and Edge
Cloudflare
Provides public DNS, TLS proxying, edge protection and controlled exposure of internet-facing services.
Reverse Proxy
Nginx Proxy Manager
Routes public requests to internal services and manages HTTPS certificates and proxy-host configuration.
Identity and Access
Authelia
Protects selected services with authentication and multi-factor access policies.
Container Platform
Docker Platform
Hosts the portfolio, monitoring, authentication, security and application workloads using Docker Compose.
Container Orchestration
Kubernetes Platform
A K3s engineering environment using Traefik, MetalLB and Git-based deployment practices.
Cloud Engineering
AWS Cloud Platform
A modular Terraform-based cloud platform using remote state, IAM and reusable infrastructure components.
Astro Application
Engineering Portfolio
The public portfolio application presenting engineering projects, architecture and live operational evidence.
Specialist Workload
BirdNET-Go
Processes live audio to identify bird species and exports operational metrics for monitoring.
Metrics Collection
Prometheus
Scrapes and stores infrastructure, container, application and security metrics.
Visualisation and Alerting
Grafana
Provides operational dashboards, public telemetry views and alerting across the engineering platform.
Log Aggregation
Loki
Centralises platform and application logs for investigation and operational troubleshooting.
Threat Detection
CrowdSec
Analyses proxy logs, detects malicious behaviour and creates automated security decisions.
Traffic Enforcement
Linux Firewall
Applies CrowdSec decisions and drops traffic from known or locally detected malicious sources.
Design Principles
How the platform is engineered
Layered access
Public exposure is separated from internal workloads through Cloudflare, reverse proxying and identity controls.
Observable by default
Infrastructure and applications are connected to central metrics, logging, dashboards and operational alerts.
Automated protection
CrowdSec detections are translated into Linux firewall actions without requiring manual intervention.
Documented and repeatable
Git repositories, Docker Compose, Terraform and documented procedures make the environment reproducible and supportable.