Reference architecture for architects and IT

Overview

This document describes the reference architecture of the Noveu platform, intended for architects and technical decision-makers.

Architecture principles

1. Where data is stored

Data and backups in a Hetzner data centre in Falkenstein (Germany)
Cloudflare (US) sits at the edge of the network
Transparent supply chain

2. Modularity

Loosely coupled services
Replaceable components
API-first design

3. Resilience

Dedicated server at Hetzner
Every night an encrypted copy of the databases and the mail goes to separate object storage at Hetzner, outside this server and also in Falkenstein

4. Security by Design

Backups are encrypted
Defence in depth
Encryption in transit (TLS 1.2 or higher, TLS 1.3 is supported)

Logical Architecture

Web Portal and Customer portal
          |
      API Gateway
          |
Mail, Calendar, Files and Chat (beta)
          |
Identity, notifications, monitoring and backups
          |
Dedicated server at Hetzner, Falkenstein

Component Details

Presentation Layer

Component	Technology	Function
Web Portal	React, Next.js	Browser-based UI
Customer portal	React, Next.js	Subscriptions, invoices and support tickets
API Gateway	NestJS (own gateway)	Request routing, auth

Application Layer

Service	Responsibility	Storage
Mail Service	IMAP/SMTP, filtering	Object + DB
Calendar Service	CalDAV, scheduling	PostgreSQL
Files Service	REST API, versioning	Object + DB
Chat Service (beta)	Real-time messaging	PostgreSQL + Redis

Platform Layer

Component	Technology	Function
Identity (IAM)	Zitadel	Sign-in (OIDC), MFA and user management
Notification	Custom (noveu-notification-service)	Transactional and system notifications, channel routing
Observability	Prometheus, Grafana, GlitchTip	Metrics, dashboards, error reports
Backup	Backups	See Backup Strategy; backups are encrypted

Infrastructure Layer

Component	Specification	Redundancy
Compute	Dedicated server at Hetzner (Proxmox VE) in Falkenstein	One physical server
Storage	Storage on the same server
Backups	Backups in Falkenstein	Every night an encrypted copy of the databases and the mail goes to separate object storage at Hetzner, outside this server and also in Falkenstein
DNS/CDN	Cloudflare (US) at the edge of the network

Deployment Architecture

Multi-Tenant (SaaS)

┌────────────────────────────────────────────┐
│              Shared Platform                │
│  ┌────────┐  ┌────────┐  ┌────────┐        │
│  │  IAM   │  │ Billing│  │Provisn │        │
│  └────────┘  └────────┘  └────────┘        │
└────────────────────────────────────────────┘
              │         │         │
    ┌─────────┘         │         └─────────┐
    ▼                   ▼                   ▼
┌────────┐         ┌────────┐         ┌────────┐
│Tenant A│         │Tenant B│         │Tenant C│
│ (Data) │         │ (Data) │         │ (Data) │
└────────┘         └────────┘         └────────┘

Data Flow

Email Reception

Internet ─► MX ─► Antispam ─► Delivery ─► Mailbox
                    │           │
                    ▼           ▼
                 [Block]     [Store]

Authentication Flow

User ─► Client ─► API Gateway ─► IAM ─► Service
                      │          │         │
                      │    ┌─────┘         │
                      │    ▼               │
                      │  [Token]           │
                      │    │               │
                      └────┼───────────────┘
                           │
                           ▼
                    [Validate + Authorize]
                           │
                           ▼
                      [Response]

Security Architecture

Network Zones

Zone	Components	Ingress	Egress
Edge	Cloudflare (US), with a Tunnel to the server	Internet	Platform
Platform	Services, databases and storage on one VM	Edge	External services where needed
Mail	Mail server on its own VM	Internet (SMTP, IMAP)	Internet
Mgmt	Monitoring and management	Only via SSH over the Proxmox host	Platform

Services and databases run on the same VM.

Encryption

Layer	Mechanism	Key Management
Transport	TLS 1.2 or higher	Cloudflare at the edge; Let's Encrypt on the mail server
Backup	Backups are encrypted

Integration Patterns

Synchronous

Client ──► API Gateway ──► Service ──► Response
              │               │
              │          ┌────┴────┐
              │          ▼         ▼
              │      [Cache]   [Database]
              │
              └► [Rate Limit]

Disaster Recovery

Recovery

Backups are in the Hetzner data centre in Falkenstein (Germany), on a separate disk and VM. Backups are encrypted. Recovery takes place from those backups. Every night an encrypted copy of the databases and the mail goes to separate object storage at Hetzner, outside this server and also in Falkenstein.

Backup Strategy

Backups      ─► Hetzner data centre Falkenstein (DE)

Capacity

We agree on capacity for an organisation by quote.

Technology Choices

Category	Choice	Rationale
Containers	Docker on VMs; Coolify for the website and the login page	Simple management on one physical server (Proxmox)
Monitoring	Prometheus, Grafana and Uptime Kuma	Metrics, dashboards, availability and alerting
Error tracking	GlitchTip	Error reports
Database	PostgreSQL	Reliable, open source
Cache	Redis	Performance, pub/sub
Object storage	MinIO (S3-compatible)	In production in Falkenstein

Reference Architecture