260209:1642 Update Infrastructure 3

2026-02-09 16:42:27 +07:00
parent fe0f8aade7
commit d5e37d986f
10 changed files with 926 additions and 254 deletions
--- a/specs/08-infrastructure/02_Network_daigram.md
+++ b/specs/08-infrastructure/02_Network_daigram.md
@@ -0,0 +1,290 @@
+# 🗺️ แผนผัง Network Architecture & Container Services (LCBP3-DMS)
+
+แผนผังนี้แสดงการแบ่งส่วนเครือข่าย (VLANs), การเชื่อมต่อ Firewall (ACLs) และบทบาทของ Server ทั้งสองตัว (QNAP: Application, ASUSTOR: Infrastructure)
+
+> 📖 **ดูรายละเอียด Server Roles และ Service Distribution ได้ที่:** [README.md](README.md#-hardware-infrastructure)
+
+---
+
+## 1. Data Flow Diagram
+
+```mermaid
+flowchart TB
+    subgraph Internet["🌐 Internet"]
+        User[("👤 User")]
+    end
+
+    subgraph QNAP["💾 QNAP TS-473A (App Server)"]
+        NPM["🔲 NPM<br/>(Reverse Proxy)"]
+        Frontend["📱 Next.js<br/>(Frontend)"]
+        Backend["⚙️ NestJS<br/>(Backend API)"]
+        DB["🗄️ MariaDB"]
+        Redis["📦 Redis"]
+        ES["🔍 Elasticsearch"]
+    end
+
+    subgraph ASUSTOR["💾 ASUSTOR AS5403T (Infra Server)"]
+        Portainer["🐳 Portainer"]
+        Registry["📦 Registry"]
+        Prometheus["📊 Prometheus"]
+        Grafana["📈 Grafana"]
+        Uptime["⏱️ Uptime Kuma"]
+        Backup["💾 Restic/Borg"]
+        NFS["📁 NFS Storage"]
+    end
+
+    User -->|HTTPS 443| NPM
+    NPM --> Frontend
+    NPM --> Backend
+    Frontend --> Backend
+    Backend --> DB
+    Backend --> Redis
+    Backend --> ES
+
+    DB -.->|Scheduled Backup| Backup
+    Backup --> NFS
+
+    Portainer -.->|Manage| QNAP
+    Prometheus -.->|Collect Metrics| Backend
+    Prometheus -.->|Collect Metrics| DB
+    Uptime -.->|Health Check| NPM
+```
+
+---
+
+## 2. Docker Management View
+
+```mermaid
+flowchart TB
+    subgraph Portainer["🐳 Portainer (ASUSTOR - Central Management)"]
+        direction TB
+
+        subgraph LocalStack["📦 Local Infra Stack"]
+            Registry["Docker Registry"]
+            Prometheus["Prometheus"]
+            Grafana["Grafana"]
+            Uptime["Uptime Kuma"]
+            Backup["Restic/Borg"]
+            Loki["Loki (Logs)"]
+            ClamAV["ClamAV"]
+        end
+
+        subgraph RemoteStack["🔗 Remote: QNAP App Stack"]
+            Frontend["Next.js"]
+            Backend["NestJS"]
+            MariaDB["MariaDB"]
+            Redis["Redis"]
+            ES["Elasticsearch"]
+            NPM["NPM"]
+            Gitea["Gitea"]
+            N8N["n8n"]
+            PMA["phpMyAdmin"]
+        end
+    end
+```
+
+---
+
+## 3. Security Zones Diagram
+
+```mermaid
+flowchart TB
+    subgraph PublicZone["🌐 PUBLIC ZONE"]
+        direction LR
+        NPM["NPM (Reverse Proxy)"]
+        SSL["SSL/TLS Termination"]
+    end
+
+    subgraph AppZone["📱 APPLICATION ZONE (QNAP)"]
+        direction LR
+        Frontend["Next.js"]
+        Backend["NestJS"]
+        N8N["n8n"]
+        Gitea["Gitea"]
+    end
+
+    subgraph DataZone["💾 DATA ZONE (QNAP - Internal Only)"]
+        direction LR
+        MariaDB["MariaDB"]
+        Redis["Redis"]
+        ES["Elasticsearch"]
+    end
+
+    subgraph InfraZone["🛠️ INFRASTRUCTURE ZONE (ASUSTOR)"]
+        direction LR
+        Backup["Backup Services"]
+        Registry["Docker Registry"]
+        Monitoring["Prometheus + Grafana"]
+        Logs["Loki / Syslog"]
+    end
+
+    PublicZone -->|HTTPS Only| AppZone
+    AppZone -->|Internal API| DataZone
+    DataZone -.->|Backup| InfraZone
+    AppZone -.->|Metrics| InfraZone
+```
+
+---
+
+## 4. แผนผังการเชื่อมต่อเครือข่าย (Network Flow)
+
+```mermaid
+graph TD
+    direction TB
+
+    subgraph Flow1["การเชื่อมต่อจากภายนอก (Public WAN)"]
+        User["ผู้ใช้งานภายนอก (Internet)"]
+    end
+
+    subgraph Router["Router (ER7206) - Gateway"]
+        User -- "Port 80/443 (HTTPS/HTTP)" --> ER7206
+        ER7206["Port Forwarding<br/>TCP 80 → 192.168.10.8:80<br/>TCP 443 → 192.168.10.8:443"]
+    end
+
+    subgraph VLANs["เครือข่ายภายใน (VLANs & Firewall Rules)"]
+        direction LR
+
+        subgraph VLAN10["VLAN 10: Servers<br/>192.168.10.x"]
+            QNAP["QNAP NAS<br/>(192.168.10.8)"]
+            ASUSTOR["ASUSTOR NAS<br/>(192.168.10.9)"]
