# omprakash2929/appwrite-devsecops architecture

> Architecture diagram of the GitHub repository omprakash2929/appwrite-devsecops, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/omprakash2929/appwrite-devsecops
- Repository: https://github.com/omprakash2929/appwrite-devsecops

## Overview

1. **What this repository is**
   - This is not the Appwrite application codebase itself. It is a **DevSecOps delivery repository** that defines how Appwrite is built, scanned, packaged, deployed, and observed in Kubernetes.
   - The repository’s main boundary is between **CI/CD control** and **runtime infrastructure**.

2. **Primary control plane: Jenkins pipeline**
   - `Jenkinsfile` is the orchestration entrypoint.
   - Jenkins handles the end-to-end flow: source checkout, static analysis, container build, vulnerability scanning, image publishing, Kubernetes deployment, verification, and notification.
   - The pipeline integrates with **SonarQube**, **Trivy**, **DockerHub**, **kubectl/Helm**, and **Slack**.

3. **Build and security gates**
   - **SonarQube** provides code-quality / SAST gating through `sonar-project.properties`.
   - **Trivy** is used for security scanning of images and/or filesystem content, with findings influencing pipeline quality checks.
   - These scans are part of the delivery path before the deployment is promoted to Kubernetes.

4. **Container artifact boundary**
   - The deployable artifact is a **Docker image** pushed to **DockerHub**.
   - The README indicates versioned tags are used, so the runtime cluster consumes immutable image references rather than building locally.
   - This cleanly separates build-time concerns from cluster runtime.

5. **Kubernetes application packaging**
   - `helm/appwrite` is the deployable package for the Appwrite workload.
   - `Chart.yaml` defines chart metadata, `values.yaml` carries configurable parameters, and `templates/` contains the Kubernetes manifests.
   - The Helm chart is the primary abstraction for parameterized deployment of the Appwrite service.

6. **Appwrite runtime workload**
   - `helm/appwrite/templates/deployment.yaml` defines the main Appwrite workload as a Kubernetes Deployment.
   - `service.yaml` exposes it inside the cluster or externally depending on chart values.
   - `ingress.yaml` routes external traffic into the Appwrite service through the cluster ingress layer.

7. **Supporting data services**
   - The `k8s/` directory contains standalone manifests for **MariaDB**, **MongoDB**, and **Redis**, plus a dedicated `namespace.yaml`.
   - These are the stateful backing services Appwrite relies on for relational data, document data, and caching/queueing.
   - This repo therefore has a clear split between the **application tier** (Helm chart) and **stateful dependency tier** (raw Kubernetes manifests).

8. **Namespace and cluster boundary**
   - The `namespace.yaml` creates an isolated namespace for Appwrite resources.
   - The supporting databases and cache are deployed as Kubernetes resources in the same cluster, but logically separated from monitoring and from the Jenkins control plane.
   - The target environment described in the README is **k3s**, which makes the cluster a lightweight single-node or small-footprint Kubernetes runtime.

9. **Observability stack**
   - `monitoring/` defines the observability layer:
     - `servicemonitor.yaml` connects Prometheus scraping to the Appwrite workload.
     - `alert-rules.yaml` defines operational alerts such as CPU throttling, crash loops, and replica mismatch.
     - `grafana-dashboard.json` is an importable dashboard for runtime health and pod-level metrics.
     - `prometheus-values.yaml` customizes the Prometheus/Grafana stack deployment.
   - The monitoring subsystem is separate from the app runtime but reads its metrics and health state.

10. **Operational feedback loop**
   - Runtime metrics flow from Kubernetes workloads into **Prometheus**, then into **Grafana** dashboards and **Alertmanager** rules.
   - Alerting and deployment events are also pushed outward to **Slack**, creating a closed-loop operational signal path from build to runtime.
   - This makes the architecture observability-driven, not just deployment-driven.

11. **Repository-level deployment structure**
   - The repo is organized around three layers:
     - **Pipeline layer:** Jenkins + SonarQube + Trivy + DockerHub
     - **Runtime layer:** Appwrite Deployment/Service/Ingress + MariaDB/MongoDB/Redis
     - **Observability layer:** Prometheus + Grafana + alerting
   - That separation is important for diagramming because each layer has different failure modes and dependencies.

