System Topology

Current Topology (main branch)

The current architecture provisions per-client infrastructure on a shared VPS:

Buyer Browser ──> Cloudflare Pages ──> Astro SSR (Node) ──> Directus CMS ──> PostgreSQL
                      │                                            │
                      │ (static assets)                   (on shared VPS via Dokploy)
                      │
Agent/Developer ──> Cloudflare Access ──> Cloudflare Tunnel ──> Directus Admin UI
                      │                     │
                      │ (MFA + allowlist)   │ (no open VPS ports)
                      │
Operator ──> Cloudflare Access ──> Cloudflare Tunnel ──> Portainer / Directus

Each client gets:

• 1 Cloudflare Pages project (buyer portal)
• 1 Directus Docker container (admin/CMS)
• 1 PostgreSQL database on shared instance
• 1 Cloudflare Access app + policy
• 1 Cloudflare Tunnel ingress route (per-client port)

Target Topology (spike/cf-runtime branch)

The target architecture replaces per-client infrastructure with shared multi-tenant apps:

                         Cloudflare for SaaS
                              │
              ┌───────────────┼───────────────┐
              │               │               │
    Buyer Browsers    Agent/Dev Browsers    Operator Browser
         │                  │                     │
         v                  v                     v
  Buyer Portal          Admin App           Operator Panel
  (Cloudflare Pages)   (Cloudflare Pages)   (same Pages project)
         │                  │                     │
         v                  v                     v
    ┌───────────────────────────────────────────────┐
    │          Neon Postgres (Multi-Tenant)          │
    │           + RLS + Tenant Scoping              │
    └───────────────────────────────────────────────┘
         │
         v
    ┌───────────────────────────────────────────────┐
    │        Cloudflare R2 (Media + Docs)            │
    │          (presigned URLs, no proxy)            │
    └───────────────────────────────────────────────┘
         │
         v
    ┌───────────────────────────────────────────────┐
    │   Hetzner CPX11 (€5/mo)                       │
    |   **CPX22 — Worker Box**                          │
    │   (Dokploy-managed Docker Compose)               │
    │   - OpenImmo XML imports                         │
    │   - Image processing (floorplan OCR, PDF gen)    │
    │   - Scheduled jobs (pg_dump, TLS check)          │
    └─────────────────────────────────────────────────┘

## Key Differences

| Aspect | Current (`main`) | Target (`spike/cf-runtime`) |
|---|---|---|
| Buyer Portal Instances | 1 per client (N projects) | 1 for all clients (Host-based routing) |
| Admin/CMS | Directus 11 per client | Built-in CRM in same app |
| Database | DB per client on shared VPS | 1 Neon database, RLS scoped |
| File Storage | Directus-managed uploads | R2 with presigned URLs |
| Deployment | Dokploy + shell scripts | Cloudflare Pages + Dokploy (worker box) |
| New Client Setup | ~30 min (infra provisioning) | ~5 min (DB inserts + Custom Hostname) |

## Network Architecture (Target)

Public: *.convertella.app ──> Cloudflare ──> Pages / Workers

Private (VPS): jobs.convertella.app ──> Cloudflare Access ──> CPX22 (Dokploy worker stack) operator.convertella.app ──> Cloudflare Access ──> Pages (same app)

Database: Pages/Workers ──> Neon HTTP API (TLS) Worker Box ──> PostgreSQL wire protocol (TLS)