diff --git a/.github/assets/architecture.svg b/.github/assets/architecture.svg index 4edbb0e60..2cf76995a 100644 --- a/.github/assets/architecture.svg +++ b/.github/assets/architecture.svg @@ -1,225 +1,114 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - SPINIFEX ARCHITECTURE - AWS SDK → Gateway → NATS → Service daemons - stateless · message-driven · horizontally scalable - - - - CLIENTS - Standard AWS tooling — unmodified, no shims, no custom SDK - - - - aws-cli - - - Terraform - - - boto3 - - - aws-sdk-go - - - kubectl - - - Packer - - - your application - - - - - - HTTPS · SigV4 · :9999 - - - - AWS GATEWAY - spinifex/services/awsgw · TLS termination · SigV4 verification · IAM policy eval · NATS routing - - - - TLS 1.3 - - - SigV4 auth - - - policy eval - - - req routing - - - rate-limit - - - audit log - - - - - - NATS BUS - ec2.* ebs.* s3.* vpc.* iam.* - queue groups · fan-out · request/reply - - - - - - - - - - - - - - - ec2.* daemon - - RunInstances - TerminateInstances - QMP · cloud-init - - - - - - ebs.* daemon - - CreateVolume - AttachVolume - snapshots · WAL - - - - - - s3.* daemon - - PutObject · GetObject - Multipart · presigned - erasure-coded - - - - - - vpc.* daemon - - Subnets · SGs · RTs - ALB · NAT · IGW - OVN · OVS - - - - - - iam.* daemon - - Users · Roles · Keys - Policy evaluation - audit trail - - - - - - - - - - - - - - BACKEND RESOURCES · local hardware · no cloud dependency - - - - - - QEMU / KVM - hypervisor - host kernel · virtio - - - - - - Viperblock - block storage - NVMe WAL · NBD - - - - - - Predastore - object storage - Reed–Solomon - - - - - - OVN / OVS - SDN fabric - overlays · flow rules - - - - - - Identity store - users · keys · rules - local · audit-logged - - - - - - - Queue groups load-balance ops across daemon replicas. - Fan-out (no queue group) dispatches describe calls to every node. - - - Daemons are stateless — scale horizontally by starting more. - No etcd, no Kubernetes, no external control plane. Systemd units, a NATS cluster, and your hardware. - - - + + + +SPINIFEX ARCHITECTURE +stateless · message-driven · horizontally scalable +AWS SDK → Gateway → NATS → service daemons + +CLIENTS +Standard AWS tooling, unmodified. No shims, no custom SDK. + +aws-cli + +Terraform + +boto3 + +aws-sdk-go + +kubectl + +Packer + +your app + + +HTTPS · SigV4 · :9999 + + +AWS GATEWAY +spinifex/services/awsgw · TLS termination · SigV4 verification · IAM policy eval · NATS routing + +TLS 1.3 + +SigV4 auth + +policy eval + +req routing + +rate-limit + +audit log + + + +NATS BUS +ec2.* ebs.* s3.* vpc.* iam.* +queue groups · fan-out · request/reply + + + + + + +ec2.* daemon + +RunInstances +TerminateInstances +QMP · cloud-init + +ebs.* daemon + +CreateVolume +AttachVolume +snapshots · WAL + +s3.* daemon + +PutObject · GetObject +Multipart · presigned +erasure-coded + +vpc.* daemon + +Subnets · SGs · RTs +ALB · NAT · IGW +OVN · OVS + +iam.* daemon + +Users · Roles · Keys +Policy evaluation +audit trail + + + + + + +BACKEND RESOURCES · local hardware · no cloud dependency + +QEMU / KVM +hypervisor +host kernel · virtio + +Viperblock +block storage +NVMe WAL · NBD + +Predastore +object storage +Reed-Solomon + +OVN / OVS +SDN fabric +overlays · flow rules + +Identity store +users · keys · rules +local · audit-logged + +Queue groups load-balance ops across daemon replicas. Fan-out (no queue group) dispatches describe calls to every node. +Daemons are stateless: scale horizontally by starting more. No etcd, no Kubernetes, no external control plane. Systemd units, a NATS cluster, and your hardware. + \ No newline at end of file diff --git a/README.md b/README.md index 6d939ff36..a6a03bd49 100644 --- a/README.md +++ b/README.md @@ -75,7 +75,7 @@ Spinifex is a minimal VM orchestration layer built on top of QEMU, exposing APIs ## Architecture at a Glance

- Spinifex message-driven architecture — AWS Gateway, NATS bus, service daemons + Spinifex message-driven architecture: standard AWS clients call the AWS Gateway over HTTPS with SigV4, which publishes to a NATS bus answered by stateless ec2/ebs/s3/vpc/iam daemons over local backends.

Every AWS API call is authenticated at the gateway, published to a NATS subject, and answered by whichever daemon claims it. Daemons are stateless — scale horizontally by starting more. No etcd, no Kubernetes, no external control plane. Deep dive: **[`docs/DESIGN.md`](docs/DESIGN.md)**.