12. **External systems that materially affect the architecture**
   - **GitHub** is the source trigger.
   - **DockerHub** is the immutable image registry.
   - **Slack** is the human notification channel.
   - **k3s/Kubernetes** is the execution substrate.
   - **Jenkins, SonarQube, Trivy, Prometheus, Grafana, Alertmanager** are the operational platform services that define how this repo behaves in practice.

13. **What to show in an architecture diagram**
   - A good diagram should show:
     - GitHub commit/webhook → Jenkins pipeline
     - Jenkins → SonarQube and Trivy gates
     - Jenkins → DockerHub image publish
     - Jenkins → Kubernetes/Helm deploy
     - Appwrite → MariaDB/MongoDB/Redis dependencies
     - Kubernetes metrics → Prometheus → Grafana/Alertmanager
     - Jenkins and alerting → Slack notifications
   - The key architectural theme is a **CI/CD-driven Kubernetes deployment with separate stateful dependencies and a distinct observability plane**.

Main entry points: [`helm/appwrite/templates/deployment.yaml`](https://github.com/omprakash2929/appwrite-devsecops/blob/main/helm/appwrite/templates/deployment.yaml) (Appwrite Deploy), [`Jenkinsfile`](https://github.com/omprakash2929/appwrite-devsecops/tree/main/Jenkinsfile) (Jenkinsfile), [`helm/appwrite/Chart.yaml`](https://github.com/omprakash2929/appwrite-devsecops/blob/main/helm/appwrite/Chart.yaml) (Appwrite Chart), [`monitoring/prometheus-values.yaml`](https://github.com/omprakash2929/appwrite-devsecops/blob/main/monitoring/prometheus-values.yaml) (Prometheus)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_pipeline["CI/CD Control Plane"]
  node_github(("GitHub<br/>source trigger"))
  node_jenkinsfile["Jenkinsfile<br/>pipeline entry"]
  node_sonar(("SonarQube<br/>quality gate"))
  node_trivy(("Trivy Scan<br/>security scan"))
  node_dockerhub[("DockerHub<br/>image registry")]
  node_slack(("Slack<br/>notification sink"))
end

subgraph group_runtime["Kubernetes Runtime"]
  node_helmchart["Appwrite Chart<br/>helm package<br/>[Chart.yaml]"]
  node_deployment["Appwrite Deploy<br/>k8s deployment<br/>[deployment.yaml]"]
  node_service["Appwrite Service<br/>k8s service<br/>[service.yaml]"]
  node_ingress["Appwrite Ingress<br/>k8s ingress<br/>[ingress.yaml]"]
  node_namespace["Appwrite Namespace<br/>k8s namespace<br/>[namespace.yaml]"]
  node_mariadb[("MariaDB<br/>stateful db<br/>[mariadb.yaml]")]
  node_mongodb[("MongoDB<br/>stateful db<br/>[mongodb.yaml]")]
  node_redis[("Redis<br/>cache/queue<br/>[redis.yaml]")]
end

subgraph group_observability["Observability Plane"]
  node_prometheus[("Prometheus<br/>metrics collector")]
  node_servicemonitor["ServiceMonitor<br/>scrape config"]
  node_grafana(("Grafana<br/>dashboard"))
  node_alerts["Alert Rules<br/>alerting rules<br/>[alert-rules.yaml]"]
end

node_github -->|"trigger"| node_jenkinsfile
node_jenkinsfile -->|"analyze"| node_sonar
node_jenkinsfile -->|"scan"| node_trivy
node_jenkinsfile -->|"publish"| node_dockerhub
node_jenkinsfile -->|"deploy"| node_helmchart
node_helmchart -->|"renders"| node_deployment
node_helmchart -->|"renders"| node_service
node_helmchart -->|"renders"| node_ingress
node_deployment -->|"runs in"| node_namespace
node_service -->|"scoped to"| node_namespace
node_ingress -->|"scoped to"| node_namespace
node_deployment -->|"pulls image"| node_dockerhub
node_deployment -->|"uses"| node_mariadb
node_deployment -->|"uses"| node_mongodb
node_deployment -->|"uses"| node_redis
node_deployment -->|"exposed to"| node_servicemonitor
node_servicemonitor -->|"scraped by"| node_prometheus
node_prometheus -->|"visualized in"| node_grafana
node_prometheus -->|"evaluates"| node_alerts
node_jenkinsfile -->|"notify"| node_slack
node_alerts -->|"page"| node_slack

