Running evidence

A graph you can follow into the environment

I built the map because a flat list of services does not explain what depends on what. Starting with the whole platform, you can open an operating area, then a system, workload, or component. The same renderer and hierarchy support the private operating map. The public version receives a separately constructed data set.

The drill-down is useful when a parent is degraded. It lets you follow the affected branch and see the component behind that summary. Functional names and relationships make that investigation understandable, so I retain reviewed names while removing addresses, administration links, and private identifiers.

Containers and the live update path

A custom Python container collects the private graph from monitoring sources. A second container runs the publisher from the same custom image, built on python:3.14-slim. It reads the public projection, checks the complete document, and sends a snapshot every 15 seconds. The publisher carries a dedicated publication credential; the browser does not receive it.

A Cloudflare Worker handles the public feed, with a SQLite-backed Durable Object storing the accepted snapshot. These are Cloudflare services, separate from the Kubernetes containers. The website serves the HTML, CSS, and JavaScript renderer. Its requests do not open an inbound route to the private topology service.

What the boundary enforces

The projection rebuilds nodes from allowed fields and gives them opaque IDs. The Python publisher and Cloudflare contract check field names, types, text lengths, relationships, states, and timestamps. Unknown fields, broken references, and disallowed identifiers cause rejection. An authenticated publication request still has to pass those checks.

The storage layer refuses older snapshots and conflicting replacements with the same generation time. Identical retries are accepted. The publisher rejects snapshots more than two minutes old, and the browser stops labeling expired data live. If it has a last successful graph stored locally, it labels that fallback so an outage does not silently turn old data into current health.

The committed Kubernetes configuration runs both Python processes without root, drops Linux capabilities, disables privilege escalation and automatic API-token mounting, and uses read-only root filesystems. The publisher has a small writable temporary volume for its readiness marker.

The public graph deliberately exposes reviewed component names and operational relationships. That is a disclosure choice, not anonymization of the whole environment. The private collector still depends on its own network and access boundary; the public projection does not secure that private service.

Move from a status tile to the measurements behind it

The NOC gives me a place to start an investigation. A domain tile summarizes a set of measurements; opening it takes you to the dashboard that explains that state. The topology map helps you follow relationships, and the NOC lets you inspect measurements over time. Both drill-downs help explain the environment without requiring someone to know its inventory first.

What runs behind the panels

Prometheus and Grafana run as containers in Kubernetes. Exporters collect operational measurements, and Prometheus evaluates recording rules that produce the approved public series. Grafana's sidecar containers load the provisioned dashboard and data-source configuration. Backup panels also use fixed queries against reviewed PostgreSQL views.

The public dashboards use Grafana's externally shared dashboard routes on the existing monitoring service. Their saved queries select the public recording rules or approved database views. This design does not require a second public Prometheus server. The restriction depends on the saved dashboard queries, data projections, and the public request boundary.

Protecting the query and response paths

The public hostname passes through Cloudflare to the existing ingress and Grafana. Access policies distinguish the public dashboard and asset paths from the remaining application. A Worker checks the allowed routes and methods, filters dashboard JSON, and removes private bootstrap metadata such as data-source connection settings and internal origins.

The Worker validates a complete document before releasing it, with a bounded response size. Unexpected content, private labels, or an invalid response produce an unavailable page. Annotation polls terminate at the Worker with an empty response. Readers can follow the curated dashboard links; the public surface does not offer Explore or arbitrary query editing.

Content Security Policy restricts dashboard embedding to this portfolio. The edge also has a rate limit for dashboard traffic, with static assets excluded after normal page loads hit the earlier limit. These controls complement the query restrictions. An embedding policy alone would not make a private query safe to publish.

When the observer fails

Missing measurements are represented as no signal. This matters because an empty query can otherwise become a zero that a threshold colors green. The dashboard generator checks no-data behavior and drill-down destinations. A nightly reconciliation job compares the served dashboard with the repository definition and emits its own monitored heartbeat.

