# Topologi Produksi (Production Topology)

Dokumen ini menjelaskan topologi arsitektur runtime, jaringan kontainer, dan interaksi layanan pada VPS Hostinger KVM 2.

---

## 1. Diagram Topologi Sistem

```mermaid
graph TD
    User["Public Internet Users"]

    subgraph Cloudflare["Cloudflare Edge Network"]
        CF_ERP["erp-km.trl.my.id (SSL/Edge)"]
        CF_B2B["b2b-km.trl.my.id (SSL/Edge)"]
        CF_POS["pos-km.trl.my.id (SSL/Edge)"]
        CF_API["api-km.trl.my.id (SSL/Edge)"]
    end

    subgraph Hostinger["Hostinger KVM 2 VPS (2 vCPU, 8 GB RAM)"]
        CFTunnel["Cloudflare Tunnel Agent (cloudflared)<br/>Running on Host Network"]

        subgraph LoopbackPorts["Host Loopback (127.0.0.1)"]
            P3001["127.0.0.1:3001"]
            P3002["127.0.0.1:3002"]
            P3003["127.0.0.1:3003"]
            P3004["127.0.0.1:3004"]
        end

        subgraph ContainerStack["Podman / Docker Bridge Network (keluargamart)"]
            ERP["keluargamart-erp<br/>(Nginx 8080)"]
            B2B["keluargamart-b2b<br/>(Nuxt SSR 3000)"]
            POS["keluargamart-pos<br/>(Nginx 8080)"]
            Backend["keluargamart-backend<br/>(Go Chi 8080)"]
            NextReport["keluargamart-nextreport<br/>(Puppeteer 5489)"]
            DB[(PostgreSQL 16)]
            Redis[(Redis 7)]
        end
    end

    User --> CF_ERP
    User --> CF_B2B
    User --> CF_POS
    User --> CF_API

    CF_ERP -.->|Encrypted Tunnel| CFTunnel
    CF_B2B -.->|Encrypted Tunnel| CFTunnel
    CF_POS -.->|Encrypted Tunnel| CFTunnel
    CF_API -.->|Encrypted Tunnel| CFTunnel

    CFTunnel --> P3001 --> ERP
    CFTunnel --> P3002 --> B2B
    CFTunnel --> P3003 --> POS
    CFTunnel --> P3004 --> Backend

    ERP -.->|Internal /api proxy| Backend
    POS -.->|Internal /api proxy| Backend
    B2B -.->|Internal NUXT_API_PROXY_TARGET| Backend
    Backend -.->|Internal PDF rendering| NextReport

    Backend --> DB
    Backend --> Redis
```

---

## 2. Pemetaan Port Origin & Layanan

| Public Hostname | Host Loopback Origin | Target Container Port | Lingkup Akses |
|---|---|---|---|
| `erp-km.trl.my.id` | `http://127.0.0.1:3001` | `erp:8080` | Terbuka melalui Cloudflare (Auth required) |
| `b2b-km.trl.my.id` | `http://127.0.0.1:3002` | `b2b:3000` | Publik Storefront |
| `pos-km.trl.my.id` | `http://127.0.0.1:3003` | `pos:8080` | Terbuka melalui Cloudflare (Kasir POS) |
| `api-km.trl.my.id` | `http://127.0.0.1:3004` | `backend:8080` | Public API & Mobile |
| *(Internal)* | — | `nextreport:5489` | Internal Docker Network only |
| *(Internal)* | — | `postgres:5432` | Internal Docker Network only |
| *(Internal)* | — | `redis:6379` | Internal Docker Network only |

---

## 3. Isolasi Keamanan Jaringan

1. **Zero Open Public Ports**: Firewall VPS (`ufw` atau Hostinger Cloud Firewall) hanya perlu mengizinkan port `22` (SSH). Port 80, 443, 3001, 3002, 3003, 3004, 5432, 6379 TIDAK BOLEH dibuka ke publik.
2. **Tunnel Ke Edge**: Semua koneksi masuk dienkripsi dan di-tunnel secara aman oleh `cloudflared` ke edge Cloudflare.
3. **Internal Bridge Network**: Komunikasi antar-kontainer (Backend ke DB, Backend ke NextReport, B2B SSR ke Backend) berjalan cepat dan terisolasi melalui bridge network privat `keluargamart`.