pal-e-docs

Deployment: pal-e-app

arch-deployment-pal-e-app Architecture

architecture active
Project

Deployment: pal-e-app

Diagram

Components

Component Purpose Notes
pal-e-landing Public landing page for Pal-E Enterprises Not yet deployed. New repo, static site, nginx or adapter-static. Hostname: pal-e.tail5b443a.ts.net
pal-e-app Authenticated SvelteKit frontend Currently deployed as pal-e-docs-app in namespace pal-e-docs-app. Needs namespace rename. Hostname: pal-e-app.tail5b443a.ts.net
Keycloak OIDC identity provider Running in keycloak namespace. Realm: pal-e. Client: pal-e-docs-app (needs rename to pal-e-app).
pal-e-docs API Content API + authorization enforcement Running in pal-e-docs namespace. FastAPI. Will add UserProjectPermission query layer.
Embedding Worker Vector embedding for semantic search Sidecar in pal-e-docs namespace. Uses Ollama.
PostgreSQL Persistent storage for all services CNPG-managed cluster. Shared by pal-e-docs and Keycloak.

Key Decisions

  • All ingress via Tailscale Funnels. No cert-manager, no Traefik. Each service gets its own Tailscale hostname with automatic TLS.
  • pal-e-landing gets its own namespace and funnel. Separate from pal-e-app because it's a different deployment (static vs node) with a different audience (public vs authenticated).
  • Namespace rename needed. Current pal-e-docs-app namespace → pal-e-app. This is a deployment coordination task across ArgoCD, Tailscale Ingress, and the Keycloak client.
  • ArgoCD manages deployments. pal-e-deployments repo has kustomize overlays. New services need overlay creation + ArgoCD Application.
  • CI via Woodpecker. Builds push images to Harbor, trigger ArgoCD sync.