Struxel-Hosted Deployment

Fully managed SaaS deployment model and runbooks.

Architecture OverviewSelf-Hosted Guide
High-Level Diagram
Hosted Architecture

Struxel-Hosted Deployment

Overview

Struxel-hosted deployment is our fully managed SaaS offering. We handle all infrastructure, scaling, monitoring, backups, and AI services.

Customer Time to Value: 2-4 weeks Customer DevOps Required: None Customer Infrastructure Cost: $0

Deployment Architecture

``` Customer → CloudFlare → AWS ALB → ECS Services → RDS/ElastiCache ↓ AWS Bedrock Google Gemini ```

Our AWS Account:

  • Region: us-east-1 (primary), us-west-2 (DR)
  • VPC: Dedicated per customer
  • Multi-AZ for high availability
  • Automated backups (daily snapshots)
  • Disaster recovery to us-west-2

What We Manage

Infrastructure

  • ✅ AWS ECS cluster (Fargate)
  • ✅ Application Load Balancers
  • ✅ RDS PostgreSQL (Multi-AZ)
  • ✅ ElastiCache Redis (Cluster mode)
  • ✅ S3 buckets (assets + backups)
  • ✅ CloudFront CDN
  • ✅ Route53 DNS
  • ✅ WAF + DDoS protection
  • ✅ VPC + security groups

Application

  • ✅ Frontend deployment
  • ✅ API deployment
  • ✅ All 31 product containers
  • ✅ Demo service
  • ✅ PDF generator
  • ✅ Background workers

Data

  • ✅ Database migrations
  • ✅ Daily backups (retained 30 days)
  • ✅ Point-in-time recovery (7 days)
  • ✅ Disaster recovery (RTO: 4 hours, RPO: 15 minutes)

AI Services

  • ✅ AWS Bedrock integration
  • ✅ Google Gemini integration
  • ✅ Automatic failover
  • ✅ Cost optimization
  • ✅ API key management

Monitoring

  • ✅ DataDog APM
  • ✅ CloudWatch logs
  • ✅ Sentry error tracking
  • ✅ PagerDuty alerting
  • ✅ 24/7 on-call team

Security

  • ✅ SSL certificates (auto-renewal)
  • ✅ Encryption at rest (all data)
  • ✅ Encryption in transit (TLS 1.3)
  • ✅ SOC2 Type II compliance
  • ✅ GDPR compliance
  • ✅ Penetration testing (annual)
  • ✅ Vulnerability scanning (continuous)

Customer Onboarding Process

Step 1: Contract Signed

  • Sales provides customer details
  • Finance creates Stripe subscription
  • Provisioning ticket auto-created

Step 2: Environment Provisioning (Day 1-2)

Automated by our systems:

```bash

Triggered via API call

POST /api/provisioning/create-customer-environment { "customer_id": "cust_ABC123", "customer_name": "Acme Corp", "products": ["bias-engine-ai", "risk-forecast-ai"], "deployment_type": "struxel-hosted", "region": "us-east-1" }

System automatically:

  1. Creates dedicated VPC
  2. Provisions RDS instance
  3. Creates ElastiCache cluster
  4. Deploys ECS services
  5. Configures load balancers
  6. Sets up CloudFront distribution
  7. Generates SSL certificate
  8. Creates customer database
  9. Seeds product configurations
  10. Sends setup complete notification ```

What gets created:

  • Customer subdomain: `acme.struxel.app`
  • Database: `acme_prod`
  • ECS cluster: `struxel-acme-prod`
  • S3 bucket: `struxel-acme-prod-assets`

Step 3: Product Configuration (Day 3-5)

Done by customer success team:

  • Configure product settings
  • Set up integrations (MLflow, SageMaker, etc.)
  • Import customer data (optional)
  • Configure SSO (SAML/OIDC)
  • Set up RBAC permissions
  • Configure alerting

Step 4: Customer Training (Day 6-10)

  • Live onboarding session (2 hours)
  • Product-specific training (1 hour per product)
  • Admin training (1 hour)
  • Q&A session

