---
title: "Data, observability & tooling — N1 IT Landscape"
---

N1 IT Landscape — The Blueprint · CF-Access internal

# Data, observability & tooling

N1 IT Landscape · Owner: Arun Venkataraman · source of truth: markdown SSOT

# N1 IT Landscape — Data, observability & tooling

> **CURRENT-STATE** as of **2026-06-09** · part of the **N1 IT Landscape** (start at **[Overview](/landscape/overview/)**). Owner: **Arun Venkataraman** (Principal Engineer).

_Where state lives (the data stores), how the system is watched (observability), the internal tools, and how secrets are managed._

* * *

## 12\. DATA STORES (where state lives)

Store | Technology / version | Used by  
---|---|---  
Primary relational | **Aurora PostgreSQL 17.7 Serverless v2** (per-service clusters, manual) | api-backend, auth/Kratos/Hydra, billing, litellm, forge-runner (the **agno** session/memory + LangGraph checkpoint DB)  
Connection pool | **pgbouncer v1.25.1-p0** (connection pooling outside the application) | all PG clients  
Streams / cache | **ElastiCache Valkey 8.2.0** ("Redis" Streams) | the entire parse→CHR pipeline, queues  
Object storage | **S3** (private), **R2** (public wheels) | uploads, KYC, DB backups, TF state / libraries  
Vector DB | **Qdrant v1.17.0** (in-cluster StatefulSet, S3-backed) | embeddings/search  
Graph DB | **Memgraph 3.8.1** (in-cluster StatefulSet, S3-backed) | clinical graph  
Key-value | **DynamoDB** (`n1-api-vitals-staging`) | patient vitals / appointment notes  
  
Each major service **owns its own database** (api-backend, auth, billing, kratos, hydra, litellm, forge-runner) — no shared monolithic DB.

* * *

## 13\. OBSERVABILITY & ALERTING

  * **Tracing/metrics/logs:** an **OpenTelemetry (OTel) collector`0.142.0`** runs in both clusters (a per-node DaemonSet + a centralized Deployment in `monitoring`) and ships to **SigNoz**.
  * **SigNoz** runs on a host in the **development/AI account** , reachable at `signoz.n1-research.com` (UI) and `ingest-signoz.n1-research.com` (OTLP ingest, `:4318`) via a dedicated Cloudflare Tunnel, both Access-gated. 🔒 **SigNoz sends alert messages to Slack.**
  * **Langfuse** captures LLM traces from the AI-powered services (CHR/agents). 🔒 Its tunnel is currently **down**.
  * **release-scribe** ([§7.2](/landscape/source-cicd/)) posts human-readable "what shipped / what to test / will it break" notes to Slack on every merge to `develop` and `main`.

This blueprint is also wired to a **SigNoz MCP server** for live queries (services, traces, logs, metrics, dashboards, alerts).

* * *

## 14\. INTERNAL TOOLING

  * **admin-dashboard** (`admin.n1-research.com` prod, `staging-admin.n1-research.com` staging) — the management console: manage users, view transactions, view **per-user LiteLLM logs** , and generate **static service tokens**. In **staging** , developers can self-generate service tokens to test against staging data. Prod admin is locked to the 7-named-email allowlist ([§1.3](/landscape/people/)/[§6.6](/landscape/cloudflare/)).
  * **Slack bots** (staging cluster): **n1-api-slack-bot** (N1 service-token self-service) and the **LiteLLM Slack app** (LiteLLM key self-service) — both 30-day expiry, invalidate-on-reissue ([§11](/landscape/ai-models/)).
  * **NexAI** (`chat.n1-research.com`) — an internal chat/AI surface.
  * **Developer portal / queue dashboard / gitpulse** — internal developer tooling (repos present).

* * *

## 15\. SECRETS & KEY MANAGEMENT (summary)

Layer | Mechanism  
---|---  
Cloud secret store | **AWS Secrets Manager** (~150 secrets, [§8.8](/landscape/aws/))
Cluster delivery | **External Secrets Operator** → per-service `ExternalSecret` → k8s Secret → pod  
Staff passwords | **Dashlane** (not Google-linked)  
CI → AWS | **GitHub OIDC** role assumption (no long-lived keys)  
Developer API/service keys | Self-service via Slack, **30-day expiry, invalidate-on-reissue**  
Encryption at rest | KMS CMK for EKS etcd; AWS-managed keys for RDS/S3/Secrets  
  
* * *