bisco
1.8 KiB
Architecture
The system has four default runtime components and one optional component on the Docker Compose network:
- NGINX accepts requests for
azionelab.organd routes them by path. - Astro renders the public single page and requests one aggregate JSON document.
- Wagtail/Django manages editorial content, serves media in development, and exposes
the read-only
/api/site/home/endpoint. - PostgreSQL persists Wagtail content and metadata.
- When explicitly enabled, Certbot obtains and renews a Let's Encrypt certificate by writing HTTP-01 challenges and certificate files to shared named volumes.
NGINX sends /admin, /api, /documents, /health, /media, and /static paths to
Wagtail. All remaining paths go to Astro. Unknown virtual hosts receive a 404 response.
The ACME challenge path is served directly from its shared volume. If automatic TLS is
enabled, NGINX starts in HTTP mode, detects the first certificate, adds its HTTPS
virtual host, redirects application traffic to HTTPS, and reloads after renewals.
The aggregate response contains settings, homepage, feature_cards, teacher,
lesson_info, shows, and gallery_items. Image values contain browser-facing URLs
and alternative text. Only published home content and records marked for home display
are exposed. Astro validates/normalizes the response and falls back to checked-in
Italian demo content if fetching fails.
Wagtail's authenticated admin remains the only editing interface. The public frontend has no database access and no public write API. Uploaded media is stored in a dedicated Compose volume.
The deployment topology and content model are recorded in ADR-0001 and ADR-0002. Optional TLS termination is recorded in ADR-0003.