Architecture¶

High-level view of CloudXM's platform. Two hosting realities:

Cloudflare edge — public sites (this wiki, CloudXM site, SupraMax storefront) on Cloudflare Pages, protected with Cloudflare Access where required.
VPS prd1 (Hostinger) — backend services (Laravel/PHP-FPM apps, Docker services, databases) behind nginx.

Global view¶

flowchart TB
    subgraph Internet
        U[Employees] -->|Google SSO| ACCESS[Cloudflare Access]
        C[Customers / Public] --> EDGE
    end

    subgraph CF[Cloudflare edge]
        EDGE[DNS + CDN + WAF]
        ACCESS -->|allowed| WIKI[wiki.cloudxm.com.br - Pages]
        EDGE --> SITE[cloudxm.com.br - Pages]
        EDGE --> SM[supramax.log.br - Pages storefront]
        EDGE --> VPS[VPS prd1 origin]
    end

    subgraph VPS1[VPS prd1 - Hostinger 2.24.212.12]
        NGX[nginx 80/443]
        NGX --> PHP[PHP-FPM apps: ShopXM, plugins]
        NGX --> DOCKER[Docker services]
        DOCKER --> CONV[Convert API 8000 / console 3099]
        DOCKER --> VEN[Vendure 3001 + Chatwoot 3100]
        PHP --> MARIA[(MariaDB)]
        VEN --> PG[(PostgreSQL 17)]
        CONV --> PG
        PHP --> REDIS[(Redis)]
    end

    EDGE -->|TLS proxied| NGX

Access flow (this wiki)¶

sequenceDiagram
    participant U as Employee
    participant A as Cloudflare Access
    participant G as Google Workspace
    participant W as Wiki (Pages)

    U->>A: GET wiki.cloudxm.com.br
    A->>G: OIDC authorize (Google sign-in)
    G-->>A: identity + groups
    A->>A: policy check (employees group)
    alt allowed
        A->>W: proxy request
        W-->>U: page
    else denied
        A-->>U: 403 blocked
    end

VPS prd1 service map¶

Layer	Technology	Managed by
Reverse proxy	nginx (native)	cloudxm-infra
PHP apps	PHP-FPM 8.2/8.4 pools, per-app user/socket	cloudxm-infra
Databases	PostgreSQL 17 (native), MariaDB 10.11 (native)	cloudxm-infra
Cache/queues	Redis 7 (native)	cloudxm-infra
Container runtime	Docker + Compose, per-service	each app repo
Firewall	UFW — 22/80/443 (+ Docker bridges for PG/Redis)	cloudxm-infra

Port allocation¶

Range	Owner
3000–3999	SupraMax (Vendure 3001, Chatwoot 3100, staging +10000)
8000–8199	Convert (API 8000, console 3099; staging 8100/8180)
5432 / 3306 / 6379	PostgreSQL / MariaDB / Redis (native)

Full port audit: see cloudxm-infra repo (references/port-map.md).

Environments¶

Environment	Purpose	Where
Production	Live client traffic	VPS prd1 / Cloudflare Pages (`main`)
Staging	Pre-release validation	VPS prd1 (same machine, offset ports) / Pages preview
Sandbox	Isolated experiments (ShopXM/NFSe)	VPS prd1

CI/CD pipeline (this wiki as example)¶

flowchart LR
    PUSH[git push] --> GL[GitLab CI]
    GL -->|MR / feature branch| PREV[build + wrangler pages deploy --branch X]
    GL -->|main| PROD[build + wrangler pages deploy --branch main]
    PREV --> PP[preview.pages.dev - Access protected]
    PROD --> WP[wiki.cloudxm.com.br - Access protected]

Single source of truth¶

Infrastructure config: emcloud/cloudxm-infra (nginx, PHP, DB, firewall, backups).
Application config & deploy logic: each application repo (never in infra).
DNS & edge (Pages, Access): Cloudflare dashboard / API — not in git.