Step 5: Go Live (Day 11-14)

  • Final smoke tests
  • Customer acceptance testing
  • Production cutover
  • Monitor first 48 hours

Technical Specifications

Infrastructure Specs

Frontend (ECS Service):

  • Container: `ghcr.io/struxel-dynamics/struxel-frontend:latest`
  • Replicas: 3 (auto-scale 3-10)
  • CPU: 512 units
  • Memory: 1GB
  • Port: 80 (HTTP) → ALB handles HTTPS

API (ECS Service):

  • Container: `ghcr.io/struxel-dynamics/struxel-api:latest`
  • Replicas: 5 (auto-scale 5-20)
  • CPU: 1024 units
  • Memory: 2GB
  • Port: 8000

Product Services (31 ECS Services):

  • Each product runs as separate ECS service
  • Example: `ghcr.io/struxel-dynamics/bias-engine:latest`
  • Replicas: 2 (auto-scale 2-5)
  • CPU: 512-1024 units (varies by product)
  • Memory: 1-4GB (varies by product)

Database (RDS PostgreSQL):

  • Instance: db.t3.large (baseline), db.r5.xlarge (heavy load)
  • Storage: 500GB (auto-scale to 3TB)
  • Multi-AZ: Yes
  • Automated backups: Daily at 2am UTC
  • Backup retention: 30 days
  • Encryption: AES-256

Cache (ElastiCache Redis):

  • Node type: cache.r5.large
  • Cluster mode: Enabled (3 shards, 1 replica each)
  • Encryption: At-rest + in-transit
  • Auto-failover: Enabled

Network Configuration

```yaml VPC CIDR: 10.0.0.0/16

Subnets: Public (ALB): - 10.0.1.0/24 (us-east-1a) - 10.0.2.0/24 (us-east-1b) - 10.0.3.0/24 (us-east-1c)

Private (ECS): - 10.0.10.0/24 (us-east-1a) - 10.0.11.0/24 (us-east-1b) - 10.0.12.0/24 (us-east-1c)

Database (RDS): - 10.0.20.0/24 (us-east-1a) - 10.0.21.0/24 (us-east-1b)

Security Groups: ALB: Allow 80/443 from 0.0.0.0/0 ECS: Allow all from ALB SG RDS: Allow 5432 from ECS SG Redis: Allow 6379 from ECS SG ```

Scaling Configuration

Auto-scaling rules:

```yaml Frontend: min_replicas: 3 max_replicas: 10 scale_up_threshold: CPU > 70% for 2 minutes scale_down_threshold: CPU < 30% for 5 minutes

API: min_replicas: 5 max_replicas: 20 scale_up_threshold: CPU > 70% or Requests > 1000/sec scale_down_threshold: CPU < 30% for 5 minutes

Products: min_replicas: 2 max_replicas: 5 scale_up_threshold: CPU > 80% for 2 minutes ```

Monitoring & Alerting

Metrics Tracked

  • Request latency (p50, p95, p99)
  • Error rates (4xx, 5xx)
  • CPU/Memory utilization
  • Database connections
  • Cache hit rates
  • AI API latency
  • Background job queue depth

Alerts Configured

  • P1 (Page immediately): service down, high error rate, DB unreachable
  • P2: high latency/CPU/disk
  • P3: deployments, scaling, certificate warnings

SLA Commitment

  • Uptime: 99.9%
  • Support Response: <1 hour (P1), <4 hours (P2)

Disaster Recovery

Summarized runbooks for DB corruption, region failure, and accidental deletion.

Security & Compliance

Controls: encryption, isolation, secrets mgmt, logging, IDS, scanning, WAF, DDoS, MFA, least privilege.

Certifications: SOC2 Type II, GDPR; ISO 27001 in progress.

Customer Access & Cost Structure

What customers get/do not get, support channels, what's included in pricing, add-ons, maintenance windows.

Getting Started / Troubleshooting

Provisioning scripts, health checks, scaling, logs, common issues.

base44
Edit with Base44