hatiyildiz 7cafa3c894 docs(seaweedfs+guacamole): replace MinIO with SeaweedFS as unified S3 encapsulation; add Guacamole to bp-relay

Component-level architectural correction (two changes):

1. MinIO → SeaweedFS as unified S3 encapsulation layer

The old design used MinIO for in-cluster S3 plus separate cold-tier configuration scattered across consumers. The new design positions SeaweedFS as the single S3 encapsulation layer: every Catalyst component talks to one endpoint (seaweedfs.storage.svc:8333). SeaweedFS internally handles hot tier (in-cluster NVMe), warm tier (in-cluster bulk), and cold tier (transparent passthrough to cloud archival storage — Cloudflare R2 / AWS S3 / Hetzner Object Storage / etc., chosen at Sovereign provisioning). One audit/lifecycle/encryption boundary instead of N. No Catalyst component talks to cloud S3 directly anymore — Velero, CNPG WAL archive, OpenSearch snapshots, Loki/Mimir/Tempo, Iceberg, Harbor blob store, Application buckets all share one S3 surface.

2. Apache Guacamole added as Application Blueprint §4.5 Communication

Clientless browser-based RDP/VNC/SSH/kubectl-exec gateway. Keycloak SSO, full session recording to SeaweedFS for compliance evidence (PSD2/DORA/SOX). Composed into bp-relay. Replaces VPN+native-client distribution for auditable remote access.

Component changes:
- DELETED: platform/minio/
- CREATED: platform/seaweedfs/README.md (unified S3 + cold-tier encapsulation; bucket layout; multi-region replication via shared cold backend; migration-from-MinIO section)
- CREATED: platform/guacamole/README.md (clientless remote-desktop gateway; GuacamoleConnection CRD; compliance integration via session recordings)

Doc updates: PLATFORM-TECH-STACK §1+§3.5+§4.5+§5+§7.4; TECHNOLOGY-FORECAST L11+mandatory+a-la-carte counts (52 → 53); ARCHITECTURE §3 topology; SECURITY §4 DB engines; SOVEREIGN-PROVISIONING §1 inputs; SRE §2.5+§7; IMPLEMENTATION-STATUS §3; BLUEPRINT-AUTHORING stateful examples; BUSINESS-STRATEGY 13 component-count anchors + Relay product line; README.md backup row; CLAUDE.md folder count.

Component README updates (S3 endpoint + dependency renames): cnpg, clickhouse, flink, gitea, iceberg, harbor, grafana, livekit, kserve, milvus, opensearch, flux, stalwart, velero (substantive rewrite of velero — now writes exclusively to SeaweedFS with cold-tier auto-routing). Products: relay, fabric.

UI scaffold: products/catalyst/bootstrap/ui/src/shared/constants/components.ts — minio entry replaced with seaweedfs; velero+harbor deps updated; new guacamole entry added.

VALIDATION-LOG entry "Pass 104 — MinIO → SeaweedFS swap + Guacamole add" captures the encapsulation principle and adds Lesson #22: storage tier policy belongs at the encapsulation boundary, not inside every consumer.

Verification: zero remaining MinIO references in canonical docs (one intentional retention in TECHNOLOGY-FORECAST L37 explaining the swap); 53 platform/ folders matching all "53 components" anchors; bp-relay composition includes guacamole.

2026-04-28 10:23:46 +02:00

2.5 KiB

Raw Blame History

OpenOva Relay

Enterprise communication platform with email, video, chat, and WebRTC.

Status: Accepted | Updated: 2026-02-26

Overview

OpenOva Relay bundles self-hosted communication components into a unified enterprise communication product. It provides email, real-time video/audio, team messaging, and WebRTC infrastructure.

flowchart TB
    subgraph Email["Email"]
        Stalwart[Stalwart<br/>JMAP/IMAP/SMTP]
    end

    subgraph Video["Video & Audio"]
        LiveKit[LiveKit<br/>WebRTC SFU]
        STUNner[STUNner<br/>TURN/STUN]
    end

    subgraph Chat["Team Messaging"]
        Matrix[Matrix/Synapse<br/>Federation]
    end

    subgraph Auth["Identity"]
        Keycloak[Keycloak SSO]
    end

    Auth --> Email
    Auth --> Video
    Auth --> Chat
    STUNner --> LiveKit

Components

All components are in platform/ (flat structure):

Component	Purpose	Location
stalwart	Email server (JMAP/IMAP/SMTP)	platform/stalwart
livekit	Video/audio/data (WebRTC SFU)	platform/livekit
stunner	Kubernetes-native TURN/STUN	platform/stunner
matrix	Team chat (Matrix/Synapse)	platform/matrix

Optional Dependencies

Component	Purpose
Keycloak	SSO across all communication services
CNPG	PostgreSQL backend for Matrix and Stalwart
SeaweedFS	Recording and attachment storage

Use Cases

Enterprise Email

Self-hosted email with JMAP/IMAP/SMTP, spam filtering, and compliance archiving.

Video Conferencing

WebRTC-based video calls, screen sharing, and recording with Kubernetes-native TURN/STUN.

Team Messaging

End-to-end encrypted team chat with federation support, bridges (Slack, IRC), and webhook integrations.

Resource Requirements

Component	Replicas	CPU	Memory
Stalwart	2	1	2Gi
LiveKit	2	2	4Gi
STUNner	2	0.5	512Mi
Matrix/Synapse	2	1	2Gi
Total	-	9	17Gi

Deployment

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: relay
  namespace: flux-system
spec:
  interval: 10m
  path: ./products/relay/deploy
  prune: true
  sourceRef:
    kind: GitRepository
    name: openova-blueprints

Part of OpenOva

2.5 KiB Raw Blame History