direction: right

mac: "macOS host loopback" {
  public: ":8080 Worker + S3 traffic"
  management: ":9090 Wrangler API · :9080 identity · :9060 quotas"
  portals: "console.ermahgerd.localhost:8081 · admin.ermahgerd.localhost:8082"
  operator: ":3000 Grafana · :9091 Prometheus"
}

control: "control-01" {
  haproxy: "HAProxy :80"
  api: "Control / identity / quotas / Access APIs"
  access: "Access gateway\nbrowser + service authentication"
  console: "Tenant + admin BFFs\nseparate audiences and cookies"
  dpa: "Data Plane API\nloopback only"
  warehouse: "Artifact warehouse\nroot-owned"
}

compute: "compute-01 + compute-02" {
  pool: "8 shared workerd pool members\nprivate WireGuard listeners"
  isolate: "Dynamic Worker isolate" {
    bindings: "explicit same-org capabilities"
    outbound: "public-only network capability\nprivate ranges denied"
    no_platform: "no management or artifact capability"
  }
}

data: "data-01 + data-02" {
  services: "storage · assets · queues · key-value · databases"
  state: "service-owned filesystem state\nnot mounted into compute"
}

observe: "observe-01" {
  backends: "Prometheus · Loki · Tempo · Grafana"
}

wg: "WireGuard 10.77.0.0/24" {
  policy: "full mesh · per-node keys\nUFW admits service ports only on wg0"
  underlay: "Lima user-v2 is untrusted transport"
}

mac.public -> control.haproxy: "explicit Lima forward"
mac.management -> control.api: "explicit Lima forwards"
mac.portals -> control.console: "host-only session cookies"
mac.operator -> observe.backends: "explicit Lima forwards"
control.api -> control.dpa: "loopback only"
control.api -> compute.pool: "leased scheduled-event delivery over wg0"
control.haproxy -> compute.pool: "trusted routing headers over wg0"
control.haproxy -> control.access: "protected hostname + application ID"
control.access -> control.haproxy: "private token-gated return listener"
compute.pool -> compute.isolate: "Worker Loader creates V8 isolate"
compute.isolate.bindings -> data.services: "dispatcher-mediated scoped calls over wg0"
compute.pool -> control.api: "runtime token over wg0"
compute.pool -> control.warehouse: "systemd InaccessiblePaths" {style.stroke-dash: 4}
compute.pool -> data.state: "no filesystem path" {style.stroke-dash: 4}
compute.isolate.no_platform -> control.dpa: "no capability" {style.stroke-dash: 4}
control -> wg
compute -> wg
data -> wg
observe -> wg

boundary: "Guarantee boundary" {
  text: "Workers sharing a member rely on workerd/V8 isolation.\nTwo systemd-hardened compute hosts bound host-level blast radius.\nThis is not VM-grade isolation between Workers on one member."
}