meta/architecture-docs/Fediversity-architecture-notes.md

graph TB

subgraph Management
    A[Nix-panel] --> I
    Z[(central database<br/>Netbox)]--> B[Orchestrator<br/>NixOps] --> D[Proxmox]
    B --> E[Nix-configuration]
    B --> G[DNS]
    B --> F[Email]
    B --> J[Garage]
    B --> H[<b>IdentityManagement</b><br/><small>Authentication<br/>Authorization<br/>Accounting</small>]
    I[Nix-Panel API] --> Z
    H --> I
    Core[<b>Core-services</b><br/><small>DNS<br/>Email<br/>identity_management<br/>secret_management<br/>authentication<br/>SASL</small>]
end


subgraph Hardware
    Systems[<b>Systems</b><br/><small>Storage<br/>Networking<br/>Operating-system<br/>Virtualization</small>]
    Storage[<b>Storage</b><br/><small>exclusive_filesystem<br/>shared_blob Garage<br/>zfs</small>]
end

subgraph Virtualization
    Nixos[<b>Nixos</b><br/><small>Application</small>]
    LinuxOS[<b>LinuxOS</b><br/><small>Application</small>]

    Services[<b>Services</b><br/><small>Edumeet<br/>NextCloud<br/>secure_document_collaboration<br/>Forgejo<br/>webmail<br/>HedgeDoc<br/>project_planning</small>]
    FediServices[<b>FediServices</b><br/><small>Matrix<br/>Pixelfed<br/>Peertube<br/>Mastadon<br/>Owncast<br/>Castopod<br/>activityPub</small>]
end


Systems --> Storage
Hardware --> Virtualization
Virtualization --> Hardware
Services --> Core
FediServices --> Core
Core --> Hardware
Nixos --> Services
Nixos --> FediServices
F --> Core
G --> Core
J --> Storage
D --> Virtualization
E --> Nixos
H --> Core

• human-centric
• easy, automated, replication and migration to different datacenter provider
• blob storage replicated generically
• files on the exclusive filesystems replicated via application-aware process, e.g.:
  • asynchronous, but "live" database replication
  • shutdown app then rsync directories
  • ZFS replication and snapshot-ing
• Strengths, Weaknesses, Opportunities, and Threats awareness for all apps
• Not everything needs to start on Nix, NixOs, or with NixOps
• Do not use "Open Core"
  • GitLab
  • Dovcot
  • Zimbra
• LXC containers (not Docker-style)
• zfs-snapshots + replicatie (send/receive)
• s3 replicatie naar 3rd party
• locatie-mirorring? (buiten scope?)
• (maar dan Linstore op zfs)

Working session: Architecture discussion

Attendees: Robert, Valentin, Koen, Kevin

• Robert: NixOps should handle backup creation and restore, since it knows all the details for that
  • There will be an interface to plug Nix expressions with scripts that can access all the resources
  • Once should be able to build domain-specific applications around that
  • Valentin: Backups seem to be morally equivalent to deployments "to a file"
• Koen walked us through myprotagio.nl
  • Kevin will share source code with Valentin
  • It's a role-based-permission and billing UI wrapping PowerDNS, Postfix Admin, and InvoiceNinja
    • Written in Laravel and Tailwind
  • To build a UI for deployment we'd primarily need a REST API to a database
    • Primary work would be to do the architecture and design
  • Valentin: Maybe we could add just the APIs for the deployment workflows from a completely new service, and connect the front-end to that
    • Won't have to touch the PHP then
      • But for the full integration to work one will have to understand the whole system anyway
        • At that point one may as well keep maintaining it or rewrite it
      • Koen: The existing thing needs work regardless, and would like to move away from PHP to Python anyway

Architecture meeting

• Identitymanagement == AAA
• Central database is two databases, one accounting and one state
• Datamodel -> dns, aaa, ip, machines, etc.
• Data complete first, model later
• Data flows/processes
• Describe casestories
• Nixos -> VM
• LinuxOS out of scope
• Services and Fediservices one box
• move secretsmanagement
• move core-services to management