DracoByte Estate - Three Sites, Two Traffic Planes

DracoByte Estate - Three Sites, Two Traffic Planes An architecture diagram generated by Archify. Customers & Staff · browsers · Architecture component Customers & Staff browsers Cloudflare · orange-clouded names · Architecture component · edge Cloudflare orange-clouded names edge CT211 nginx · 10.41.0.2 · TLS ends here · NYC · PVE-NYC001-Store - control plane · NYC DMZ CT211 nginx 10.41.0.2 · TLS ends here NYC DMZ Pterodactyl Panel · CT102 · 10.21.0.10 · v1.14.1 · NYC · PVE-NYC001-Store - control plane Pterodactyl Panel CT102 · 10.21.0.10 · v1.14.1 Paymenter Billing · CT103 · 10.21.0.11 · NYC · PVE-NYC001-Store - control plane Paymenter Billing CT103 · 10.21.0.11 NYC data tier · MariaDB · Redis · Postgres · NYC · PVE-NYC001-Store - control plane NYC data tier MariaDB · Redis · Postgres CT111 nginx · 10.40.0.2 · status, webmail · LAX · reliablesite - ingress + compute · LAX DMZ CT111 nginx 10.40.0.2 · status, webmail LAX DMZ node001 · VM104 · free tier · 1487 servers · LAX · reliablesite - ingress + compute · auto-sleep node001 · VM104 free tier · 1487 servers auto-sleep node002 · VM116 · paid tier · 22 servers · LAX · reliablesite - ingress + compute · no sleep node002 · VM116 paid tier · 22 servers no sleep wings-eu · VM300 · free tier · 58 servers · EU · dracobyte-eu - standalone · auto-sleep wings-eu · VM300 free tier · 58 servers auto-sleep Minecraft Players · game clients · Architecture component Minecraft Players game clients HTTPS 443 → 206.221.176.238 443 → 104.238.221.3 HTTP :80, same site HTTP :80 MariaDB + Redis MariaDB wings API over wg0 mesh 10.99.0.0/24 HTTP :8080 HTTPS :443 wings API :443, public path + EU DNAT TCP/UDP 25565-27564, host DNAT 25565-26564 25565-26481 NYC · PVE-NYC001-Store - control plane LAX · reliablesite - ingress + compute EU · dracobyte-eu - standalone Legend Backend Database Cloud Security External

The front door is split

  • • panel + billing terminate TLS on CT211 in NYC, one hop from the apps
  • • status + webmail still terminate on CT111 in LAX
  • • status.dracobyte.pro is grey-clouded: Cloudflare is not in front of it at all
  • • The LAX panel/billing vhosts remain as an instant DNS rollback

Game traffic is a separate plane

  • • Minecraft bypasses Cloudflare and both reverse proxies entirely
  • • Each PVE host DNATs its own public IP straight to its wings node
  • • node002 is reserved for paid servers and runs no sleep/wake automation
  • • wings-eu is a NAT'd guest, so allocations use 10.32.0.30, not the public IP

Single points to watch

  • • Every production database lives in NYC only, with no offsite copy
  • • The corosync QDevice at 10.99.0.3 is uninventoried, unpatched and unmonitored
  • • EU is standalone: not clustered, so it inherits no cluster backup job
  • • LAX↔NYC is 57 ms; LAX↔EU is 163 ms