Meridian Logistics — the architecture

The architecture built across the course, M03 → M13. Click a module to open its detail; ⚙ shows the build module by module.
Master view · through M13
✕ Close
Microsoft Azure — control plane M03 › shared trust spiffe://meridian.ziti · OIDC auth · quorum 2 of 3 East US Central US West Europe RAFT RAFT ctrl1 preferredLeader ctrl2 preferredLeader ctrl3 voter control channel :1280 · all routers → all controllers dial out · edge + link :3022 Microsoft Azure — public edge M04 › rendezvous + ingress · edge + link :3022 link mesh :3022 er-pub-01 East US er-pub-02 Central India Remote identities M04 › outside · dial the nearest edge remote-laptop laptop tunneler edge :3022 On-prem DC M04 › North America DC · NAT · dials OUT er-nam-01 tunneling ER er-nam-02 HA pair app-nam-01 yard.meridian.internal hosts JWT trust OIDC sign-in Microsoft Entra ID M05 › external IdP · OIDC / JWT Entra ID role Logistics identity #remote-users partner-01 OS posture · TOTP at login Docker host M06 › compose = IaC · dials out partner-portal portal.meridian.internal er-pp-01 Docker ER · #er-docker Ubuntu fleet M07 › snet-tun-eus-01 · systemd linux-fleet-01 by hand #employee linux-fleet-02 cloud-init #employee linux-fleet-03 cloud-init #employee OTT · auto-enroll on first start ziti-host-pp-01 hosts the portal er-sc-dispatch-01 tproxy sidecar docker-host-01 host-gateway · optional Kubernetes M09 › AKS snet-aks-eus-01 + k3d aks-meridian-lab-eus-01 wms-ziti-host meridian-wms dispatch tproxy sidecar node-proxy DaemonSet · DNS k3d · meridian-yard-edge telemetry yard edge · Bind dispatch → by name Observability M10 › agents push · AKS obs pool Grafana 10 panels · 2 alerts Elasticsearch + Kibana · ES: 3 IPs Day-2 ops M11 › backup proven by a restore backup set snapshot+config+PKI restore rig via db: · 17·6·12 cert calendar dated · CAs 2036 Upgrade 2.0.6 M12 › 2.0.3 → 2.0.6 · runbook canary M11 rig · 2.0.6 the upgrade read-only ~60 s SE Asia non-voter ctrl4 --non-voting Azure Southeast Asia M13 › 10.40.0.0/16 · 5 VMs · lab only to er-pub :3022 er-sea-01 --private er-sea-02 --private erp-apac linux-fleet-ap-01 depot · #apac-depot ziti-host-wms-ap-01 host #2 · meridian-wms one meridian-wms · two hosts SEA served locally · ~0.017 s ctrl4 = the only public address
100%
scroll to zoom · drag to pan · ⚙ reveal modules one by one
controller / service edge router tunneler identity external IdP ops artifact
management — to the control plane fabric / dial — router ↔ router, site → edge hosting / service path identity / auth