<mxfile host="app.diagrams.net" agent="skarke.net" version="24.7.17">
  <diagram id="estate" name="Edy estate">
    <mxGraphModel dx="1400" dy="900" grid="1" gridSize="20" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1100" pageHeight="700" math="0" shadow="0">
      <root>
        <mxCell id="0"/>
        <mxCell id="1" parent="0"/>

        <!-- lanes: top = furthest from the internet? No: top = the internet, bottom = the platform.
             Provisioning is NOT an edge lane. It is an enclave, drawn beside SERVICES and below IDENTITY. -->
        <mxCell id="lane-internet" value="INTERNET" style="text;align=left;verticalAlign=middle;fontFamily=JetBrains Mono;fontSize=9;fontColor=#6C665D;" vertex="1" parent="1"><mxGeometry x="20" y="20" width="80" height="20" as="geometry"/></mxCell>
        <mxCell id="lane-edge" value="PUBLIC EDGE" style="text;align=left;verticalAlign=middle;fontFamily=JetBrains Mono;fontSize=9;fontColor=#6C665D;" vertex="1" parent="1"><mxGeometry x="20" y="120" width="80" height="20" as="geometry"/></mxCell>
        <mxCell id="lane-identity" value="IDENTITY" style="text;align=left;verticalAlign=middle;fontFamily=JetBrains Mono;fontSize=9;fontColor=#6C665D;" vertex="1" parent="1"><mxGeometry x="20" y="240" width="80" height="20" as="geometry"/></mxCell>
        <mxCell id="lane-services" value="SERVICES" style="text;align=left;verticalAlign=middle;fontFamily=JetBrains Mono;fontSize=9;fontColor=#6C665D;" vertex="1" parent="1"><mxGeometry x="20" y="360" width="80" height="20" as="geometry"/></mxCell>
        <mxCell id="lane-platform" value="PLATFORM" style="text;align=left;verticalAlign=middle;fontFamily=JetBrains Mono;fontSize=9;fontColor=#6C665D;" vertex="1" parent="1"><mxGeometry x="20" y="600" width="80" height="20" as="geometry"/></mxCell>
        <mxCell id="lane-rule" style="endArrow=none;dashed=1;dashPattern=2 4;strokeColor=#C9C3B8;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="110" y="10" as="sourcePoint"/><mxPoint x="110" y="660" as="targetPoint"/></mxGeometry></mxCell>

        <!-- INTERNET -->
        <mxCell id="browsers" value="Browsers&#10;operators · collaborators" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#C9C3B8;fontFamily=Archivo;fontSize=12;" vertex="1" parent="1"><mxGeometry x="140" y="10" width="200" height="50" as="geometry"/></mxCell>
        <mxCell id="newhosts" value="New machines&#10;bare metal · VMs" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#C9C3B8;fontFamily=Archivo;fontSize=12;" vertex="1" parent="1"><mxGeometry x="820" y="10" width="200" height="50" as="geometry"/></mxCell>

        <!-- PUBLIC EDGE: only what must face the internet -->
        <mxCell id="frontdoor" value="Edy-Proxy · public edge&#10;TLS (ACME) · reverse proxy · external DNS" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#8A6A3B;strokeWidth=1.4;fontFamily=Archivo;fontSize=12;" vertex="1" parent="1"><mxGeometry x="140" y="110" width="300" height="60" as="geometry"/></mxCell>
        <mxCell id="edge-note" value="nothing else listens here" style="text;align=left;verticalAlign=middle;fontFamily=JetBrains Mono;fontSize=9;fontColor=#8A6A3B;" vertex="1" parent="1"><mxGeometry x="460" y="130" width="180" height="20" as="geometry"/></mxCell>

        <!-- IDENTITY -->
        <mxCell id="auth" value="Edy-Auth&#10;realms · providers · sessions" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#F3EEE6;strokeColor=#8A6A3B;strokeWidth=1.4;fontFamily=Archivo;fontSize=12;fontStyle=1" vertex="1" parent="1"><mxGeometry x="300" y="230" width="280" height="60" as="geometry"/></mxCell>

        <!-- SERVICES -->
        <mxCell id="catalog" value="Services Catalog&#10;this site" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#EEF2F2;strokeColor=#3E5C61;fontFamily=Archivo;fontSize=12;" vertex="1" parent="1"><mxGeometry x="140" y="350" width="180" height="60" as="geometry"/></mxCell>
        <mxCell id="collab" value="Collaboration&#10;projects · RFP · proposals" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#C9C3B8;fontFamily=Archivo;fontSize=12;" vertex="1" parent="1"><mxGeometry x="340" y="350" width="180" height="60" as="geometry"/></mxCell>
        <mxCell id="cockpit" value="Cockpit&#10;tuner · remote desktop" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#C9C3B8;fontFamily=Archivo;fontSize=12;" vertex="1" parent="1"><mxGeometry x="540" y="350" width="180" height="60" as="geometry"/></mxCell>

