Skip to content
Curt Phillips, home

Systems blueprint

A real platform, drawn as it runs.

This is my production cloud: fourteen edge apps, one identity provider, a byte store that spans the edge and on-prem servers, nightly backups, and an autonomous runner that ships the code. The names are generic on purpose; the shape is exact. Select a node to read what it does and what it talks to.

The blueprint draws here. The index below is the same map.

Every node

The index.

The same map as a list, zone by zone. Each entry is what the canvas says when you select it.

People & devices

Who reaches the platform, and through what.

  • Operator

    One administrator: the control plane, the runner's queue and every operator-tier app.

    SessionAccess JWT

  • Tenant users

    Provisioned identities in one directory; each app admits by tier.

    TiersGrants

  • Browsers & PWAs

    Every app is a web page; some keep a service worker for offline use.

    PWAService workerSigned URLs

Edge & identity

One DNS zone, one identity provider, a zero-trust door, and the cache.

  • DNS zone & routes

    One zone; each app is a proxied hostname routed to its Worker.

    DNSWorker routes

  • Edge ingress

    TLS, caching and security headers before any request meets an app.

    TLSCache rulesHeaders

  • Zero-trust gate

    A door in front of the door: the control plane and every stage host sit behind it.

    Identity-aware proxyService tokens

  • Identity provider

    One sign-in for every app; sessions, resets and two-factor codes.

    WorkerSQLite-class DBService binding

Application tier

Fourteen Workers, each with its own database and a stage that holds no real accounts.

  • Application Workers

    15 production Workers: media libraries, an atlas, a vault, a console and more.

    WorkersHonoReactDurable Objects

  • Operations console

    The operator's view of every workspace: queues, runners, traffic, cost, alerts.

    WorkerDurable ObjectWebSocket

  • Stage tier

    12 stage Workers: the same build, a second database, no real accounts.

    EnvironmentsSmokeBrowser walk

  • This site

    Prerendered pages served by one Worker, proven live by its commit.

    WorkerStatic assetsPrerender

Persistence

Per-app databases, object storage, a byte store that spans the edge and on-prem servers.

  • Per-app databases

    11 SQLite-class databases, every statement bound to its tenant.

    D1SQLiteMigrations

  • Object storage

    Customer files keyed by tenant; cold media tenants rest here too.

    R2S3-compatibleB2

  • Byte store

    One service for every app's media: edge cache, tunnel, local disk, object pools.

    Edge gateTunnelSQLite index

  • Key-value & analytics

    Rate-limit namespaces, OAuth grants, a request data point per app.

    KVRate limitsAnalytics Engine

On-prem servers

Hardened local servers: tunnels, the byte store's origin, scheduled jobs, secrets.

  • Compute servers

    Hardened workstation-class servers: the byte store's origin and every scheduled job.

    launchdTwo rootsBun

  • Tunnels

    Outbound-only connectors; the servers accept no inbound connection.

    cloudflaredOutbound only

  • Scheduled jobs

    56 registered jobs that ingest, encode, link, audit and back up, each with a log.

    launchdDerived roster

  • Sealed secrets

    Every token a deploy reads, mode 0600, under the state root, backed up daily.

    Env files0600Redaction

Autonomous engineering

A queue, a runner, a gate and a locked deploy. The code ships itself.

  • Task queue

    Work enters as a Markdown file; its folder is its state.

    MarkdownGit-committed

  • Autonomous runner

    Wakes every five minutes, claims a batch, runs an agent, files what it could not finish.

    Claude CodelaunchdOne at a time

  • Gate

    One command runs types, lint, design law, tenancy, secrets, docs, tests and the build.

    ChecksTestsBudgets

  • Locked deploy

    Gate, migrate, deploy stage, smoke, deploy production, prove the live commit.

    wranglerLock/healthz

  • Model context & inference

    MCP servers, an assistant that cites and never writes, transcription, edge inference.

    MCPWorkers AIWhisperAI Gateway

Backups & observability

What survives losing a piece, and what tells the owner before a user does.

  • Nightly backups

    Every database pulled home, the state root encrypted and pushed off-site.

    NightlyageOff-site

  • Watches

    Every public hostname asked from outside every five minutes; alerts on two channels.

    ProbesMailPhone

  • Resource registry

    Every host, job, zone and cloud resource in one table that a gate reads.

    RegistryTwo-way check

Outside services

Third parties the platform calls, each behind one adapter.

  • Transactional mail

    Sign-in, reset and two-factor codes; every runner alert.

    ResendCarrier gateway

  • Federated identity

    Google OAuth for sign-in and connected mail and calendar.

    OAuth 2.0OIDC

  • Model provider

    The model every batch agent and assistant runs on.

    ClaudeClaude Code

  • Media & data APIs

    Video libraries, music search, maps, subtitles, IP geography.

    AdaptersCaching in DB

  • Package registry & source host

    Libraries shared by published version; every repo pushed to a private remote.

    npmGit

Reading the map

What it proves.

Boundaries are functions

Tenant isolation, the secrets rule and the production-auth rule are each one module every call passes through, and a gate fails when something goes around it.

Nothing listens inbound

The on-prem servers dial out through tunnels. The control plane sits behind a zero-trust door. Tests reach stage with a token and can never touch production accounts.

The code ships itself

A task is a file. A runner claims it, an agent builds it, a gate proves it, a locked deploy lands it, and production says which commit it runs.