← Back to overview

DevOps Bootcamp 2026 — AWS Fleet Architecture

DevOps Bootcamp 2026 — AWS Fleet Architecture An architecture diagram generated by Archify. Visitors · browser · Architecture component Visitors browser web.luqmansyakir.com · proxied :443 → :80 · Cloudflare · luqmansyakir.com · Cloudflare web.luqmansyakir.com proxied :443 → :80 monitoring.luqmansyakir.com · Tunnel → Grafana · Cloudflare · luqmansyakir.com · Cloudflare monitoring.luqmansyakir.com Tunnel → Grafana Amazon ECR · ship-app image · Architecture component Amazon ECR ship-app image Web Server · 10.0.0.5 · EIP · Ship :80 · AWS ap-southeast-1a · VPC 10.0.0.0/24 › public subnet 10.0.0.0/25 · IGW Web Server 10.0.0.5 · EIP · Ship :80 Ansible Controller · 10.0.0.135 · Ansible · AWS ap-southeast-1a · VPC 10.0.0.0/24 › private subnet 10.0.0.128/25 · NAT Ansible Controller 10.0.0.135 · Ansible Monitoring Server · 10.0.0.136 · Prom + Grafana · AWS ap-southeast-1a · VPC 10.0.0.0/24 › private subnet 10.0.0.128/25 · NAT Monitoring Server 10.0.0.136 · Prom + Grafana S3 State Bucket · terraform.tfstate + lock · Architecture component S3 State Bucket terraform.tfstate + lock Operator · laptop · IaC · Architecture component Operator laptop · IaC AWS SSM · Sessions + Params :443 · Architecture component AWS SSM Sessions + Params :443 HTTPS :443 HTTPS :443 HTTP :80 outbound Tunnel :443 docker pull :443 terraform state :443 SSM start-session :443 SSM agent channel SSH :22 · playbooks SSH :22 · playbooks scrape :9100 Cloudflare · luqmansyakir.com AWS ap-southeast-1a · VPC 10.0.0.0/24 public subnet 10.0.0.0/25 · IGW private subnet 10.0.0.128/25 · NAT Legend Backend Cloud Security External

Public Exposure

  • • web.luqmansyakir.com — Cloudflare proxied A record → EIP, origin port 80 only
  • • monitoring.luqmansyakir.com — Grafana via outbound Cloudflare Tunnel, no open ports
  • • Cloudflare DNS auto-repoints to the new EIP after every redeploy

Configuration Flow

  • • setup-controller.sh drives the whole fleet from the operator laptop
  • • Operator → SSM Session Manager :443 → controller; Ansible over VPC-internal SSH :22
  • • Terraform state + lock live in S3; Cloudflare token in SSM Parameter Store

Images & Metrics

  • • Ship app multi-stage Dockerfile → ECR; web pulls over the IGW on :443
  • • Private servers egress through the NAT gateway
  • • Prometheus scrapes node_exporter on web :9100 every 15s