Skip to main content

Architecture

This section covers Soverstack platform architecture, design decisions, and conventions.

Contents

  1. Overview - High-level architecture
  2. Infrastructure Tiers - local vs production vs enterprise
  3. VM ID Ranges - Reserved ID conventions
  4. Network Design - Network architecture
  5. Security Model - Zero-trust security

Architecture Principles

1. Layer-Based Design

Infrastructure is organized into independent layers:

2. High Availability by Default

Production and enterprise tiers require HA for all critical services:

  • Minimum 3 servers for quorum
  • Redundant VMs for each service
  • Automatic failover

3. Zero-Trust Security

  • All access through VPN (Headscale)
  • OIDC enforced for authentication
  • No direct SSH to VMs
  • Secrets in OpenBao/Vault

4. Infrastructure as Code

  • Declarative YAML configuration
  • Version controlled
  • Reproducible deployments
  • Audit trail

Component Overview

ComponentPurposeHA Mechanism
VyOSFirewallVRRP
HeadscaleVPNLB + shared DB
PostgreSQLDatabasePatroni + etcd
KeycloakIAMInfinispan cluster
OpenBaoSecretsRaft consensus
PrometheusMonitoringDual scrape
GrafanaDashboardsLB + shared DB

Next Steps

Start with Overview for a high-level understanding.