TELEICU/Topology

referenceteleicuCARE 3.0+

The target topology for the TELEICU infrastructure across all 200+ sites.

Components

Control plane (cloud VMs)

1–3 virtual machines in reliable cloud environments, serving as the K3s control plane. These nodes:

- Run embedded etcd for HA control plane state - Host the K3s server process - Are reachable over Tailscale from all spoke/hub nodes - Run in cloud regions with stable power and internet - Are the management entry point for both Ansible and NixOS paths

Agent nodes (hospital sites)

Every hospital PC — whether spoke or hub — runs as a K3s agent node. Each agent:

- Runs K3s agent process, registered to the control plane - Hosts containerized TELEICU middleware workloads - Connects over Tailscale for all control-plane communication - Pulls its node-level configuration (Ansible pull or comin) - Reports monitoring data to VictoriaMetrics

Network topology

syntaxhighlight lang="text"

                       ┌─────────────────────┐
                       │   Cloud CP VM 1      │
                       │   (etcd member)      │
                       ├─────────────────────┤
                       │   Cloud CP VM 2      │
                       │   (etcd member)      │
                       ├─────────────────────┤
                       │   Cloud CP VM 3      │
                       │   (etcd member)      │
                       └──────────┬──────────┘
                                  │
                           Tailscale mesh
                                  │
           ┌──────────────────────┼──────────────────────┐
           │                      │                      │
           ▼                      ▼                      ▼
  ┌──────────────────┐  ┌──────────────────┐  ┌──────────────────┐
  │ Hub site (agent)  │  │ Spoke site (agent)│  │ Spoke site (agent)│
  │ K3s agent         │  │ K3s agent         │  │ K3s agent         │
  │ + middleware       │  │ + middleware       │  │ + middleware       │
  └──────────────────┘  └──────────────────┘  └──────────────────┘

syntaxhighlight

Node communication

All traffic between agent nodes and the control plane traverses Tailscale:

- K3s registration: agent → CP over Tailscale IPs - Configuration pull: ansible-pull or comin fetches from git repo (routed through CP or directly) - Metrics: node → VictoriaMetrics endpoint - Incident notifications: heartbeat missing → on-device agent classifies cause → alert routed to hub admin

No sensitive data in this page

IP addresses, subnets, DNS names, and specific cloud providers are not documented here. These are environment-specific and maintained in the deployment repository's encrypted variables.