# rabbii96/devops-project-02 architecture

> Architecture diagram of the GitHub repository rabbii96/devops-project-02, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/rabbii96/devops-project-02
- Repository: https://github.com/rabbii96/devops-project-02

## Overview

1. This repository is centered on an AWS “modular and scalable VPC” deployment. The README describes the target system as two VPCs connected for both administrative access and private application traffic: one VPC for a bastion host and one VPC for the application tier.

2. The `VPC Architecture/` folder holds the AWS-side support artifacts for that environment. Based on the filenames, it contains JSON definitions for VPC Flow Logs, CloudWatch memory metrics, and an S3 bucket policy, plus a `script.sh` helper for setup or validation. These files are infrastructure inputs rather than application code.

3. The network boundary is split into two CIDR ranges:
   - `192.168.0.0/16` for the bastion/admin VPC
   - `172.32.0.0/16` for the application VPC
   Each VPC has its own Internet Gateway, and the app VPC also uses a NAT Gateway so private instances can reach the internet for updates and bootstrap tasks without being publicly exposed.

4. The two VPCs are linked through a Transit Gateway, which is the private routing backbone of the design. That lets the bastion network reach private application instances while keeping the app subnet private and segregated from direct inbound internet access.

5. The operational access path is the bastion host in the public subnet. It is assigned an Elastic IP and protected by a security group that allows SSH from the public internet. From there, engineers can SSH into private instances in the app VPC. The README also calls out AWS Session Manager as an alternate shell access path, so the IAM role on instances is part of the management plane.

6. Observability is a first-class subsystem. Both VPCs send Flow Logs to CloudWatch Logs, using a dedicated log group with separate streams for each VPC. In addition, the pre-deployment steps require the CloudWatch Agent and custom memory metrics on the golden AMI, so instance-level telemetry is expected alongside network-level telemetry.

7. The application compute tier is designed as a highly available Auto Scaling Group spanning two private subnets across two availability zones. Instances are launched from a Golden AMI with a Launch Configuration, and the bootstrap flow pulls application code from Bitbucket and starts the web server. That makes the app tier ephemeral and rebuildable.

8. The ingress path for end users is: Route 53 CNAME → Network Load Balancer in public subnets → Target Group → Auto Scaling Group instances in private subnets. The NLB is the public entry point, while the application instances remain private behind it.

9. Configuration and secrets-like app inputs are separated from the AMI by using S3. The README explicitly says the instance role should have scoped access to a dedicated S3 bucket for application configuration, not broad S3 permissions. That keeps bootstrap configuration externalized and permission boundaries tight.

10. The `html-web-app/` directory is the sample workload that gets deployed onto the EC2 web servers. It contains a simple HTML/CSS/JS site, images, error/ok pages, and web server descriptors (`WEB-INF/web.xml`). It also includes a `Dockerfile` and `nginx.conf`, which suggests the app can be packaged either as a traditional web artifact or containerized, even though the README’s main deployment path is EC2-based Apache.

11. `podmanager/` is a separate Helm chart, with Kubernetes deployment and service templates plus default values. The repository README does not describe this path, so it appears to be an additional packaging/deployment option rather than part of the primary VPC architecture described in the document.

12. `Jenkinsfile` indicates there is CI/CD automation in the repo, likely for building or publishing the app and/or infrastructure artifacts. Even without the file contents, it is an important boundary because it suggests the environment is meant to be reproducible rather than assembled manually every time.

13. For an architecture diagram, the main flow to capture is: engineers access through bastion or Session Manager; app instances live in private subnets; outbound-only internet access goes through NAT; inbound user traffic goes through NLB and Route 53; network and instance telemetry go to CloudWatch; and the whole design is bridged by a Transit Gateway between the two VPCs.

