DevOps Infrastructure Platform
Operational Documentation, Architecture & Verification Runbooks
Primary Endpoints
Production Web
Web Application
https://web.hasb.dev
Three.js containerized web application hosted on Web EC2, routed via Cloudflare Anycast edge with DDoS protection and TLS termination.
Zero Trust Observability
Monitoring Dashboard
https://monitoring.hasb.dev
Grafana dashboard querying Prometheus on the Monitoring EC2, accessed via an outbound Cloudflare Zero Trust Tunnel with zero public inbound ports.
Version Control
Public Repository
https://github.com/hasB223/devops-bootcamp-project
Complete Infrastructure-as-Code (Terraform), Ansible automation, Docker packaging, CI/CD workflows, and durable operational runbooks.
End-State Architecture Showcase
System Architecture & Network Flow
Open Full Screen ↗
Live Integration Verification
Production Web Application (web.hasb.dev)
Live Three.js application container served via Nginx with Cloudflare edge TLS termination. Click thumbnail to expand full resolution screenshot.
Observability Dashboard (monitoring.hasb.dev)
Real-time host metrics scraped from private target 10.0.0.5:9100 visualized in Grafana over Cloudflare Zero Trust Tunnel. Click thumbnail to expand full resolution screenshot.
Durable Operational Runbooks
System Architecture
VPC topology, security groups matrix, IAM least-privilege, and traffic flow.
Master Runbook
Complete 0-to-1 operational build sequence, verification checklist, and cost management.
Terraform Foundation
VPC networking, EC2 compute, private subnets, security groups, and S3 backend.
Containerization
Multi-stage Dockerfile, image minimization, and local compose verification.
Ansible Configuration
Multi-play automation, Docker runtime, ECR IAM auth, and idempotency guarantees.
Monitoring & Observability
Prometheus metrics collection, node_exporter daemon, and pre-provisioned Grafana.
Domain & Cloudflare Tunnel
DNS A-record proxying, Zero Trust Tunnel setup, and future Terraform IaC path.
CI/CD Automation
GitHub Actions PR gates, AWS OIDC identity federation, and Pages deployment.
Secrets Management
Infisical Cloud strategy, workload identity, and zero static credentials policy.
Git Standards
Branching conventions, conventional commits, and pull request lifecycle.
Infrastructure Specifications
| Component | Configuration / Resource | Security / Network Placement |
|---|---|---|
| VPC Network | 10.0.0.0/24 | AWS ap-southeast-1 (Singapore) |
| Public Subnet | 10.0.0.0/25 (IGW + NAT Gateway) | Inbound Port 80 (HTTP) to Web Server |
| Private Subnet | 10.0.0.128/25 (Route to NAT) | Zero public IPs; outbound internet via NAT |
| Web Server | 10.0.0.5 + Elastic IP | Serves web container on port 80; node_exporter on port 9100 (private) |
| Ansible Controller | 10.0.0.135 (Private Subnet) | Manages targets via VPC private network; SSM access only |
| Monitoring Server | 10.0.0.136 (Private Subnet) | Prometheus (:9090) + Grafana (:3000); Cloudflare Tunnel connector |
| ECR Registry | devops-bootcamp/final-project-hasb | Private AWS container registry; IAM auth on instance profile & GitHub OIDC |