---
# System prepended metadata

title: Network architecture

---

# Network architecture

We have 3 VMs (amar, akbar, anthony :wink:) and 10 IPs.

I initially planned to host services on these machines based on their specs, but I'm just gonna make a docker swarm and use one or two of them as entry for traffic.

The reverse proxy is [traefik](https://traefik.io), seems to work well with swarm mode as well.

A tentative list of services:
1. [x] traefik
2. [x] backend server
3. frontend server
   - [x] api docs (static site)
5. blog (likely wordpress)
6. docker registry
7. gitlab [CI runner](https://docs.gitlab.com/runner/)
8. admin services
   + [prometheus](https://prometheus.io/) for parsing and querying logs
   + [grafana](https://grafana.com) for visuals
   + [swarmpit.io](https://swarmpit.io) for swarm monitoring
9. Some JIRA, bugzilla equivalent:
   + [osticket](https://osticket.com) I'm impressed :100: 
   + [bugzilla](https://bugzilla.org)

## Best plan of action
traefik runs on amar, that's our entrypoint.
Simply launching another docker image with traefik labels will register it with traefik.

Priority (highest first)
1. docker registry (registry.placements.iitb.ac.in)
2. prometheus
3. grafana
4. gitlab CI runner
5. swarmpit.io
6. osticket

A good starting point for traefik configuration:
```yml
version: '3.7'

volumes:
  cinder_prod_db:

services:
  traefik:
    image: 'traefik:latest'
    command:
      - '--log.level=INFO'
      - '--api'
      - '--providers.docker'
      - '--providers.docker.exposedbydefault=false'
      - '--providers.file.directory=/traefik/'
      - '--providers.file.watch=true'
      - '--entrypoints.websecure.address=:443'
      - '--entrypoints.web.address=:80'
    ports:
      - '80:80'
      - '443:443'
    labels:
      traefik.enable: 'true'
      traefik.http.routers.catchall.entrypoints: web
      traefik.http.routers.catchall.rule: 'HostRegexp(`{host:.+}`)'
      traefik.http.routers.catchall.middlewares: 'redirect_https'

      # Dashboard
      traefik.http.routers.traefik.rule: ${DASHBOARD_RULE}
      traefik.http.routers.traefik.entrypoints: websecure
      traefik.http.routers.traefik.tls: 'true'
      traefik.http.routers.traefik.service: api@internal
      traefik.http.routers.traefik.middlewares: auth@file

      # Middlewares
      traefik.http.middlewares.redirect_https.redirectscheme.scheme: https
      # Middlewares from file
      # 1. auth: basicAuth

    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock:ro'
      - './traefik:/traefik' # This holds config.yml
      
  whoami: # backend
    image: 'containus/whoami'
    labels:
      traefik.enable: 'true'
      traefik.http.routers.cinder.rule: ${WHOAMI_RULE}
      traefik.http.routers.cinder.tls: 'true'
      traefik.http.routers.cinder.entrypoints: websecure
    environment:
      NODE_ENV: production
      TYPEORM_HOST: db
      TYPEORM_PORT: 5432
      TYPEORM_USERNAME: ${TYPEORM_USERNAME}
      TYPEORM_PASSWORD: ${TYPEORM_PASSWORD}
      TYPEORM_DATABASE: ${TYPEORM_DATABASE}
    depends_on:
      - db

  db:
    image: postgres:12-alpine
    volumes:
      - cinder_prod_db:/var/lib/postgresql/data
    ports:
      - '5432:5432'
    environment:
      POSTGRES_USER: ${TYPEORM_USERNAME}
      POSTGRES_PASSWORD: ${TYPEORM_PASSWORD}
      PGDATA: /var/lib/postgresql/data/pgdata
      POSTGRES_DB: ${TYPEORM_DATABASE}
    restart: always

```

Add more stuff to this!