Main entry points: [`README.md`](https://github.com/rabbii96/devops-project-02/blob/main/README.md) (README), [`VPC Architecture/flow-logs.json`](https://github.com/rabbii96/devops-project-02/blob/HEAD/VPC%20Architecture/flow-logs.json) (CloudWatch), [`html-web-app/Dockerfile`](https://github.com/rabbii96/devops-project-02/tree/main/html-web-app/Dockerfile) (App Packaging), [`html-web-app/index.html`](https://github.com/rabbii96/devops-project-02/blob/main/html-web-app/index.html) (Web App)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ops["AWS Architecture"]
  node_readme["README<br/>docs<br/>[README.md]"]
  node_vpc_a{{"Bastion VPC<br/>network"}}
  node_vpc_b{{"App VPC<br/>network"}}
  node_tgw{{"Transit Gateway<br/>routing backbone"}}
  node_bastion["Bastion Host<br/>admin access"]
  node_app_asg["App ASG<br/>compute tier"]
  node_golden["Golden AMI<br/>instance image"]
  node_nlb["Network Load Balancer<br/>public ingress"]
  node_tg["Target Group<br/>routing target"]
  node_route53(("Route 53<br/>dns"))
  node_nat["NAT Gateway<br/>egress"]
  node_cw(("CloudWatch<br/>telemetry<br/>[flow-logs.json]"))
  node_s3[("S3 Bucket<br/>config store<br/>[s3-policy.json]")]
  node_ssm(("Session Manager<br/>access path"))
  node_script["Setup Script<br/>infra helper<br/>[script.sh]"]
end

subgraph group_app["Workload"]
  node_webapp["Web App<br/>sample workload<br/>[index.html]"]
  node_packaging["App Packaging<br/>build assets"]
end

subgraph group_delivery["Delivery"]
  node_jenkins["Jenkinsfile<br/>ci pipeline"]
  node_helm["Helm Chart<br/>k8s packaging<br/>[Chart.yaml]"]
end

node_readme -->|"describes"| node_vpc_a
node_readme -->|"describes"| node_vpc_b
node_readme -->|"publishes"| node_nlb
node_readme -->|"references"| node_jenkins
node_vpc_a -->|"hosts"| node_bastion
node_vpc_a -->|"connects"| node_tgw
node_vpc_b -->|"hosts"| node_app_asg
node_vpc_b -->|"egress"| node_nat
node_vpc_b -->|"connects"| node_tgw
node_tgw -->|"routes"| node_bastion
node_bastion -->|"ssh"| node_app_asg
node_ssm -.->|"manages"| node_app_asg
node_route53 -->|"resolves to"| node_nlb
node_nlb -->|"forwards"| node_tg
node_tg -->|"targets"| node_app_asg
node_golden -->|"launches"| node_app_asg
node_s3 -->|"configures"| node_app_asg
node_cw -->|"logs"| node_vpc_a
node_cw -->|"logs"| node_vpc_b
node_cw -->|"metrics"| node_app_asg
node_script -.->|"prepares"| node_cw
node_jenkins -->|"builds"| node_webapp
node_webapp -.->|"bundled by"| node_packaging
node_packaging -->|"deploys to"| node_app_asg
node_helm -.->|"alternative path"| node_packaging

