How omprakash2929/appwrite-devsecops works
1. What this repository is
- This is not the Appwrite application codebase itself. It is a DevSecOps delivery repository that defines how Appwrite is built, scanned, packaged, deployed, and observed in Kubernetes.
- The repository’s main boundary is between CI/CD control and runtime infrastructure.
2. Primary control plane: Jenkins pipeline
- Jenkinsfile is the orchestration entrypoint.
- Jenkins handles the end-to-end flow: source checkout, static analysis, container build, vulnerability scanning, image publishing, Kubernetes deployment, verification, and notification.
- The pipeline integrates with SonarQube, Trivy, DockerHub, kubectl/Helm, and Slack.
3. Build and security gates
- SonarQube provides code-quality / SAST gating through sonar-project.properties.
- Trivy is used for security scanning of images and/or filesystem content, with findings influencing pipeline quality checks.
- These scans are part of the delivery path before the deployment is promoted to Kubernetes.
4. Container artifact boundary
- The deployable artifact is a Docker image pushed to DockerHub.
- The README indicates versioned tags are used, so the runtime cluster consumes immutable image references rather than building locally.
- This cleanly separates build-time concerns from cluster runtime.
5. Kubernetes application packaging
- helm/appwrite is the deployable package for the Appwrite workload.
- Chart.yaml defines chart metadata, values.yaml carries configurable parameters, and templates/ contains the Kubernetes manifests.
- The Helm chart is the primary abstraction for parameterized deployment of the Appwrite service.
6. Appwrite runtime workload
- helm/appwrite/templates/deployment.yaml defines the main Appwrite workload as a Kubernetes Deployment.
- service.yaml exposes it inside the cluster or externally depending on chart values.
- ingress.yaml routes external traffic into the Appwrite service through the cluster ingress layer.
7. Supporting data services
- The k8s/ directory contains standalone manifests for MariaDB, MongoDB, and Redis, plus a dedicated namespace.yaml.
- These are the stateful backing services Appwrite relies on for relational data, document data, and caching/queueing.
- This repo therefore has a clear split between the application tier (Helm chart) and stateful dependency tier (raw Kubernetes manifests).
8. Namespace and cluster boundary
- The namespace.yaml creates an isolated namespace for Appwrite resources.
- The supporting databases and cache are deployed as Kubernetes resources in the same cluster, but logically separated from monitoring and from the Jenkins control plane.
- The target environment described in the README is k3s, which makes the cluster a lightweight single-node or small-footprint Kubernetes runtime.
9. Observability stack
- monitoring/ defines the observability layer:
- servicemonitor.yaml connects Prometheus scraping to the Appwrite workload.
- alert-rules.yaml defines operational alerts such as CPU throttling, crash loops, and replica mismatch.
- grafana-dashboard.json is an importable dashboard for runtime health and pod-level metrics.
- prometheus-values.yaml customizes the Prometheus/Grafana stack deployment.
- The monitoring subsystem is separate from the app runtime but reads its metrics and health state.
10. Operational feedback loop
- Runtime metrics flow from Kubernetes workloads into Prometheus, then into Grafana dashboards and Alertmanager rules.
- Alerting and deployment events are also pushed outward to Slack, creating a closed-loop operational signal path from build to runtime.
- This makes the architecture observability-driven, not just deployment-driven.
11. Repository-level deployment structure
- The repo is organized around three layers:
- Pipeline layer: Jenkins + SonarQube + Trivy + DockerHub
- Runtime layer: Appwrite Deployment/Service/Ingress + MariaDB/MongoDB/Redis
- Observability layer: Prometheus + Grafana + alerting
- That separation is important for diagramming because each layer has different failure modes and dependencies.
12. External systems that materially affect the architecture
- GitHub is the source trigger.
- DockerHub is the immutable image registry.
- Slack is the human notification channel.
- k3s/Kubernetes is the execution substrate.
- Jenkins, SonarQube, Trivy, Prometheus, Grafana, Alertmanager are the operational platform services that define how this repo behaves in practice.
13. What to show in an architecture diagram
- A good diagram should show:
- GitHub commit/webhook → Jenkins pipeline
- Jenkins → SonarQube and Trivy gates
- Jenkins → DockerHub image publish
- Jenkins → Kubernetes/Helm deploy
- Appwrite → MariaDB/MongoDB/Redis dependencies
- Kubernetes metrics → Prometheus → Grafana/Alertmanager
- Jenkins and alerting → Slack notifications
- The key architectural theme is a CI/CD-driven Kubernetes deployment with separate stateful dependencies and a distinct observability plane.