click node_jenkinsfile "https://github.com/omprakash2929/appwrite-devsecops/tree/main/Jenkinsfile"
click node_sonar "https://github.com/omprakash2929/appwrite-devsecops/blob/main/sonar-project.properties"
click node_helmchart "https://github.com/omprakash2929/appwrite-devsecops/blob/main/helm/appwrite/Chart.yaml"
click node_deployment "https://github.com/omprakash2929/appwrite-devsecops/blob/main/helm/appwrite/templates/deployment.yaml"
click node_service "https://github.com/omprakash2929/appwrite-devsecops/blob/main/helm/appwrite/templates/service.yaml"
click node_ingress "https://github.com/omprakash2929/appwrite-devsecops/blob/main/helm/appwrite/templates/ingress.yaml"
click node_namespace "https://github.com/omprakash2929/appwrite-devsecops/blob/main/k8s/namespace.yaml"
click node_mariadb "https://github.com/omprakash2929/appwrite-devsecops/blob/main/k8s/mariadb.yaml"
click node_mongodb "https://github.com/omprakash2929/appwrite-devsecops/blob/main/k8s/mongodb.yaml"
click node_redis "https://github.com/omprakash2929/appwrite-devsecops/blob/main/k8s/redis.yaml"
click node_prometheus "https://github.com/omprakash2929/appwrite-devsecops/blob/main/monitoring/prometheus-values.yaml"
click node_servicemonitor "https://github.com/omprakash2929/appwrite-devsecops/blob/main/monitoring/servicemonitor.yaml"
click node_grafana "https://github.com/omprakash2929/appwrite-devsecops/blob/main/monitoring/grafana-dashboard.json"
click node_alerts "https://github.com/omprakash2929/appwrite-devsecops/blob/main/monitoring/alert-rules.yaml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_github,node_jenkinsfile,node_sonar,node_trivy,node_dockerhub,node_slack toneBlue
class node_helmchart,node_deployment,node_service,node_ingress,node_namespace,node_mariadb,node_mongodb,node_redis toneAmber
class node_prometheus,node_servicemonitor,node_grafana,node_alerts toneMint
```

## Components

### CI/CD Control Plane

Source checkout, security gates, build, publish, deploy, and notifications.

- **GitHub**: source trigger · Commit and webhook source for pipeline execution.
- [Jenkinsfile](https://github.com/omprakash2929/appwrite-devsecops/tree/main/Jenkinsfile): pipeline entry · Defines the end-to-end delivery workflow. · `Jenkinsfile`
- [SonarQube](https://github.com/omprakash2929/appwrite-devsecops/blob/main/sonar-project.properties): quality gate · Static analysis and code-quality checks. · `sonar-project.properties`
- **Trivy Scan**: security scan · Container or filesystem vulnerability scanning.
- **DockerHub**: image registry · Stores versioned deployable container images.
- **Slack**: notification sink · Human notification channel for pipeline and operations events.

### Kubernetes Runtime

Appwrite workload and its backing services inside the cluster.

- [Appwrite Chart](https://github.com/omprakash2929/appwrite-devsecops/blob/main/helm/appwrite/Chart.yaml): helm package · Parameterized Kubernetes package for the Appwrite workload. · `helm/appwrite/Chart.yaml`
- [Appwrite Deploy](https://github.com/omprakash2929/appwrite-devsecops/blob/main/helm/appwrite/templates/deployment.yaml): k8s deployment · Primary application workload definition. · `helm/appwrite/templates/deployment.yaml`
- [Appwrite Service](https://github.com/omprakash2929/appwrite-devsecops/blob/main/helm/appwrite/templates/service.yaml): k8s service · Internal/external service exposure for Appwrite. · `helm/appwrite/templates/service.yaml`
- [Appwrite Ingress](https://github.com/omprakash2929/appwrite-devsecops/blob/main/helm/appwrite/templates/ingress.yaml): k8s ingress · Routes external traffic into the Appwrite service. · `helm/appwrite/templates/ingress.yaml`
