.nornir/assets/flow_deploy.svg
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1180 640" font-family="'DejaVu Sans', 'Segoe UI', sans-serif">
<defs>
<linearGradient id="board" x1="0" y1="0" x2="0" y2="1">
<stop offset="0" stop-color="#0b1c2e"/><stop offset="1" stop-color="#06111d"/>
</linearGradient>
<linearGradient id="chip" x1="0" y1="0" x2="0" y2="1">
<stop offset="0" stop-color="#14384f"/><stop offset="1" stop-color="#0e2a3e"/>
</linearGradient>
<linearGradient id="rail" x1="0" y1="0" x2="0" y2="1">
<stop offset="0" stop-color="#173d57"/><stop offset="1" stop-color="#0c2438"/>
</linearGradient>
<marker id="arr" markerWidth="9" markerHeight="9" refX="7" refY="3" orient="auto"><path d="M0 0 L7 3 L0 6 Z" fill="#6fd3f5"/></marker>
</defs>
<rect x="0" y="0" width="1180" height="640" fill="url(#board)"/>
<g stroke="#143a52" stroke-width="1"><line x1="0" y1="74" x2="1180" y2="74"/><line x1="0" y1="600" x2="1180" y2="600"/></g>
<g fill="#16415c"><circle cx="40" cy="40" r="2"/><circle cx="1140" cy="40" r="2"/><circle cx="40" cy="620" r="2"/><circle cx="1140" cy="620" r="2"/></g>
<text x="40" y="44" fill="#eaf6ff" font-size="22" font-weight="700">Deploy — image → helm/k8s → running pod</text>
<text x="560" y="44" fill="#9fc9e0" font-size="14.5">distroless image, Helm renders manifests, one pod mounts config + auth + data</text>
<!-- stage 1: build -->
<rect x="40" y="110" width="250" height="200" rx="10" fill="url(#chip)" stroke="#5aa6cf" stroke-width="2"/>
<text x="165" y="138" fill="#eaf6ff" font-size="15" font-weight="700" text-anchor="middle">1 · image build</text>
<text x="165" y="158" fill="#9fc9e0" font-size="10.5" text-anchor="middle">distribution/Dockerfile</text>
<g font-size="10.5" fill="#bcd9ec">
<text x="56" y="184">builder: rust:1.96-slim</text>
<text x="68" y="200" fill="#86b3cc" font-size="9.5">protobuf, cmake, libssl</text>
<text x="56" y="218">cargo build --release</text>
<text x="68" y="234" fill="#86b3cc" font-size="9.5">--bin holger-server</text>
<text x="56" y="256">runtime: distroless/cc</text>
<text x="68" y="272" fill="#86b3cc" font-size="9.5">nonroot uid 65532</text>
<text x="56" y="294" font-family="'DejaVu Sans Mono', monospace" fill="#a9d8ee" font-size="10">ports 50051 / 8081</text>
</g>
<!-- stage 2: helm -->
<rect x="340" y="100" width="262" height="220" rx="10" fill="url(#chip)" stroke="#7fc8ea" stroke-width="2.5"/>
<text x="471" y="128" fill="#eaf6ff" font-size="15" font-weight="700" text-anchor="middle">2 · helm render</text>
<text x="471" y="148" fill="#9fc9e0" font-size="10.5" text-anchor="middle">deploy/helm/holger</text>
<g font-size="10.5" fill="#bcd9ec">
<text x="356" y="174">values.yaml + values-{dev,prod}</text>
<text x="356" y="196" fill="#86b3cc" font-size="10">image.repo/tag · service.type</text>
<text x="356" y="212" fill="#86b3cc" font-size="10">storage.size/class · auth.enabled</text>
<text x="356" y="228" fill="#86b3cc" font-size="10">ingress · resources</text>
<text x="356" y="252">templates → manifests:</text>
<text x="368" y="270" fill="#86b3cc" font-size="10">Deployment · Service · PVC</text>
<text x="368" y="286" fill="#86b3cc" font-size="10">ConfigMap · Secret · Ingress</text>
<text x="356" y="308" font-family="'DejaVu Sans Mono', monospace" fill="#a9d8ee" font-size="9.5">(raw deploy/k8s/*.yaml too)</text>
</g>
<!-- stage 3: cluster -->
<rect x="652" y="100" width="200" height="220" rx="10" fill="url(#chip)" stroke="#5aa6cf" stroke-width="2"/>
<text x="752" y="128" fill="#eaf6ff" font-size="15" font-weight="700" text-anchor="middle">3 · cluster</text>
