Skip to main content

Infrastructure Architecture

tupynambalucas.dev utilizes a Kubernetes-native orchestration pipeline and an edge-to-cluster reverse proxy architecture to handle TLS termination, Zero Trust security, and request routing across bounded contexts.

1. Kubernetes Manifest Layout​

Workspaces that support Kubernetes deployment use a Kustomize-based directory layout mirroring their layered structure. All configurations reside within the centralized infrastructure bounded context.

  • Path Schema:
    • infrastructure/environments/<env>/<context> (Kustomize Overlays)
    • infrastructure/manifests/<context>.yaml (Deployments + Services + Ingress)
  • Application: Used universally across all contexts (platform, cortex, studio).

2. Reverse Proxy & Request Routing​

We use an edge-to-cluster reverse proxy architecture to handle public and internal request routing.

2.1. Cloudflare Tunnel & Edge Topology​

Public access to local and remote Kubernetes development environments is provided via Cloudflare Tunnel (cloudflared) integrated with Cloudflare Zero Trust:

  • Edge TLS Termination: Cloudflare Edge terminates public HTTPS for *-dev.tupynambalucas.dev using single-level wildcard SSL/TLS certificates (*.tupynambalucas.dev).
  • Encrypted Tunnel Transport: Traffic travels from Cloudflare Edge to the cluster via an encrypted QUIC connection handled by the cloudflared deployment in the platform namespace.
  • Traefik Ingress Controller: cloudflared forwards requests internally to Traefik on port 80 (http://traefik.platform.svc.cluster.local:80), which routes HTTP/gRPC payloads to target Services based on standard Kubernetes Ingress resources.

2.2. Authoritative Development Domain Scheme​

All development services adopt a single-level hyphenated subdomain structure (*-dev.tupynambalucas.dev) to ensure 100% compatibility with free Universal SSL certificates:

Domain HostTarget ServiceNamespacePurpose
agentgateway-dev.tupynambalucas.devagentgateway:15000cortexAgentGateway Admin UI & Control Plane
agentgateway-mcp-dev.tupynambalucas.devagentgateway:8080cortexDirect MCP Ingress Endpoint (/mcp)
grafana-dev.tupynambalucas.devgrafana:3000platformGrafana Observability Dashboard
headlamp-dev.tupynambalucas.devheadlamp:80platformHeadlamp Kubernetes Dashboard
traefik-dev.tupynambalucas.devtraefik:8082platformTraefik Ingress Dashboard
penpot-dev.tupynambalucas.devpenpot-frontend:8080studioPenpot Design Tool
memos-dev.tupynambalucas.devmemos:5230studioMemos Note-taking App
docs.tupynambalucas.devCloudflare PagesExternalDocusaurus Technical Documentation Hub

2.3. Cloudflare Access & Zero Trust Policies​

To secure development endpoints exposed via Cloudflare Tunnel:

  • Web Dashboards (Grafana, Headlamp, Traefik, AgentGateway Admin): Protected by Cloudflare Access Email / One-Time PIN (OTP) policies. Only authorized developer email addresses receive authentication PINs.
  • AI & MCP Endpoints (agentgateway-mcp-dev.tupynambalucas.dev): Configured with a Bypass policy or Service Token authentication in Cloudflare Zero Trust with tunnel routing directed to /mcp. This enables non-browser clients (such as AI agents, CLI tools, and automated pipelines) to exchange JSON-RPC / SSE payloads without encountering interactive browser login redirects.