A previous duplicate-key configuration error stopped the shared probe exporter and made multiple services appear down together. Strict YAML parsing was added, and the monitoring presentation distinguishes missing observer coverage from a measured application failure.

Show work moving through the fleet

A list of active agents leaves out the handoff. The map connects the Python controller to builders and their assigned reviewers, so I can see whether work is running, waiting for review, or missing a current signal. Selecting a node exposes its role and state. The public version keeps generic aliases and removes the private task description and repository link.

A separate Python gateway container

The internal fleet collector combines runtime, work, monitoring, and usage signals. A dedicated public deployment uses the custom fleet image built on python:3.14-slim, with a different entry point that runs only the public gateway. It reads one fixed internal projection endpoint and rebuilds the response from permitted fields.

Cloudflare Tunnel routes the public hostname through the Kubernetes ingress to that gateway. The browser loads the map assets and refreshes the projected API. It receives role aliases, provider labels, activity, review handoffs, and supported subscription-usage windows. The public container has no runtime credentials for the work tracker, monitoring system, or operator service, and mounts no configuration volume or Kubernetes API token.

Small request surface and explicit failure

The gateway serves the public page, its JavaScript and stylesheet, health, and the projected API. Private API and operator paths return 404; mutating methods return 405. It accepts no caller-supplied upstream URL. Unknown source fields are discarded, so a newly added private field does not automatically become public.

Invalid snapshots or snapshots older than two minutes return a generic 503 without the source error. Old usage samples are omitted. After a failed refresh, the browser hides the previous map values and retries. That differs from the topology map's labeled historical fallback.

The deployment uses a read-only root filesystem, a non-root user, default seccomp filtering, dropped Linux capabilities, resource limits, and no privilege escalation. The image includes shared fleet code, but the gateway process has no mounted operator credentials. Those are specific process and credential controls, not a claim of complete network isolation.

I run the fleet within a limited AI usage budget and pause it when other work needs that budget. Idle or unavailable periods are expected. The map reports the available signals; it cannot establish why the fleet was stopped.

Security testing, remediations, and remaining scope

I test the publication boundary with deliberately invalid inputs as well as ordinary page loads. A page returning HTTP 200 is not enough: a test has to check the response body, the routes it can reach, and what happens when its source fails.

Fixes that changed the public boundary

The NOC response filter removes private bootstrap configuration as well as dashboard fields. Filtering only the visible panels would leave browser initialization data unchecked. The Worker also handles optional annotation requests locally, preserving the dashboard without opening a broader API route. Public SQL panels receive a synthetic browser database alias so they render without exposing connection details.

Topology publication now validates both in Python and at storage, including ordering and same-timestamp conflicts. Its tests cover recovery when an invalid future snapshot is already stored. The fleet adds a second field projection in the public gateway, which reconstructs the response independently of the internal collector.

Penetration testing scope

The evidence here consists of source-level security tests, browser checks, and bounded external scanning. I do not have a completed independent penetration-test report for these three live views. The checks here establish their specific refusal behavior; an independent assessment would need its own scope, findings, and retest record.

The weekly website assessment is report-only. It checks headers, redirects, CORS, exposed files, and public content, and runs signed Nuclei templates within a fixed target list and request limit. That list includes the site, NOC hostname, and topology feed. The newer fleet hostname is not in that configured external scan scope. Its gateway regression tests and browser verification are separate evidence.

Container scanning has limits too. The fleet image is included in the Trivy pull-request and scheduled fresh-build matrices, with findings reported at warning level. That is not a blocking vulnerability gate or proof that a particular deployed digest is free of findings.

The NOC's documented additional WAF denial rule still requires live application evidence before I count it as enforced. Access can answer a request before the Worker does, so a login redirect cannot prove that a Worker returned the intended denial. I keep that distinction visible rather than treating a committed rule as a deployed control.