Architecture Overview

I provisioned a secure AWS infrastructure using Terraform with a custom VPC split into public and private subnets.

The web application runs as a Docker container on a public EC2 instance with an Elastic IP and is accessed via a Cloudflare-managed domain.

Configuration and deployments are handled centrally by an Ansible Controller in the private subnet.

For observability, Node Exporter exposes system metrics from the web server, which are collected by Prometheus and visualized in Grafana on a dedicated monitoring server.

Grafana is not publicly exposed and is accessed securely through a Cloudflare Tunnel. The entire setup is documented and published using GitHub Pages.

Users
  │
  │  web.software70.com
  ▼
Cloudflare DNS
  │
  ▼
Web Server (Public Subnet)
  ├─ Docker Web App (Port 80)
  └─ Node Exporter (Port 9100)
            ▲
            │
Monitoring Server (Private Subnet)
  ├─ Prometheus (Port 9090)
  ├─ Grafana (Port 3000)
  └─ Cloudflare Tunnel
            │
            ▼
 monitoring.software70.com (secure access)

Ansible Controller (Private Subnet)
  └─ Manages all servers via SSH