Architecture

Naburis is a product-agnostic infrastructure foundation built on a modular architecture. It provides shared services that any number of product applications can integrate with — without the platform depending on the specifics of what those products do.

---

Design Principles

Principle	Description
Product Agnostic	The platform is independent of product-specific logic
Modular Products	Products are self-contained units with declared contracts
Convention over Configuration	Standard interfaces and paths reduce boilerplate
Observability First	Every component is monitored, logged, and alertable by default
Security by Default	TLS everywhere, OIDC for authentication, and deny-by-default authorization
Efficient Footprint	Optimized for high-density deployments

---

Platform Capabilities

Naburis provides shared infrastructure organized into three layers:

Infrastructure

Capability	Description
Relational Storage	Shared database with geospatial and vector search extensions
Identity Provider	Centralized OIDC authentication with per-organization tenant isolation
Caching & Queuing	In-memory caching, rate limiting, and event streaming with per-product isolation
Object Storage	S3-compatible storage for archives, backups, and application data
Reverse Proxy	Automatic TLS, edge rate limiting, security headers, and request routing

Observability

Capability	Description
Metrics	Collection, recording rules, and threshold alerting
Dashboards	Visualization with SSO integration
Log Aggregation	Centralized log collection and querying
Alert Routing	Grouping, deduplication, and notification delivery

Products

Each product provides its own services and integrates with the platform via declared contracts. Products remain independently deployable while sharing platform infrastructure.

---

Architecture Overview

All traffic enters through the edge layer with automatic TLS and rate limiting. Platform services handle identity, billing, metering, and observability. Products integrate with shared infrastructure while maintaining isolated internal topologies.

---

Product Integration

Products integrate with the platform through a standard contract:

1. Network attachment — Access shared storage, caching, and identity services
2. Manifest declaration — Register pricing tiers, health checks, domains, and resource requirements
3. Route configuration — Define public-facing endpoints
4. Usage reporting — Expose metrics for per-customer metering and billing

This ensures each product remains independently deployable while sharing authentication, billing, observability, and data infrastructure.

---

Security Model

Layer	Control
TLS	Automatic certificate management for all endpoints
Authentication	OIDC-based authentication for all UIs and APIs
Authorization	Per-product scopes and roles with deny-by-default policy
Secrets	Encrypted at rest, not stored in version control
Scanning	Container images scanned for vulnerabilities before deployment
Policy	Infrastructure-as-code with policy-gated deployments

See Security & Trust for the full security posture.