click node_readme "https://github.com/rabbii96/devops-project-02/blob/main/README.md"
click node_jenkins "https://github.com/rabbii96/devops-project-02/tree/main/Jenkinsfile"
click node_cw "https://github.com/rabbii96/devops-project-02/blob/main/VPC Architecture/flow-logs.json"
click node_s3 "https://github.com/rabbii96/devops-project-02/blob/main/VPC Architecture/s3-policy.json"
click node_script "https://github.com/rabbii96/devops-project-02/blob/main/VPC Architecture/script.sh"
click node_webapp "https://github.com/rabbii96/devops-project-02/blob/main/html-web-app/index.html"
click node_packaging "https://github.com/rabbii96/devops-project-02/tree/main/html-web-app/Dockerfile"
click node_helm "https://github.com/rabbii96/devops-project-02/blob/main/podmanager/Chart.yaml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_readme,node_vpc_a,node_vpc_b,node_tgw,node_bastion,node_app_asg,node_golden,node_nlb,node_tg,node_route53,node_nat,node_cw,node_s3,node_ssm,node_script toneBlue
class node_webapp,node_packaging toneAmber
class node_jenkins,node_helm toneMint
```

## Components

### AWS Architecture

Primary VPC-based deployment and operational support artifacts

- [README](https://github.com/rabbii96/devops-project-02/blob/main/README.md): docs · Architecture overview and deployment intent · `README.md`
- **Bastion VPC**: network · 192.168.0.0/16 administrative network with public access
- **App VPC**: network · 172.32.0.0/16 private application network
- **Transit Gateway**: routing backbone · Private connectivity between the two VPCs
- **Bastion Host**: admin access · Public SSH entry point for engineers
- **App ASG**: compute tier · Highly available private EC2 web tier across AZs
- **Golden AMI**: instance image · Baked image used by the launch configuration
- **Network Load Balancer**: public ingress · Internet-facing entry for end-user traffic
- **Target Group**: routing target · Forwards NLB traffic to private instances
- **Route 53**: dns · CNAME-based name resolution for the service
- **NAT Gateway**: egress · Outbound internet access for private app instances
- [CloudWatch](https://github.com/rabbii96/devops-project-02/blob/HEAD/VPC%20Architecture/flow-logs.json): telemetry · Flow logs and memory metrics collection · `VPC Architecture/flow-logs.json`
- [S3 Bucket](https://github.com/rabbii96/devops-project-02/blob/HEAD/VPC%20Architecture/s3-policy.json): config store · Scoped bucket for application configuration · `VPC Architecture/s3-policy.json`
- **Session Manager**: access path · Alternate shell access through IAM-managed sessions
- [Setup Script](https://github.com/rabbii96/devops-project-02/blob/HEAD/VPC%20Architecture/script.sh): infra helper · Helper for VPC/support artifact setup · `VPC Architecture/script.sh`

### Workload

Sample application and packaging assets

- [Web App](https://github.com/rabbii96/devops-project-02/blob/main/html-web-app/index.html): sample workload · HTML/CSS/JS site deployed to the web servers · `html-web-app/index.html`
- [App Packaging](https://github.com/rabbii96/devops-project-02/tree/main/html-web-app/Dockerfile): build assets · Docker and Nginx packaging for the sample app · `html-web-app/Dockerfile`

### Delivery

CI/CD and alternate deployment path

- [Jenkinsfile](https://github.com/rabbii96/devops-project-02/tree/main/Jenkinsfile): ci pipeline · Automation for build and delivery · `Jenkinsfile`
- [Helm Chart](https://github.com/rabbii96/devops-project-02/blob/main/podmanager/Chart.yaml): k8s packaging · Optional Kubernetes deployment path · `podmanager/Chart.yaml`

## Connections

- README → Bastion VPC: describes · Documents the bastion/admin network
- README → App VPC: describes · Documents the private application network
- README → Network Load Balancer: publishes · User ingress through the load balancer
- README → Jenkinsfile: references · Repository includes CI/CD automation
- Bastion VPC → Bastion Host: hosts · Public subnet contains the bastion host
- Bastion VPC → Transit Gateway: connects · Administrative network peers through the transit backbone
- App VPC → App ASG: hosts · Private subnets contain the application tier
- App VPC → NAT Gateway: egress · Private instances use NAT for outbound access
- App VPC → Transit Gateway: connects · Private application network is reachable over TGW
- Transit Gateway → Bastion Host: routes · Enables admin access to private application hosts
- Bastion Host → App ASG: ssh · Engineer access path into private instances
- Session Manager → App ASG: manages · Alternate access path via instance IAM role
- Route 53 → Network Load Balancer: resolves to · CNAME points users at the public load balancer
- Network Load Balancer → Target Group: forwards · Public ingress is routed to the target group
- Target Group → App ASG: targets · Targets private EC2 instances
- Golden AMI → App ASG: launches · Launch configuration uses the golden image
- S3 Bucket → App ASG: configures · Instances pull scoped application configuration
- CloudWatch → Bastion VPC: logs · Flow logs collected for bastion VPC
- CloudWatch → App VPC: logs · Flow logs collected for app VPC
- CloudWatch → App ASG: metrics · Instance memory telemetry from CloudWatch Agent
- Setup Script → CloudWatch: prepares · Sets up observability and supporting artifacts
- Jenkinsfile → Web App: builds · CI likely builds or packages the sample app
- Web App → App Packaging: bundled by · Application can be packaged with Docker/Nginx
- App Packaging → App ASG: deploys to · Primary path is EC2-based web servers
- Helm Chart → App Packaging: alternative path · Separate Kubernetes deployment option