This document describes the network layout of the [[ phacility_cluster | Phacility Cluster ]].
Overview
======
The Phacility cluster is deployed in an AWS VPC.
Most devices only accept connections from other devices within the cluster. Load balancers at the edge of the cluster accept external traffic and relay it to devices within the cluster, which may make additional service calls to other cluster services.
External Interfaces
======
These devices have external interfaces and accept requests from the public internet.
| Interface | Device | Notes |
|---|---|---|
| admin.phacility.com | alb | HTTP load balancer (ELB). Serves admin HTTP traffic. |
| bastion | bastion | Manages operational access. |
| vault.phacility.com | vault | SSH load balancer. Serves VCS SSH traffic.|
| *.phacility.com | lb | HTTP load balancer (ELB). Serves most HTTP traffic. |
Connection Restrictions
=======
Connections to devices within the network are restricted. This table summarizes the layers which provide restrictions.
| Restriction | Affects | Notes |
|---|---|---|
| AWS Security Rules | All Devices | Drops most inbound traffic. |
| `iptables` Rules | Normal Devices | Drops most inbound traffic. |
| Phabricator Rules | Application Servers | Restricts cluster devices and listening interfaces. |
| rSAAS Rules | Application Servers | Provides additional restrictions. |
| MySQL Rules | Database Servers | Prevents unrecognized connections. |