Architecture Overview

graph TD
    Browser["Browser / Vue Client"] -->|HTTP + WS| Caddy["Caddy Gateway :80"]
    IoT["IoT Sensors (Simulated)"] -->|HTTP POST| Caddy

    subgraph gateway-net [Shared Gateway Network]
        Caddy -->|/gateway/*| CG["claims-gateway :3000"]
        Caddy -->|"/tenancy/* (forward_auth)"| TS["tenancy-service :3000"]
        Caddy -->|"/twin/* (forward_auth)"| Twin["twin-service :3000"]
        Caddy -->|"/notification/* (forward_auth)"| Notif["notification-service :3000"]
        Caddy -->|"/socket.io/* (forward_auth)"| Socket["socket-server :3000"]
        Caddy -->|"/sensor/* (forward_auth, ingest exempt)"| Sensor["sensor-service :3000"]
        Caddy -->|"/chat/* (forward_auth)"| Chat["chat-service :3000"]
        Caddy -->|/agent/* - no gate| Agent["agent-service :3000"]
        Caddy -->|/contracts, /contracts/*| Contracts["contracts-service :3000"]

        Notif -->|PUBLISH| Redis[("Redis Broker")]
        Socket -->|SUBSCRIBE| Redis
        Contracts --- Redis
    end

    RegSvc["registry-service :3000"]
    ProvSvc["provisioner<br/>(no inbound route)"]
    ProvSvc -->|"HMAC-signed, internal"| RegSvc
    ProvSvc -->|"HMAC-signed, internal"| TS

    subgraph tenancy-net [Tenancy Private Network]
        TS --- TenancyDB[("tenancy-db PostgreSQL")]
    end

    subgraph registry-net [Registry Private Network]
        RegSvc --- RegistryDB[("registry-db PostgreSQL")]
    end

    subgraph twin-net [Twin Private Network]
        Twin --- TwinDB[("twin-db MongoDB")]
    end

    subgraph notification-net [Notification Private Network]
        Notif --- NotifDB[("notification-db MongoDB")]
    end

    subgraph sensor-net [Sensor Private Network]
        Sensor --- SensorDB[("sensor-db MongoDB")]
    end

    subgraph chat-net [Chat Private Network]
        Chat --- ChatDB[("chat-db MongoDB")]
    end

    subgraph contracts-net [Contracts Private Network]
        Contracts --- ContractsDB[("contracts-service-db MongoDB")]
    end

    subgraph agent-net [Agent Private Network]
        Agent --- AgentDB[("agent-db PostgreSQL / pgvector")]
    end

graph TD
    Browser["Browser / Vue Client"] -->|HTTP port 80| LB["k3d LoadBalancer"]
    Simulator["Sensor Simulator (external Docker)"] -->|HTTP POST| LB

    LB --> IGW["Istio Gateway (Envoy)<br/>auto-provisioned: crowdvision-gateway-istio"]

    subgraph crowdvision ["Namespace: crowdvision — Istio ambient, ztunnel mTLS STRICT on every pod"]
        IGW -->|"RequestAuthentication: JWT verified once<br/>outputPayloadToHeader to x-gateway-claims"| HR{{"Gateway API HTTPRoutes"}}

        HR -->|/gateway| CGSvc["claims-gateway"]
        HR -->|/tenancy| TSSvc["tenancy-service"]
        HR -->|/twin| TwinSvc["twin-service"]
        HR -->|/sensor| SensorSvc["sensor-service"]
        HR -->|/notification| NotifSvc["notification-service"]
        HR -->|/chat| ChatSvc["chat-service"]
        HR -->|/socket.io| SocketSvc["socket-service"]
        HR -->|"/agent (excluded from JWT gate)"| AgentSvc["agent-service"]
        HR -->|/contracts| ContractsSvc["contracts-service"]
        HR -->|"/ catch-all"| ClientSvc["client"]

        RegSvc["registry-service"]
        ProvSvc["provisioner<br/>(no Gateway route)"]
        ProvSvc -->|"HMAC-signed, in-mesh"| RegSvc
        ProvSvc -->|"HMAC-signed, in-mesh"| TSSvc

        TSSvc --- TenancyDB[("tenancy-db StatefulSet")]
        RegSvc --- RegistryDB[("registry-db StatefulSet")]
        TwinSvc --- TwinDB[("twin-db StatefulSet")]
        NotifSvc --- NotifDB[("notification-db StatefulSet")]
        SensorSvc --- SensorDB[("sensor-db StatefulSet")]
        ChatSvc --- ChatDB[("chat-db StatefulSet")]
        ContractsSvc --- ContractsDB[("contracts-service-db StatefulSet")]

        SocketSvc -->|SUBSCRIBE| RedisPod[("Redis Deployment")]
        NotifSvc -->|PUBLISH| RedisPod
        ContractsSvc --- RedisPod
    end