Main entry points: deployment.yaml Appwrite Deploy · Jenkinsfile Jenkinsfile · Chart.yaml Appwrite Chart · prometheus-values.yaml Prometheus
Components 18
CI/CD Control Plane
Source checkout, security gates, build, publish, deploy, and notifications.
- GitHub · Commit and webhook source for pipeline execution.
- Jenkinsfile · Defines the end-to-end delivery workflow.
Jenkinsfile - SonarQube · Static analysis and code-quality checks.
sonar-project.properties - Trivy Scan · Container or filesystem vulnerability scanning.
- DockerHub · Stores versioned deployable container images.
- Slack · Human notification channel for pipeline and operations events.
Kubernetes Runtime
Appwrite workload and its backing services inside the cluster.
- Appwrite Chart · Parameterized Kubernetes package for the Appwrite workload.
helm/appwrite/Chart.yaml - Appwrite Deploy · Primary application workload definition.
helm/appwrite/templates/deployment.yaml - Appwrite Service · Internal/external service exposure for Appwrite.
helm/appwrite/templates/service.yaml - Appwrite Ingress · Routes external traffic into the Appwrite service.
helm/appwrite/templates/ingress.yaml - Appwrite Namespace · Isolation boundary for Appwrite resources.
k8s/namespace.yaml - MariaDB · Relational backing store for Appwrite.
k8s/mariadb.yaml - MongoDB · Document backing store for Appwrite.
k8s/mongodb.yaml - Redis · Cache and transient coordination layer.
k8s/redis.yaml
Observability Plane
Metrics, dashboards, and alerts for the deployed workload.
- Prometheus · Scrapes application metrics and feeds alerting.
monitoring/prometheus-values.yaml - ServiceMonitor · Connects Prometheus scraping to the Appwrite workload.
monitoring/servicemonitor.yaml - Grafana · Visualizes runtime health and pod metrics.
monitoring/grafana-dashboard.json - Alert Rules · Operational alerts for crash loops, throttling, and replica issues.
monitoring/alert-rules.yaml
Connections 21
- GitHub → Jenkinsfile: trigger · Source changes start the delivery pipeline.
- Jenkinsfile → SonarQube: analyze · Pipeline runs static quality checks before promotion.
- Jenkinsfile → Trivy Scan: scan · Pipeline validates built artifacts for vulnerabilities.
- Jenkinsfile → DockerHub: publish · Pipeline pushes immutable image tags to the registry.
- Jenkinsfile → Appwrite Chart: deploy · Pipeline uses Helm packaging to apply Kubernetes resources.
- Appwrite Chart → Appwrite Deploy: renders · Chart templates materialize the Appwrite Deployment.
- Appwrite Chart → Appwrite Service: renders · Chart templates materialize the Appwrite Service.
- Appwrite Chart → Appwrite Ingress: renders · Chart templates materialize the Appwrite Ingress.
- Appwrite Deploy → Appwrite Namespace: runs in · Application workloads are isolated in the Appwrite namespace.
- Appwrite Service → Appwrite Namespace: scoped to · Service resources live in the same namespace boundary.
- Appwrite Ingress → Appwrite Namespace: scoped to · Ingress resources are deployed within the Appwrite namespace.
- Appwrite Deploy → DockerHub: pulls image · Cluster consumes versioned images from the registry.
- Appwrite Deploy → MariaDB: uses · Application depends on the relational backing service.
- Appwrite Deploy → MongoDB: uses · Application depends on the document backing service.
- Appwrite Deploy → Redis: uses · Application depends on cache/queue support.
- Appwrite Deploy → ServiceMonitor: exposed to · Metrics endpoint is discovered by Prometheus scraping.
- ServiceMonitor → Prometheus: scraped by · Prometheus collects metrics from the application workload.
- Prometheus → Grafana: visualized in · Collected metrics feed dashboards.
- Prometheus → Alert Rules: evaluates · Alert rules are evaluated from scraped metrics.
- Jenkinsfile → Slack: notify · Pipeline status is sent to Slack.
- Alert Rules → Slack: page · Operational alerts notify humans through Slack.