Data, observability & tooling — N1 IT Landscape

N1 IT Landscape — The Blueprint · CF-Access internal

Data, observability & tooling

N1 IT Landscape · Owner: Arun Venkataraman · source of truth: markdown SSOT

CURRENT-STATE as of 2026-06-09 · part of the N1 IT Landscape (start at Overview). Owner: Arun Venkataraman (Principal Engineer).

Where state lives (the data stores), how the system is watched (observability), the internal tools, and how secrets are managed.

Store	Technology / version	Used by
Primary relational	Aurora PostgreSQL 17.7 Serverless v2 (per-service clusters, manual)	api-backend, auth/Kratos/Hydra, billing, litellm, forge-runner (the agno session/memory + LangGraph checkpoint DB)
Connection pool	pgbouncer v1.25.1-p0 (connection pooling outside the application)	all PG clients
Streams / cache	ElastiCache Valkey 8.2.0 (“Redis” Streams)	the entire parse→CHR pipeline, queues
Object storage	S3 (private), R2 (public wheels)	uploads, KYC, DB backups, TF state / libraries
Vector DB	Qdrant v1.17.0 (in-cluster StatefulSet, S3-backed)	embeddings/search
Graph DB	Memgraph 3.8.1 (in-cluster StatefulSet, S3-backed)	clinical graph
Key-value	DynamoDB (`n1-api-vitals-staging`)	patient vitals / appointment notes

Each major service owns its own database (api-backend, auth, billing, kratos, hydra, litellm, forge-runner) — no shared monolithic DB.

Tracing/metrics/logs: an OpenTelemetry (OTel) collector0.142.0 runs in both clusters (a per-node DaemonSet + a centralized Deployment in monitoring) and ships to SigNoz.
SigNoz runs on a host in the development/AI account , reachable at signoz.n1-research.com (UI) and ingest-signoz.n1-research.com (OTLP ingest, :4318) via a dedicated Cloudflare Tunnel, both Access-gated. 🔒 SigNoz sends alert messages to Slack.
Langfuse captures LLM traces from the AI-powered services (CHR/agents). 🔒 Its tunnel is currently down.
release-scribe (§7.2) posts human-readable “what shipped / what to test / will it break” notes to Slack on every merge to develop and main.

This blueprint is also wired to a SigNoz MCP server for live queries (services, traces, logs, metrics, dashboards, alerts).

admin-dashboard (admin.n1-research.com prod, staging-admin.n1-research.com staging) — the management console: manage users, view transactions, view per-user LiteLLM logs , and generate static service tokens. In staging , developers can self-generate service tokens to test against staging data. Prod admin is locked to the 7-named-email allowlist (§1.3/§6.6).
Slack bots (staging cluster): n1-api-slack-bot (N1 service-token self-service) and the LiteLLM Slack app (LiteLLM key self-service) — both 30-day expiry, invalidate-on-reissue (§11).
NexAI (chat.n1-research.com) — an internal chat/AI surface.
Developer portal / queue dashboard / gitpulse — internal developer tooling (repos present).

Layer	Mechanism
Cloud secret store	AWS Secrets Manager (~150 secrets, §8.8)
Cluster delivery	External Secrets Operator → per-service `ExternalSecret` → k8s Secret → pod
Staff passwords	Dashlane (not Google-linked)
CI → AWS	GitHub OIDC role assumption (no long-lived keys)
Developer API/service keys	Self-service via Slack, 30-day expiry, invalidate-on-reissue
Encryption at rest	KMS CMK for EKS etcd; AWS-managed keys for RDS/S3/Secrets