<text x="752" y="148" fill="#9fc9e0" font-size="10.5" text-anchor="middle">namespace: holger</text>
<g font-size="10.5" fill="#bcd9ec">
<text x="668" y="176">replicas: 1</text>
<text x="680" y="192" fill="#86b3cc" font-size="9.5">Recreate (RWO volume)</text>
<text x="668" y="214">PVC → storageClass</text>
<text x="680" y="230" fill="#86b3cc" font-size="9.5">local-path (dev)</text>
<text x="680" y="246" fill="#86b3cc" font-size="9.5">CSI mayastor (prod)</text>
<text x="668" y="270">Talos: NodePort /</text>
<text x="668" y="286">MetalLB (no cloud LB)</text>
<text x="668" y="306" font-family="'DejaVu Sans Mono', monospace" fill="#a9d8ee" font-size="9.5">readonly rootfs, drop caps</text>
</g>
<!-- stage 4: running pod -->
<rect x="902" y="100" width="242" height="220" rx="10" fill="url(#chip)" stroke="#7fc8ea" stroke-width="2.5"/>
<text x="1023" y="128" fill="#eaf6ff" font-size="15" font-weight="700" text-anchor="middle">4 · running pod</text>
<text x="1023" y="148" fill="#9fc9e0" font-size="10.5" text-anchor="middle">holger-server start</text>
<g font-size="10.5" fill="#bcd9ec">
<text x="918" y="174">mounts:</text>
<text x="930" y="190" fill="#86b3cc" font-size="9.5">/etc/holger/holger.ron (cfg)</text>
<text x="930" y="206" fill="#86b3cc" font-size="9.5">/etc/holger/auth/ca.pem (secret)</text>
<text x="930" y="222" fill="#86b3cc" font-size="9.5">/var/lib/holger (PVC data)</text>
<text x="918" y="244">listens 50051 gRPC / 8081 HTTP</text>
<text x="918" y="266">probes:</text>
<text x="930" y="282" fill="#86b3cc" font-size="9.5">liveness /healthz</text>
<text x="930" y="298" fill="#86b3cc" font-size="9.5">readiness /readyz</text>
</g>
<g stroke="#6fd3f5" stroke-width="3" fill="none">
<path d="M290 210 H338" marker-end="url(#arr)"/>
<path d="M602 210 H650" marker-end="url(#arr)"/>
<path d="M852 210 H900" marker-end="url(#arr)"/>
</g>
<!-- service exposure rail -->
<rect x="40" y="380" width="1104" height="92" rx="12" fill="url(#rail)" stroke="#7fc8ea" stroke-width="2"/>
<text x="64" y="408" fill="#dff1ff" font-size="15" font-weight="700">Service exposes the pod</text>
<g font-size="11" fill="#bcd9ec">
<text x="300" y="408">ClusterIP (default) · NodePort 30051/30081 (dev / bare-metal) · LoadBalancer (prod) · Ingress → HTTP 8081</text>
</g>
<text x="64" y="436" fill="#86b3cc" font-size="10.5">ConfigMap carries holger.ron (repos → storage → exposed graph) · Secret carries the mTLS CA · PVC carries znippy archives + writable repos</text>
<text x="64" y="456" fill="#86b3cc" font-size="10.5">dev: latest tag, NodePort, 5Gi, no auth • prod: pinned tag, LoadBalancer + Ingress, 200Gi CSI, OIDC auth</text>
<!-- consumers -->
<rect x="320" y="510" width="246" height="76" rx="10" fill="url(#chip)" stroke="#5aa6cf" stroke-width="2"/>
<text x="443" y="540" fill="#eaf6ff" font-size="14" font-weight="700" text-anchor="middle">native clients</text>
<text x="443" y="562" fill="#86b3cc" font-size="10.5" text-anchor="middle">helm repo add / docker pull / pip</text>
<text x="443" y="580" fill="#86b3cc" font-size="10" text-anchor="middle">HTTP gateway :8081</text>
<rect x="614" y="510" width="246" height="76" rx="10" fill="url(#chip)" stroke="#5aa6cf" stroke-width="2"/>
<text x="737" y="540" fill="#eaf6ff" font-size="14" font-weight="700" text-anchor="middle">holger agent / SDK</text>
<text x="737" y="562" fill="#86b3cc" font-size="10.5" text-anchor="middle">gRPC :50051</text>
<text x="737" y="580" fill="#86b3cc" font-size="10" text-anchor="middle">fetch / put / stream</text>
<g stroke="#6fd3f5" stroke-width="3" fill="none">
<path d="M443 472 V508" marker-end="url(#arr)"/>
<path d="M737 472 V508" marker-end="url(#arr)"/>
</g>
</svg>