Skip to content

INVA platform architecture

Target architecture per the master runbook v5.0 (INVA_Platform_Master_Architecture_Claude_Code_Runbook_v5.0.md, Parts A–U), annotated with live deployment state as of 2026-07-12. Reality wins over diagrams: when they disagree, fix this page.

System topology

Five hosts across three zones — Google Cloud, the WireGuard overlay, and the local site — fronted by Cloudflare on the public edge.

flowchart TB
    subgraph EDGE["Public edge — Cloudflare"]
        CF_DNS["DNS zone inva.is<br/>(8 records incl. live MX)"]
        CF_PAGES["Pages: inva-is<br/><i>preview deployed ✓</i>"]
        CF_TUN["Tunnels + Access<br/><i>planned</i>"]
    end

    subgraph GCP["Google Cloud — inva-vpc 10.20.0.0/24"]
        NET["inva-network-01<br/>WireGuard hub (wg-easy v15)<br/>10.20.0.2 · pub 34.6.75.87<br/><b>LIVE ✓</b>"]
        ENG["inva-engineering-01<br/>control plane (Claude Code)<br/>10.20.0.20<br/><b>LIVE ✓ (this VM)</b>"]
        PLAT["inva-platform-01<br/>Authentik · Infisical · Emma Core<br/>10.20.0.30<br/><i>not created</i>"]
        GW["inva-gateway-01<br/>OpenClaw channel gateway<br/>10.20.0.40<br/><i>not created</i>"]
    end

    subgraph LOCAL["Local site (physical)"]
        BOX["inva-local-01 (inva-ai-lab)<br/>RTX 3080 AI + NAS (Part R)<br/><b>SSH ✓ · WG ✓</b><br/><i>GPU driver + ZFS pending</i>"]
        MAC["eythor-mac-primary<br/><i>WG peer created,<br/>not installed</i>"]
    end

    CF_DNS --- CF_PAGES
    CF_TUN -.->|"auth.inva.is, emma.inva.is, docs.inva.is (Outline), …"| PLAT
    NET ===|"WireGuard overlay 10.30.0.0/24"| ENG
    NET ===|WG| BOX
    NET -.-|"WG (pending device install)"| MAC
    NET -.-|WG| PLAT
    NET -.-|WG| GW
    ENG -->|"SSH (managed key)"| BOX
    ENG -->|"SSH (VPC)"| NET

WireGuard overlay (Part I) — live state

Hub 10.30.0.1 (wg-easy v15 on inva-network-01), UDP 51820 public, UI private on 10.20.0.2:51821. The hub owns client keypairs; inva-local-01 is the one static peer (on-device key, re-asserted by wg-static-peers.timer within ~30 s of any regeneration).

Peer Address State 2026-07-12
hub 10.30.0.1 live
inva-engineering-01 10.30.0.5 active — handshakes fresh, overlay-only AllowedIPs
inva-local-01 10.30.0.4 active — static peer, ~50 ms RTT from eng VM
eythor-mac-primary 10.30.0.10 created, awaiting device install
inva-platform-01 / inva-gateway-01 .2 / .3 reserved (VMs don't exist)
humans (Aron, Agnar, Hilmar, Jóhannes) .11–.14 reserved, activate per device

Identity and secrets flow (Parts B–C) — all planned

flowchart LR
    OWNER["inva@inva.is<br/>owner / break-glass<br/><b>main account for everything</b>"]
    AUTHENTIK["Authentik (SSO)<br/>auth.inva.is<br/><i>not deployed</i>"]
    GSM["Google Secret Manager<br/>bootstrap + recovery secrets<br/><b>in use ✓</b> (wg-easy admin)"]
    INF["Infisical<br/>operational secrets<br/><i>not deployed</i>"]
    OP["1Password<br/>human credentials<br/><i>process only</i>"]
    APPS["Apps: Emma · docs · ops<br/>via Cloudflare Access + Authentik"]
    MACHINES["Machine identities<br/>(VM SA · GitHub PAT→App · CF token)"]

    OWNER -->|provisions| AUTHENTIK
    AUTHENTIK -->|OIDC/SAML| APPS
    GSM -->|secret-zero| INF
    INF -->|runtime injection| APPS
    OWNER -.->|break-glass recovery| GSM
    MACHINES -->|"GCP-native auth"| INF
    OP -.-> OWNER

Current reality: secrets live in Google Secret Manager (wg-easy admin password) plus two 600-mode token files on the engineering VM pending Secret Manager migration (approval item). Authentik/Infisical await inva-platform-01.

Local NAS (Part R) — design vs. hardware reality

flowchart TB
    subgraph TARGET["Target (Part R) — pending 2× NAS-rated drives"]
        POOL["ZFS pool <b>tank</b> (mirror)<br/>compression, posixacl, by-id devices"]
        DS["datasets: shared · projects · documents · media ·<br/>ai-data · software · backups · timemachine · users/* · application/*"]
        SMB["SMB3-only shares over WireGuard<br/>fruit/streams_xattr for macOS · no guest"]
        POOL --> DS --> SMB
    end
    subgraph NOW["Live hardware (verified + SMART-baselined 2026-07-12)"]
        SDA["sda 1TB 870 QVO (boot)<br/>healthy · 300G / + 300G /srv/nas LV"]
        SDB["sdb 2TB Seagate<br/><b>1856 reallocated sectors @ 4.8y</b><br/>→ never authoritative (per R2)"]
        NVME["nvme 512GB<br/>healthy · /data scratch"]
    end
    NOW -.->|"P4 gate: exact disk-ID approval<br/>before any pool creation"| TARGET

Execution order (Parts L/T) — where we are

flowchart LR
    P1["1. Governance<br/>+ repo scaffold<br/><b>done ✓</b>"] --> P2["2. WireGuard mesh<br/>hub + eng + local box<br/><b>done ✓</b> (Mac pending)"]
    P2 --> P3["3. Website<br/><b>preview ✓</b><br/>production gated"]
    P3 --> P4["4. inva-platform-01<br/>Authentik + Infisical<br/><i>next major build</i>"]
    P4 --> P5["5. Emma + Gateway<br/>(OpenClaw, Part M)"]
    P5 --> P6["6. NAS build (Part R)<br/>+ local AI serving"]
    P6 --> P7["7. Voice (Part P)<br/>+ monitoring/CI"]

Full issue list, root causes, and held approvals: see Morning approvals 2026-07-12 and the consolidated evaluation (in progress).