- [Appwrite Namespace](https://github.com/omprakash2929/appwrite-devsecops/blob/main/k8s/namespace.yaml): k8s namespace · Isolation boundary for Appwrite resources. · `k8s/namespace.yaml`
- [MariaDB](https://github.com/omprakash2929/appwrite-devsecops/blob/main/k8s/mariadb.yaml): stateful db · Relational backing store for Appwrite. · `k8s/mariadb.yaml`
- [MongoDB](https://github.com/omprakash2929/appwrite-devsecops/blob/main/k8s/mongodb.yaml): stateful db · Document backing store for Appwrite. · `k8s/mongodb.yaml`
- [Redis](https://github.com/omprakash2929/appwrite-devsecops/blob/main/k8s/redis.yaml): cache/queue · Cache and transient coordination layer. · `k8s/redis.yaml`

### Observability Plane

Metrics, dashboards, and alerts for the deployed workload.

- [Prometheus](https://github.com/omprakash2929/appwrite-devsecops/blob/main/monitoring/prometheus-values.yaml): metrics collector · Scrapes application metrics and feeds alerting. · `monitoring/prometheus-values.yaml`
- [ServiceMonitor](https://github.com/omprakash2929/appwrite-devsecops/blob/main/monitoring/servicemonitor.yaml): scrape config · Connects Prometheus scraping to the Appwrite workload. · `monitoring/servicemonitor.yaml`
- [Grafana](https://github.com/omprakash2929/appwrite-devsecops/blob/main/monitoring/grafana-dashboard.json): dashboard · Visualizes runtime health and pod metrics. · `monitoring/grafana-dashboard.json`
- [Alert Rules](https://github.com/omprakash2929/appwrite-devsecops/blob/main/monitoring/alert-rules.yaml): alerting rules · Operational alerts for crash loops, throttling, and replica issues. · `monitoring/alert-rules.yaml`

## Connections

- GitHub → Jenkinsfile: trigger · Source changes start the delivery pipeline.
- Jenkinsfile → SonarQube: analyze · Pipeline runs static quality checks before promotion.
- Jenkinsfile → Trivy Scan: scan · Pipeline validates built artifacts for vulnerabilities.
- Jenkinsfile → DockerHub: publish · Pipeline pushes immutable image tags to the registry.
- Jenkinsfile → Appwrite Chart: deploy · Pipeline uses Helm packaging to apply Kubernetes resources.
- Appwrite Chart → Appwrite Deploy: renders · Chart templates materialize the Appwrite Deployment.
- Appwrite Chart → Appwrite Service: renders · Chart templates materialize the Appwrite Service.
- Appwrite Chart → Appwrite Ingress: renders · Chart templates materialize the Appwrite Ingress.
- Appwrite Deploy → Appwrite Namespace: runs in · Application workloads are isolated in the Appwrite namespace.
- Appwrite Service → Appwrite Namespace: scoped to · Service resources live in the same namespace boundary.
- Appwrite Ingress → Appwrite Namespace: scoped to · Ingress resources are deployed within the Appwrite namespace.
- Appwrite Deploy → DockerHub: pulls image · Cluster consumes versioned images from the registry.
- Appwrite Deploy → MariaDB: uses · Application depends on the relational backing service.
- Appwrite Deploy → MongoDB: uses · Application depends on the document backing service.
- Appwrite Deploy → Redis: uses · Application depends on cache/queue support.
- Appwrite Deploy → ServiceMonitor: exposed to · Metrics endpoint is discovered by Prometheus scraping.
- ServiceMonitor → Prometheus: scraped by · Prometheus collects metrics from the application workload.
- Prometheus → Grafana: visualized in · Collected metrics feed dashboards.
- Prometheus → Alert Rules: evaluates · Alert rules are evaluated from scraped metrics.
- Jenkinsfile → Slack: notify · Pipeline status is sent to Slack.
- Alert Rules → Slack: page · Operational alerts notify humans through Slack.