+        end
+
+        subgraph VLAN20["VLAN 20: MGMT<br/>192.168.20.x"]
+            AdminPC["Admin PC / Switches"]
+        end
+
+        subgraph VLAN30["VLAN 30: USER<br/>192.168.30.x"]
+            OfficePC["PC พนักงาน/Wi-Fi"]
+        end
+
+        subgraph VLAN70["VLAN 70: GUEST<br/>192.168.70.x"]
+            GuestPC["Guest Wi-Fi"]
+        end
+
+        subgraph Firewall["Firewall ACLs (OC200/ER7206)"]
+            direction TB
+            rule1["Rule 1: DENY<br/>Guest (VLAN 70) → All VLANs"]
+            rule2["Rule 2: DENY<br/>Server (VLAN 10) → User (VLAN 30)"]
+            rule3["Rule 3: ALLOW<br/>User (VLAN 30) → QNAP<br/>Ports: 443, 80"]
+            rule4["Rule 4: ALLOW<br/>MGMT (VLAN 20) → All"]
+        end
+
+        GuestPC -.x|rule1| QNAP
+        QNAP -.x|rule2| OfficePC
+        OfficePC -- "https://lcbp3.np-dms.work" -->|rule3| QNAP
+        AdminPC -->|rule4| QNAP
+        AdminPC -->|rule4| ASUSTOR
+    end
+
+    ER7206 --> QNAP
+
+    subgraph DockerQNAP["Docker 'lcbp3' (QNAP - Applications)"]
+        direction TB
+
+        subgraph PublicServices["Services ที่ NPM เปิดสู่ภายนอก"]
+            direction LR
+            NPM["NPM (Nginx Proxy Manager)"]
+            FrontendC["frontend:3000"]
+            BackendC["backend:3000"]
+            GiteaC["gitea:3000"]
+            PMAC["pma:80"]
+            N8NC["n8n:5678"]
+        end
+
+        subgraph InternalServices["Internal Services (Backend Only)"]
+            direction LR
+            DBC["mariadb:3306"]
+            CacheC["cache:6379"]
+            SearchC["search:9200"]
+        end
+
+        NPM -- "lcbp3.np-dms.work" --> FrontendC
+        NPM -- "backend.np-dms.work" --> BackendC
+        NPM -- "git.np-dms.work" --> GiteaC
+        NPM -- "pma.np-dms.work" --> PMAC
+        NPM -- "n8n.np-dms.work" --> N8NC
+
+        BackendC -- "lcbp3 Network" --> DBC
+        BackendC -- "lcbp3 Network" --> CacheC
+        BackendC -- "lcbp3 Network" --> SearchC
+    end
+
+    subgraph DockerASUSTOR["Docker 'lcbp3' (ASUSTOR - Infrastructure)"]
+        direction TB
+
+        subgraph InfraServices["Infrastructure Services"]
+            direction LR
+            PortainerC["portainer:9443"]
+            RegistryC["registry:5000"]
+            PrometheusC["prometheus:9090"]
+            GrafanaC["grafana:3000"]
+            UptimeC["uptime-kuma:3001"]
+        end
+
+        subgraph BackupServices["Backup & Storage"]
+            direction LR
+            ResticC["restic/borg"]
+            NFSC["NFS Share"]
+        end
+
+        PortainerC -.->|"Remote Endpoint"| NPM
+        PrometheusC -.->|"Scrape Metrics"| BackendC
+        ResticC --> NFSC
+    end
+
+    QNAP --> NPM
+    ASUSTOR --> PortainerC
+    DBC -.->|"Scheduled Backup"| ResticC
+```
+
+---
+
+## 5. Firewall & Security Configuration
+
+> 📖 **ดูรายละเอียด Firewall ACLs และ Port Forwarding ได้ที่:** [03_Securities.md](03_Securities.md)
+
+ไฟล์ `03_Securities.md` ประกอบด้วย:
+- 🌐 VLAN Segmentation
+- 🔥 Firewall Rules (IP Groups, Port Groups, Switch ACL, Gateway ACL)
+- 🚪 Port Forwarding Configuration
+
+---
+
+## 6. Container Service Distribution
+
+> 📖 **ดูรายละเอียด Container Services, Ports, และ Domain Mapping ได้ที่:** [README.md](README.md#-domain-mapping-npm-proxy)
+
+---
+
+## 7. Backup Flow
+
+```mermaid
+flowchart LR
+    subgraph QNAP["💾 QNAP TS-473A (Source)"]
+        direction TB
+        DB["🗄️ MariaDB<br/>(mysqldump)"]
+        Redis["📦 Redis<br/>(RDB + AOF)"]
+        Config["⚙️ App Config<br/>+ Volumes"]
+    end
+
+    subgraph ASUSTOR["💾 ASUSTOR AS5403T (Target)"]
+        direction TB
+        BackupDB["📁 /volume1/backup/db/<br/>(Restic Repository)"]
+        BackupRedis["📁 /volume1/backup/redis/"]
+        BackupConfig["📁 /volume1/backup/config/"]
+    end
+
+    DB -->|"Daily 2AM"| BackupDB
+    Redis -->|"Daily 3AM"| BackupRedis
+    Config -->|"Weekly Sun 4AM"| BackupConfig
+
+    subgraph Retention["📋 Retention Policy"]
+        R1["Daily: 7 days"]
+        R2["Weekly: 4 weeks"]
+        R3["Monthly: 6 months"]
+    end
+```
+
+---
+
+> 📝 **หมายเหตุ**: เอกสารนี้อ้างอิงจาก Architecture Document **v1.8.0** - Last updated: 2026-01-28