generated from bisco/codex-bootstrap
bisco
34 lines
1.8 KiB
Markdown
34 lines
1.8 KiB
Markdown
# Architecture
|
|
|
|
The system has four default runtime components and one optional component on the Docker
|
|
Compose network:
|
|
|
|
1. NGINX accepts requests for `azionelab.org` and routes them by path.
|
|
2. Astro renders the public single page and requests one aggregate JSON document.
|
|
3. Wagtail/Django manages editorial content, serves media in development, and exposes
|
|
the read-only `/api/site/home/` endpoint.
|
|
4. PostgreSQL persists Wagtail content and metadata.
|
|
5. When explicitly enabled, Certbot obtains and renews a Let's Encrypt certificate by
|
|
writing HTTP-01 challenges and certificate files to shared named volumes.
|
|
|
|
NGINX sends `/admin`, `/api`, `/documents`, `/health`, `/media`, and `/static` paths to
|
|
Wagtail. All remaining paths go to Astro. Unknown virtual hosts receive a 404 response.
|
|
The ACME challenge path is served directly from its shared volume. If automatic TLS is
|
|
enabled, NGINX starts in HTTP mode, detects the first certificate, adds its HTTPS
|
|
virtual host, redirects application traffic to HTTPS, and reloads after renewals.
|
|
|
|
The aggregate response contains `settings`, `homepage`, `feature_cards`, `teacher`,
|
|
`lesson_info`, `shows`, and `gallery_items`. Image values contain browser-facing URLs
|
|
and alternative text. Only published home content and records marked for home display
|
|
are exposed. Astro validates/normalizes the response and falls back to checked-in
|
|
Italian demo content if fetching fails.
|
|
|
|
Wagtail's authenticated admin remains the only editing interface. The public frontend
|
|
has no database access and no public write API. Uploaded media is stored in a dedicated
|
|
Compose volume.
|
|
|
|
The deployment topology and content model are recorded in
|
|
[ADR-0001](adr/0001-headless-wagtail-astro.md) and
|
|
[ADR-0002](adr/0002-nginx-reverse-proxy.md). Optional TLS termination is recorded in
|
|
[ADR-0003](adr/0003-optional-letsencrypt.md).
|