Architectuur Referentie
Overzicht
Dit document beschrijft de referentiearchitectuur van het Noveu platform, bedoeld voor architects en technische beslissers.
Architectuurprincipes
1. Soevereiniteit
- Alle data binnen EU juridisch bereik
- Geen US cloud providers in kritieke paden
- Transparante supply chain
2. Modulairiteit
- Loosely coupled services
- Vervangbare componenten
- API-first design
3. Resilience
- Geen single points of failure
- Graceful degradation
- Self-healing systemen
4. Security by Design
- Zero trust networking
- Defense in depth
- Encryption everywhere
Logische Architectuur
┌─────────────────────────────────────────────────────────────────────┐
│ PRESENTATION LAYER │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ │
│ │ Web │ │ Desktop │ │ Mobile │ │ Outlook │ │ API │ │
│ │ Portal │ │ Client │ │ Apps │ │ Plugin │ │ Gateway │ │
│ └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘ │
└───────┼────────────┼────────────┼────────────┼────────────┼────────┘
│ │ │ │ │
└────────────┴────────────┼────────────┴────────────┘
│
┌───────┴───────┐
│ API Gateway │
│ + AuthN │
└───────┬───────┘
│
┌─────────────────────────────────┼─────────────────────────────────┐
│ APPLICATION LAYER │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ │
│ │ Mail │ │Calendar │ │ Files │ │ Chat │ │ AI │ │
│ │ Service │ │ Service │ │ Service │ │ Service │ │ Service │ │
│ └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘ │
└───────┼────────────┼────────────┼────────────┼────────────┼───────┘
│ │ │ │ │
└────────────┴────────────┼────────────┴────────────┘
│
┌─────────────────────────────────┼─────────────────────────────────┐
│ PLATFORM LAYER │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ │
│ │Identity │ │ Notif- │ │Observa- │ │ Compli- │ │ Backup │ │
│ │ IAM │ │ ication │ │ bility │ │ ance │ │ │ │
│ └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘ │
└───────┼────────────┼────────────┼────────────┼────────────┼───────┘
│ │ │ │ │
└────────────┴────────────┼────────────┴────────────┘
│
┌─────────────────────────────────┼─────────────────────────────────┐
│ INFRASTRUCTURE LAYER │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ │
│ │Kubernetes│ │ Object │ │ Block │ │ DNS/ │ │ Secrets │ │
│ │ Cluster │ │ Storage │ │ Storage │ │ CDN │ │ Mgmt │ │
│ └─────────┘ └─────────┘ └─────────┘ └─────────┘ └─────────┘ │
└───────────────────────────────────────────────────────────────────┘
Componenten Detail
Presentation Layer
| Component | Technologie | Functie |
|---|
| Web Portal | React, Next.js | Browser-based UI |
| Desktop Client | Electron | Native app experience |
| Mobile Apps | React Native | iOS/Android apps |
| Outlook Plugin | COM Add-in | Microsoft integratie |
| API Gateway | Kong/Envoy | Request routing, auth |
Application Layer
| Service | Verantwoordelijkheid | Storage |
|---|
| Mail Service | IMAP/SMTP, filtering, archiving | Object + DB |
| Calendar Service | CalDAV, scheduling | PostgreSQL |
| Files Service | REST API, versioning (geen WebDAV); desktop-sync in ontwikkeling | Object + DB |
| Chat Service | Realtime messaging | PostgreSQL + Redis |
| AI Service | LLM (Mistral AI, EU), RAG, on-prem embeddings (bge-m3/TEI) | pgvector (self-hosted, EU) |
Platform Layer
| Component | Technologie | Functie |
|---|
| Identity (IAM) | Zitadel | SSO, MFA, user management |
| Notification | Custom (noveu-notification-service) | Transactionele en systeemnotificaties, kanaalroutering |
| Observability | Prometheus, Grafana, GlitchTip | Metrics, dashboards, foutmeldingen |
| Compliance | Custom | Audit, reporting, evidence |
| Backup | age (X25519 + ChaCha20-Poly1305) | Encryptie en sleutelbeheer voor back-ups, zie Backup Strategy |
