Fleet management platform
A bigger model in the style of a real platform page: three zones, a hub-and-spoke tunnel, grids of services, planned work in dashed outline, and scenarios that cross all of it. The names are invented.
Things to try:
- Pick One read request, end to end. It opens as a swimlane story, with eight lanes and five phases.
- Open One device for a single machine and how it connects back to the hub.
- Press Hide planned to remove everything that is not built yet.
- Zoom with Ctrl or ⌘ and scroll, or use full screen. With a diagram this size the camera follows the action while a scenario plays.
A central management stack, a hub that terminates tunnels, and many devices, each one physical machine running its own VM and services. Dashed items are planned.
The whole platform. Hover a box or a line to follow it, click a box for details, or pick a scenario to watch a job travel.
Scenario
HTTP request / responsePersistent channel (websocket, gRPC)Overlay tunnelDashed: planned
Loading diagram…
| Key | From → To | Kind | Auth | What travels |
|---|---|---|---|---|
| A | Operator browser → nginx · mgmt-proxy | http | Identity session (OIDC) | management UI and API calls |
| B | nginx · mgmt-proxy → identity | http | none (public login pages) | OIDC redirects and token endpoint |
| C | nginx · mgmt-proxy → control-api | http | agent API key | agent websocket upgrade |
| D | nginx · mgmt-proxy → management-backend | http | bearer JWT | UI host and REST API |
| E | management-backend → control-api | http | service token | jobs, tunnels, policies |
| F | management-backend → vision-api | http | — | inference requests |
| G | management-backend → management-iot | http | — | device telemetry queries |
| H | management-backend → Hub · gateway | http | mTLS | calls forwarded to a device |
| I | Hub · gateway → nginx · mgmt-proxy | channel | agent API key | control websocket |
| J | management-backend ↔ Hub · gateway | channel | mTLS | config and state sync |
| K | Hub · gateway ↔ Gateway VM · spoke | tunnel | IPsec / WireGuard / OpenVPN | all management traffic |
| L | Hub · gateway ↔ More spokes × N | tunnel | — | — |
| M | Gateway VM · spoke → nginx (device) | http | — | forwarded management calls |
| N | Local operator → nginx (device) | http | device realm session | device UI |
| O | nginx (device) → dx-backend | http | — | device app and API |
| P | dx-backend ↔ Gateway VM · spoke | channel | — | job relay |
| Q | dx-backend → VMS | http | — | container lifecycle |
The source is diagram.yaml plus three files in scenarios/. It uses rows and packed groups, lanes and hidden edges.