Networking and Access
This page explains how traffic is routed to the servers and how you, as an engineer, reach the parts of production that are not public.
Source: infra-volare/terragrunt/live/us-east-2/*/{vpc,load-balancer,target-groups,cloudflare-dns,*-private-dns,twingate-*}
How you get access
Section titled “How you get access”| You want to… | Use | Notes |
|---|---|---|
| Open a shell on a server | AWS SSM Session Manager | No SSH keys needed. See Server Access. |
| Connect to RDS with a SQL client | Twingate | Twingate gives you the whole VPC; use the DB credentials from the backend .env parameter. |
Open Swagger (/api/documentation), /health or Telescope |
Twingate | These paths only answer to traffic coming from inside the VPC, which is how Twingate traffic appears. |
| Open the Hermes dashboard | Cloudflare Access login | agents[-staging-1].byvolare.com |
Ask for Twingate access (groups staging / production) and AWS access to both accounts when you
join. The team’s skills and runbooks expect these AWS CLI profiles:
| Profile | Account | Used by |
|---|---|---|
| default | staging | /ec2-connect, day-to-day staging work |
production |
production (organization access role) | /ec2-connect, /db-restore, production shells |
volare, volare-production |
staging / production | Terragrunt in infra-volare (see Working on infra-volare) |
Load balancers
Section titled “Load balancers”Each account has three Application Load Balancers (HTTPS only; HTTP redirects to HTTPS):
| ALB | Public? | Routes |
|---|---|---|
api |
yes | api.../api/* → api servers · arkana... → api servers · analytics.byvolare.com → Analytics MCP on ops-runner · Hermes host → Hermes (Cloudflare IPs only) |
api-internal |
VPC only | The same API and Arkana hosts, for callers inside the VPC (Hermes reaches the Arkana MCP this way) |
front |
yes | byvolare.com (and www, redirected to the apex) → front servers |
Rules worth knowing on the public api ALB:
/health,/api/documentationand/docsare blocked from the internet and only allowed from the VPC (i.e. over Twingate).- With Twingate on, the whole api hostname is routed to the ops-runner, which is where Telescope runs. Telescope is blocked on staging.
/api/*and/mcp/*on the Arkana hostname return 403: the API lives onapi.and the MCP is reachable only through the internal ALB.- Health checks: the load balancer calls
/healthon each server every 5 seconds and takes unhealthy servers out of rotation.
Public DNS is managed in Cloudflare by Terraform (cloudflare-dns units). Records are CNAMEs to
the ALBs or to CloudFront and are not proxied — Cloudflare only answers DNS. The exception is
the Hermes host (agents), which is proxied so Cloudflare Access can protect it.
Inside the VPC, private Route 53 zones with the same names as api.byvolare.com and
arkana.byvolare.com point to the internal ALB, so in-VPC callers never leave the network.
Hermes registers itself as agents.<env>.internal.byvolare.com.
Network layout
Section titled “Network layout”- One VPC per account, two availability zones (
us-east-2a,us-east-2b). - Public subnets hold the load balancers and a single NAT gateway; private subnets hold every server and the database.
- All outbound traffic (AerTicket, Stripe, …) leaves through the NAT gateway, so it comes from one fixed IP per environment. Suppliers that allow-list IPs need that address — ask the infra owner.
- A Twingate connector runs in each VPC (
twingate-connectorunit, one small instance).