        <!-- DEPLOYMENT AUTOMATION ENCLAVE: a container, not a lane. DHCP/DNS/iPXE/TFTP live inside it. -->
        <mxCell id="enclave" value="DEPLOYMENT AUTOMATION ENCLAVE" style="swimlane;startSize=24;fillColor=none;strokeColor=#3E5C61;dashed=1;dashPattern=6 4;fontFamily=JetBrains Mono;fontSize=9;fontColor=#3E5C61;align=left;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="760" y="220" width="320" height="200" as="geometry"/></mxCell>
        <mxCell id="proxy-enclave" value="Edy-Proxy · enclave services&#10;DHCP · DNS · iPXE · TFTP" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#3E5C61;fontFamily=Archivo;fontSize=12;" vertex="1" parent="enclave"><mxGeometry x="20" y="40" width="280" height="50" as="geometry"/></mxCell>
        <mxCell id="netboot" value="Netboot · unattended Windows 11" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#3E5C61;fontFamily=Archivo;fontSize=12;" vertex="1" parent="enclave"><mxGeometry x="20" y="100" width="280" height="40" as="geometry"/></mxCell>
        <mxCell id="images" value="Image customisation → HTTPS delivery" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#EEF2F2;strokeColor=#3E5C61;fontFamily=Archivo;fontSize=12;" vertex="1" parent="enclave"><mxGeometry x="20" y="150" width="280" height="40" as="geometry"/></mxCell>
        <mxCell id="enclave-note" value="TFTP never leaves the enclave" style="text;align=left;verticalAlign=middle;fontFamily=JetBrains Mono;fontSize=9;fontColor=#3E5C61;" vertex="1" parent="1"><mxGeometry x="760" y="424" width="240" height="20" as="geometry"/></mxCell>

        <!-- PLATFORM -->
        <mxCell id="platform" value="" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#F2F0EC;strokeColor=#C9C3B8;" vertex="1" parent="1"><mxGeometry x="140" y="590" width="940" height="52" as="geometry"/></mxCell>
        <mxCell id="podman" value="podman" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#C9C3B8;fontFamily=Archivo;fontSize=12;" vertex="1" parent="1"><mxGeometry x="160" y="602" width="180" height="28" as="geometry"/></mxCell>
        <mxCell id="kvm" value="KVM / libvirt" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#C9C3B8;fontFamily=Archivo;fontSize=12;" vertex="1" parent="1"><mxGeometry x="380" y="602" width="180" height="28" as="geometry"/></mxCell>
        <mxCell id="samba" value="Samba AD" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#C9C3B8;fontFamily=Archivo;fontSize=12;" vertex="1" parent="1"><mxGeometry x="600" y="602" width="180" height="28" as="geometry"/></mxCell>
        <mxCell id="host" value="Linux host · Ubuntu 26.04" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#C9C3B8;fontFamily=Archivo;fontSize=12;" vertex="1" parent="1"><mxGeometry x="820" y="602" width="240" height="28" as="geometry"/></mxCell>

        <!-- flows. flowAnimation=1 is draw.io's animated dashed connector; the site SVG does the same with stroke-dashoffset. -->
        <mxCell id="f-browse" value="https" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeColor=#8A6A3B;dashed=1;flowAnimation=1;fontFamily=JetBrains Mono;fontSize=9;fontColor=#8A6A3B;" edge="1" parent="1" source="browsers" target="frontdoor"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="f-proxy" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeColor=#8A6A3B;dashed=1;flowAnimation=1;" edge="1" parent="1" source="frontdoor" target="catalog"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="230" y="200"/><mxPoint x="230" y="200"/></Array></mxGeometry></mxCell>
        <mxCell id="f-signin" value="sign-in" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeColor=#8A6A3B;fontFamily=JetBrains Mono;fontSize=9;fontColor=#8A6A3B;" edge="1" parent="1" source="catalog" target="auth"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="f-redeem" value="redeem result, server to server" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeColor=#3E5C61;fontFamily=JetBrains Mono;fontSize=9;fontColor=#3E5C61;" edge="1" parent="1" source="collab" target="auth"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="f-boot" value="DHCP · PXE · TFTP (inside only)" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeColor=#3E5C61;dashed=1;flowAnimation=1;fontFamily=JetBrains Mono;fontSize=9;fontColor=#3E5C61;" edge="1" parent="1" source="proxy-enclave" target="newhosts"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="f-image" value="customised image over HTTPS" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeColor=#8A6A3B;dashed=1;flowAnimation=1;fontFamily=JetBrains Mono;fontSize=9;fontColor=#8A6A3B;" edge="1" parent="1" source="images" target="frontdoor"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="700" y="390"/><mxPoint x="700" y="140"/></Array></mxGeometry></mxCell>
        <mxCell id="f-plat1" style="endArrow=none;dashed=1;dashPattern=3 3;strokeColor=#C9C3B8;" edge="1" parent="1" source="catalog" target="podman"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="f-plat2" style="endArrow=none;dashed=1;dashPattern=3 3;strokeColor=#C9C3B8;" edge="1" parent="1" source="cockpit" target="samba"><mxGeometry relative="1" as="geometry"/></mxCell>
        <mxCell id="f-plat3" style="endArrow=none;dashed=1;dashPattern=3 3;strokeColor=#C9C3B8;" edge="1" parent="1" source="enclave" target="host"><mxGeometry relative="1" as="geometry"/></mxCell>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
