pal-e-docs

Deployment: westside-mcp

arch-deployment-westside-mcp Architecture

architecture active
Project

Deployment: westside-mcp

Diagram




          
  
Components



          
  

    

        
          

              Component
              Purpose
              Namespace / Location
          

        
      
          

              Tailscale funnel
              Public HTTPS entry
              Tailnet — <code>westside-mcp.tail5b443a.ts.net</code>
          

          

              westside-mcp pod
              MCP server + OAuth + tools
              k3s <code>westside-mcp</code> namespace
          

          

              mcp-remote-auth
              OAuth proxy (shared lib)
              In-pod sidecar or in-process
          

          

              CNPG <code>-ro</code> replica
              Read-only Postgres endpoint
              k3s CNPG cluster (basketball-api DB)
          

          

              CNPG primary
              Basketball-api writes (untouched)
              k3s CNPG cluster
          

          

              basketball-api
              Unrelated service, not touched by MCP
              k3s <code>basketball-api</code> namespace
          

          

              Harbor
              Container image registry
              Consumed from pal-e-platform
          

          

              Woodpecker CI
              Build + test + push
              Consumed from pal-e-platform
          

          

              ArgoCD
              Kustomize sync → k3s
              Consumed from pal-e-platform
          

          

              Prometheus
              Metrics scrape
              Consumed; ServiceMonitor in overlay
          

          

              Loki
              Log + audit sink
              Consumed; stdout JSON auto-scraped
          

          

              Grafana
              Dashboard (Stage 3)
              Consumed
          

      
    

  



          
  
Key Decisions



          
  
    
      
  • pal-e-platform is untouched. Every capability we need (Tailscale, CNPG, Harbor, Woodpecker, Prom/Loki, ArgoCD) is already provided by the bootstrap repo. New work is Terraform in pal-e-services + kustomize in pal-e-deployments + new code repo. Three-repo split does its job.
    • 
      
  • Connect to -ro replica, not primary. Physical write-impossibility. Slightly stale reads (milliseconds) are acceptable because Marcus is asking aggregate questions, not racing against transactions.
    • 
      
  • DB credentials live in a k8s Secret provisioned by pal-e-services. Not in the MCP repo, not in the kustomize overlay. Rotations happen at the Terraform layer.
    • 
      
  • Tailscale funnel, not an ingress controller. Matches platform convention for public-facing services. Zero cert-manager, zero Traefik — Tailscale terminates TLS.
    • 
      
  • Single replica pod in v1. MCP traffic is one human asking occasional questions. HPA + multi-replica is a Stage 3 concern if QPS grows.
    • 
      
  • Observability is "free." /metrics endpoint + stdout JSON logs automatically picked up by the cluster's Prom/Loki stack. ServiceMonitor is the only overlay addition.
    •