Platform architecture¶

Forgejo organizations¶

Org / namespace	Repos	Purpose
`infra`	`devops`	VPS platform (Traefik, Forgejo, Woodpecker, Plane, Uptime Kuma, Netdata, DefectDojo)
`rafael.gonzalez.albes`	`portfolio`	Principal site — rafaelgonzalezalbes.com
`bioscan`	`bioscancheck` (paused — not deployed)	Legacy product org; repo may exist, not in active CI/monitoring

Git source of truth: Forgejo only (git.rafaelgonzalezalbes.com).

Servers¶

Server	IP	Role
Infra VPS	`85.215.32.166`	Platform only (Forgejo, Woodpecker server, Uptime Kuma, Netdata, DefectDojo, docs)
Apps VPS	`82.165.177.110`	Application runtime (WearLab live; DroneColonies, cat tree planned) — Traefik + `/opt/apps`
IONOS web hosting	—	Static frontends (portfolio SFTP) + apex/www

SSH aliases after local setup: bioscan-vps (infra — legacy alias name), apps-vps (apps). Details: Apps VPS.

Future hosting (not started)

Planned move off IONOS compute + web hosting to Hetzner dual VPS, Cloudflare DNS, and portfolio on infra: Migrate VPS off IONOS. Cost notes: Products, domains & legal.

Product portfolio, subdomain vs branded-domain strategy, and legal phases: Products, domains & legal.

Planned platform capability — idea intake → approve → ticket → PR → CI → ship: Idea → Done conductor · Implementation Blueprint.

Idea → Done Conductor (ship.*)

Central orchestrator status: Architecture & Blueprint v1.1.0 complete. Phase 1 Golden-Path dry-run verified. Target host: ship.rafaelgonzalezalbes.com.

Plane stack

Plane UI (pm.*), bridge (bridge.*), and MCP (mcp.*) DNS still point at the infra VPS, but deploy-platform.sh skips the Plane stack by default (ENABLE_PLANE_STACK=false). Re-enable when ready: ENABLE_PLANE_STACK=true bash scripts/deploy-platform.sh on the infra VPS.

HTTPS versions (TLS / HTTP/2 / HTTP/3): TLS and HTTP versions.

DNS (IONOS)¶

Infra VPS — `85.215.32.166`¶

Host	Target	Service
`git`	Infra VPS	Forgejo
`ci`	Infra VPS	Woodpecker UI
`ci-grpc`	Infra VPS	Woodpecker gRPC for remote agents (optional; tunnel mode works without DNS)
`pm`	Infra VPS	Plane
`mcp`	Infra VPS	Plane MCP server (Cursor)
`bridge`	Infra VPS	plane-forge-bridge (Forgejo ↔ Plane)
`status`	Infra VPS	Uptime Kuma
`metrics`	Infra VPS	Netdata (host + Docker metrics)
`security`	Infra VPS	DefectDojo
`secrets`	Infra VPS	Infisical (secrets manager)
`docs`	Infra VPS	MkDocs static site
apex / `www`	IONOS	Portfolio (and other static sites)

Apps VPS — `82.165.177.110`¶

Host	Target	Service
`wearlab`	Apps VPS	WearLab (`alex/wearlab-main`) — live
`bioscan`	—	BioScanCheck — not deployed (do not point DNS)
`dronecolonies`	Apps VPS	DroneColonies (planned)
`cats`	Apps VPS	Cat tree (planned)

Full IONOS click-through steps: DNS.

VPS paths¶

Path	Source repo
`/opt/devops`	`infra/devops` (infra VPS)
`/opt/devops/site`	MkDocs build output (nginx on infra VPS)
`/opt/apps/{app}`	Per-app `deploy/` on apps VPS

CI/CD flows¶

Woodpecker server stays on the infra VPS; agents are split by workflow labels (infra-vps vs apps-vps). See Woodpecker agents.

Static site (portfolio)¶

flowchart LR
  Push[push main] --> WP[Woodpecker]
  WP --> Build[npm build]
  Build --> SFTP[SFTP upload]
  SFTP --> IONOS[IONOS dist]
  IONOS --> Site[rafaelgonzalezalbes.com]

Woodpecker does not deploy through the VPS filesystem for static sites — it SFTPs directly to IONOS.

Full-stack (wearlab)¶

flowchart LR
  Push[push main] --> WP[Woodpecker apps-vps agent]
  WP --> Test[npm test / docker build]
  Test --> FE[SFTP frontend dist optional]
  Test --> Docker[build-push image]
  Docker --> SSH[SSH docker compose pull]
  SSH --> Apps[/opt/apps on apps VPS]

Woodpecker build steps run on the apps VPS agent (labels: location: apps-vps). Deploy uses SSH to deploy@82.165.177.110.

Observability (centralized)¶

Do not run duplicate status.*, metrics.*, or security.* on the apps VPS or IONOS. One stack on the infra VPS covers both servers:

Tool	URL	Host	Covers
Uptime Kuma	`status.*`	Infra VPS	HTTP/ping/TCP for platform + both VPSes + app URLs
Netdata	`metrics.*`	Infra VPS (parent)	Host + Docker metrics; apps VPS streams as child
DefectDojo	`security.*`	Infra VPS	CI scan findings from all repos (infra + apps agents)

IONOS hosts static sites only (portfolio SFTP) — it cannot run these tools.

flowchart LR
  subgraph infra [Infra VPS]
    Kuma[status.*]
    Netdata[metrics.* parent]
    DD[security.*]
  end
  subgraph apps [Apps VPS]
    AppsStacks[wearlab bioscan …]
    NDChild[Netdata child]
  end
  Kuma -->|probes| infra
  Kuma -->|probes| apps
  NDChild -->|stream :19999| Netdata
  Woodpecker[Woodpecker CI] -->|upload scans| DD

Runbooks: Monitoring · Metrics · Security scanning

Platform (infra/devops)¶

flowchart LR
  Push[push main] --> WP[Woodpecker]
  WP --> Docs[mkdocs build]
  Docs --> Rsync[rsync to VPS]
  Rsync --> Deploy[deploy-platform.sh]
  Deploy --> Stack[Traefik Forgejo Woodpecker Kuma Netdata DefectDojo bridge MCP docs]

Public discoverability¶

Asset	Hosted on	Search engines
Portfolio website	IONOS	Allowed — `index, follow`, sitemap
Platform tools (`git`, `ci`, `pm`, `status`, `metrics`, `security`, `mcp`, `bridge`, `docs`)	VPS	Blocked — Traefik `noindex` middleware
Portfolio git repo	Forgejo	Public — browsable without login
Other git repos (`bioscan/`, `infra/`)	Forgejo	Private — login required

Portfolio git repo is public on Forgejo; the built site on IONOS is also public.