Topology
Containers are split across three network zones. Only the
public zone faces outward; data and
docker are closed (internal) — there is no
path to the databases from outside, only through the application.
Internet
HTTPS · 443 / 80 ▼
zone: public only nginx is exposed outward
nginxsingle entry · TLS · security headers
frontendReact static · :8080
backendFastAPI · API :8000
certbotauto-renew TLS · Let's Encrypt
▲ internal traffic ▼
zone: data internal — closed to the outside
postgres + pgvectorrelational · vectors · graph
redis-durablequeues · counters · AOF persistence
redis-cachecache · memory-based eviction
worker (SAQ)background execution outside the request
migratealembic upgrade · one-shot
graph enginev2 dedicated graph engine
zone: docker internal
socket-proxy ◄ autohealrestarts unhealthy containers without direct socket access