Frozen document. Dates and status refer to its original source. Private resources and unreviewed images are unavailable.
Status: accepted two-stage topology in ADR 0010. Provider and price remain the owner gate #45. This is a prototype placement, not an availability or compliance architecture.
flowchart TB
subgraph Local[Stage 1: Mac development and certification]
LUI[React/Vite build] --> LG[Loopback HTTPS gateway]
LG --> LB[BFF and workers]
LB --> LK[Keycloak]
LB --> LC[Camunda]
LB --> LP[(PostgreSQL and private documents)]
LB --> LS[ClamAV and simulators]
end
CF[Contentful SaaS: bilingual authoring] -->|Versioned import| LB
subgraph Cloud[Stage 2: hosted prototype after local gate]
HUI[Hosted static UI origin] -->|HTTPS route| HG[VPS HTTPS gateway]
HG --> HB[BFF and workers]
HB --> HK[Keycloak]
HB --> HC[Camunda]
HB --> HP[(PostgreSQL and private documents)]
HB --> HS[ClamAV and simulators]
end
CF -->|Versioned import| HB
On the Mac, Docker Compose runs the real backend components where supported. The loopback gateway exercises the same-origin BFF/session path through HTTPS. Synthetic users, payments and legacy records are mandatory. Local acceptance traverses the UI and BFF against real Keycloak, Camunda, PostgreSQL and ClamAV, with a pinned Contentful release. Tests retain commands/results, redacted logs, resource measurements and a reproducible synthetic dataset. Numerical performance targets follow measured baselines.
After that gate, deploy the built SPA to a hosted HTTPS origin and the service stack to one cloud VPS. Keep database, engine, scanner, private storage and administrative endpoints off the public route. Verify the hosted callback, logout, cookie, CSRF and trusted-proxy behavior from the actual browser origin, then rerun critical journeys, upload, recovery, locale, persistence and security checks. A local pass cannot certify hosted DNS, TLS or reverse-proxy behavior.
No CloudFront/WAF/S3, ECS Fargate, multi-AZ failover or cloud purchase is assumed. A single VPS is one failure domain. Backups, secret handling, TLS, patching, capacity and restore proof are promotion work, not properties implied by the diagram. The current repository may contain partial local configuration ahead of those gates; the runtime guide gives the executable local path.