Infrastructure Layer
| Component | Specificatie | Redundantie |
|---|
| Kubernetes | Managed K8s | Multi-node, multi-zone |
| Object Storage | S3-compatible | 3x replicatie |
| Block Storage | SSD | RAID, snapshotting |
| Secrets Management | HashiCorp Vault | HA cluster |
| DNS/CDN | EU-based | Global edge |
Deployment Architectuur
Multi-Tenant (SaaS)
┌────────────────────────────────────────────┐
│ Shared Control Plane │
│ ┌────────┐ ┌────────┐ ┌────────┐ │
│ │ IAM │ │ Billing│ │Provisn │ │
│ └────────┘ └────────┘ └────────┘ │
└────────────────────────────────────────────┘
│ │ │
┌─────────┘ │ └─────────┐
▼ ▼ ▼
┌────────┐ ┌────────┐ ┌────────┐
│Tenant A│ │Tenant B│ │Tenant C│
│ (Data) │ │ (Data) │ │ (Data) │
└────────┘ └────────┘ └────────┘
Dedicated Tenant
┌────────────────────────────────────────────┐
│ Dedicated Control Plane │
│ ┌────────┐ ┌────────┐ ┌────────┐ │
│ │ IAM │ │ Config │ │ Ops │ │
│ └────────┘ └────────┘ └────────┘ │
└────────────────────────────────────────────┘
│
▼
┌────────────────────────────────────────────┐
│ Dedicated Data Plane (Customer) │
│ ┌────────┐ ┌────────┐ ┌────────┐ │
│ │ Apps │ │ Data │ │Network │ │
│ └────────┘ └────────┘ └────────┘ │
└────────────────────────────────────────────┘
Data Flow
E-mail Ontvangst
Internet ─► MX ─► Antispam ─► Policy ─► Delivery ─► Mailbox
│ │ │
▼ ▼ ▼
[Block] [Quarantine] [Store]
│ │ │
└───────────┴───────────┘
│
▼
[Audit Log]
Authenticatie Flow
User ─► Client ─► API Gateway ─► IAM ─► Service
│ │ │
│ ┌─────┘ │
│ ▼ │
│ [Token] │
│ │ │
└────┼───────────────┘
│
▼
[Validate + Authorize]
│
▼
[Response]
Security Architecture
Network Zones
| Zone | Components | Ingress | Egress |
|---|
| Edge | LB, WAF, CDN | Internet | DMZ |
| DMZ | API Gateway | Edge | Services |
| Services | App containers | DMZ | Data |
| Data | Databases, storage | Services | None |
| Mgmt | Monitoring, CI/CD | Jump only | All |
Encryption
| Layer | Mechanism | Key Management |
|---|
| Transport | TLS 1.3 | PKI, auto-rotation |
| Application | S/MIME, PGP | User managed |
| Storage (volume) | Roadmap, volume-encryptie nog niet uitgerold | Vault, per-tenant (gepland) |
| Backup | age (X25519 + ChaCha20-Poly1305) | Aparte sleutel-hiërarchie |
Integration Patterns
Synchronous
Client ──► API Gateway ──► Service ──► Response
│ │
│ ┌────┴────┐
│ ▼ ▼
│ [Cache] [Database]
│
└► [Rate Limit] [Circuit Breaker]
Disaster Recovery
RTO/RPO Targets
| Tier | RTO | RPO | Strategy |
|---|
| Basis | 4 uur | 1 uur | Backup + restore |
| Pro | 1 uur | 15 min | Warm standby |
| Overheid | 15 min | 5 min | Active-active |
Backup Strategy
Continuous ─► Transaction Logs ─► 5 min RPO
Every hour ─► Incremental ─► Offsite
Daily ─► Full snapshot ─► 2nd DC
Weekly ─► Full backup ─► Tape/Archive
Capacity Planning
Sizing Guidelines
| Component | Per 1000 users | Notes |
|---|
| API nodes | 2-4 | Auto-scaling |
| Mail storage | 50-100 GB | Average mailbox |
| File storage | 100-500 GB | Afhankelijk gebruik |
| Database | 50 GB | Excluding mail |
| Network | 100 Mbps | Peak burst |
Technology Choices
| Category | Choice | Rationale |
|---|
| Container orchestration | Kubernetes | Industry standard, portable |
| Service mesh | Istio/Linkerd | mTLS, observability |
| Secrets | HashiCorp Vault | Enterprise features |
| Monitoring | Prometheus + Grafana | Open source, flexible |
| Error tracking | GlitchTip | Foutmeldingen, geen centrale logaggregatie of tracing |
| Database | PostgreSQL | Reliable, EU cloud native |
| Cache | Redis | Performance, pub/sub |
| Object storage | MinIO/S3 | S3-compatible, EU-hosted |
Laatste update: Januari 2026
Architectuur kan variëren per deployment model
