TELEICU/Topology: Difference between revisions

Content deleted Content added

VisualWikitext

Inline

Latest revision as of 09:05, 6 July 2026

referenceteleicuCARE 3.0+

The target topology for the TELEICU infrastructure across all 200+ sites.

Components

Control plane (cloud VMs)

1–3 virtual machines in reliable cloud environments, serving as the K3s control plane. These nodes:

Run embedded etcd for HA control plane state
Host the K3s server process
Are reachable over Tailscale from all spoke/hub nodes
Run in cloud regions with stable power and internet
Are the management entry point for both Ansible and NixOS paths

Agent nodes (hospital sites)

Every hospital PC — whether spoke or hub — runs as a K3s agent node. Each agent:

Runs K3s agent process, registered to the control plane
Hosts containerized TELEICU middleware workloads
Connects over Tailscale for all control-plane communication
Pulls its node-level configuration (Ansible pull or comin)
Reports monitoring data to VictoriaMetrics

Network topology

Node communication

All traffic between agent nodes and the control plane traverses Tailscale:

K3s registration: agent → CP over Tailscale IPs
Configuration pull: ansible-pull or comin fetches from git repo (routed through CP or directly)
Metrics: node → VictoriaMetrics endpoint
Incident notifications: heartbeat missing → on-device agent classifies cause → alert routed to hub admin

No sensitive data in this page

IP addresses, subnets, DNS names, and specific cloud providers are not documented here. These are environment-specific and maintained in the deployment repository's encrypted variables.

@@ Line 14: / Line 14: @@
 –3 virtual machines in reliable cloud environments, serving as the K3s control plane. These nodes:
-- Run embedded etcd for HA control plane state
+* Run embedded etcd for HA control plane state
-- Host the K3s server process
+* Host the K3s server process
-- Are reachable over Tailscale from all spoke/hub nodes
+* Are reachable over Tailscale from all spoke/hub nodes
-- Run in cloud regions with stable power and internet
+* Run in cloud regions with stable power and internet
-- Are the management entry point for both Ansible and NixOS paths
+* Are the management entry point for both Ansible and NixOS paths
 === Agent nodes (hospital sites) ===
@@ Line 24: / Line 24: @@
 Every hospital PC — whether spoke or hub — runs as a K3s agent node. Each agent:
-- Runs K3s agent process, registered to the control plane
+* Runs K3s agent process, registered to the control plane
-- Hosts containerized TELEICU middleware workloads
+* Hosts containerized TELEICU middleware workloads
-- Connects over Tailscale for all control-plane communication
+* Connects over Tailscale for all control-plane communication
-- Pulls its node-level configuration (Ansible pull or comin)
+* Pulls its node-level configuration (Ansible pull or comin)
-- Reports monitoring data to VictoriaMetrics
+* Reports monitoring data to VictoriaMetrics
 == Network topology ==
+{{#mermaid:flowchart TB
-syntaxhighlight lang="text"
+    subgraph CP["Cloud Control Plane"]
-                        ┌─────────────────────┐
-                        │   Cloud CP VM 1      │
+        CP1["CP VM 1<br/>(etcd)"]
-                        │   (etcd member)      │
+        CP2["CP VM 2<br/>(etcd)"]
+        CP3["CP VM 3<br/>(etcd)"]
-                        ├─────────────────────┤
+    end
-                        │   Cloud CP VM 2      │
-                        │   (etcd member)      │
+    TS["Tailscale Mesh"]
-                        ├─────────────────────┤
-                        │   Cloud CP VM 3      │
+    CP1 --- TS
-                        │   (etcd member)      │
+    CP2 --- TS
-                        └──────────┬──────────┘
+    CP3 --- TS
-                                   │
-                            Tailscale mesh
+    subgraph Agents["K3s Agent Nodes (200+)"]
-                                   │
+        H["Hub Node<br/>K3s agent<br/>+ middleware"]
-            ┌──────────────────────┼──────────────────────┐
+        S1["Spoke Node<br/>K3s agent<br/>+ middleware"]
-            │                      │                      │
+        S2["Spoke Node<br/>K3s agent<br/>+ middleware"]
-            ▼                      ▼                      ▼
+        SN["... (200 more)"]
-   ┌──────────────────┐  ┌──────────────────┐  ┌──────────────────┐
+    end
-   │ Hub site (agent)  │  │ Spoke site (agent)│  │ Spoke site (agent)│
-   │ K3s agent         │  │ K3s agent         │  │ K3s agent         │
+    TS --- H
-   │ + middleware       │  │ + middleware       │  │ + middleware       │
+    TS --- S1
-   └──────────────────┘  └──────────────────┘  └──────────────────┘
+    TS --- S2
-syntaxhighlight
+    TS --- SN
+}}
 == Node communication ==
@@ Line 60: / Line 62: @@
 All traffic between agent nodes and the control plane traverses Tailscale:
-- '''K3s registration''': agent → CP over Tailscale IPs
+* '''K3s registration''': agent → CP over Tailscale IPs
-- '''Configuration pull''': ansible-pull or comin fetches from git repo (routed through CP or directly)
+* '''Configuration pull''': ansible-pull or comin fetches from git repo (routed through CP or directly)
-- '''Metrics''': node → VictoriaMetrics endpoint
+* '''Metrics''': node → VictoriaMetrics endpoint
-- '''Incident notifications''': heartbeat missing → on-device agent classifies cause → alert routed to hub admin
+* '''Incident notifications''': heartbeat missing → on-device agent classifies cause → alert routed to hub admin
 == No sensitive data in this page ==
 IP addresses, subnets, DNS names, and specific cloud providers are not documented here. These are environment-specific and maintained in the deployment repository's encrypted variables.
+{{Navbox TELEICU}}
 {{Related}}