Skip to content
Arron Pitman — Systems Engineering

Estate topology

Every node and every edge below is derived, not drawn. The graph is regenerated daily from four sources that are each maintained for some other reason — the metrics agent’s probe inventory, the configuration inventory, live database connections, and one declared file for a dependency no API can enumerate. Nothing is placed by hand, which is what makes it impossible for the map to drift without something else breaking first.

Estate topology — derived, never drawn

Snapshot taken — build-time, not live
87 nodes · 133 edges
app service 1 · on infra host 3 · 2 edges app service 2 · on infra host 3 · 1 edges media service 1 · on infra host 3 · 1 edges security service 1 · on infra host 3 · 1 edges infra service 1 · on infra host 7 · 1 edges media service 2 · on infra host 3 · 1 edges network service 1 · on infra host 3 · 1 edges infra host 1 · 4 edges media service 3 · on infra host 3 · 1 edges infra host 2 · 4 edges infra host 3 · 63 edges network service 2 · on infra host 3 · 1 edges infra service 2 · on infra host 3 · 1 edges security service 2 · on infra host 3 · 2 edges infra provider 1 · on infra host 3 · 1 edges itsm service 1 · on infra host 3 · 1 edges app service 3 · 1 edges app service 4 · 1 edges infra service 3 · on infra host 3 · 1 edges monitoring service 1 · on infra host 3 · 1 edges app service 5 · on infra host 3 · 1 edges app service 6 · on infra host 3 · 1 edges network service 3 · on infra host 3 · 1 edges infra service 4 · on infra host 3 · 1 edges itsm service 2 · on infra host 3 · 2 edges security service 3 · on infra host 3 · 2 edges infra provider 2 · on infra host 3 · 1 edges network service 4 · on infra host 3 · 1 edges infra host 4 · 4 edges media service 4 · on infra host 3 · 1 edges media service 5 · on infra host 3 · 1 edges infra provider 3 · on infra host 3 · 15 edges media service 6 · on infra host 3 · 1 edges infra service 5 · on infra host 3 · 1 edges app service 7 · on infra host 3 · 2 edges infra provider 4 · on infra host 3 · 1 edges itsm service 3 · on infra host 3 · 2 edges infra provider 5 · on infra host 3 · 1 edges media service 7 · on infra host 3 · 1 edges app service 8 · on infra host 3 · 2 edges app service 9 · on infra host 3 · 1 edges infra provider 6 · on infra host 3 · 1 edges backup service 1 · on infra host 3 · 1 edges backup service 2 · on infra host 3 · 1 edges network service 5 · on infra host 10 · 1 edges network service 6 · on infra host 11 · 1 edges app service 10 · on infra host 3 · 1 edges app service 11 · on infra host 3 · 2 edges infra service 6 · on infra host 3 · 1 edges media service 8 · on infra host 3 · 1 edges infra host 5 · 4 edges infra service 7 · on infra host 3 · 1 edges monitoring service 2 · on infra host 3 · 15 edges infra service 8 · on infra host 3 · 1 edges infra host 6 · 4 edges media service 9 · on infra host 3 · 1 edges app service 12 · on infra host 3 · 9 edges app service 13 · 1 edges media service 10 · on infra host 3 · 1 edges infra host 7 · 5 edges infra host 8 · 4 edges security service 4 · on infra host 3 · 1 edges media service 11 · on infra host 3 · 1 edges infra service 9 · on infra host 3 · 1 edges infra service 10 · on infra host 3 · 1 edges infra service 11 · on infra host 3 · 15 edges media service 12 · on infra host 3 · 1 edges security service 5 · on infra host 3 · 1 edges app service 14 · on infra host 3 · 2 edges infra provider 7 · on infra host 3 · 1 edges media service 13 · on infra host 3 · 1 edges infra service 12 · on infra host 3 · 1 edges security service 6 · on monitoring service 3 · 1 edges media service 14 · on infra host 3 · 1 edges network service 7 · on infra host 3 · 1 edges backup service 3 · on infra host 3 · 1 edges infra host 9 · 4 edges infra service 13 · on infra host 3 · 1 edges app service 15 · 1 edges app service 16 · 1 edges media service 15 · on infra host 3 · 1 edges infra host 10 · 5 edges infra host 11 · 5 edges infra host 12 · 4 edges infra host 13 · 4 edges app service 17 · on infra host 3 · 1 edges monitoring service 3 · on infra host 3 · 20 edges
appbackupinfraitsmmediamonitoringnetworksecurity

Labels are pseudonyms by design. Node names, hostnames, dashboard links and service URLs are removed by the build's sanitiser, which then asserts its own output and fails the build on any survivor. Radius is degree — how many derived relationships a node participates in. Four independent derivation sources contributed this graph: alloy (62), ansible_inventory (15), postgresql (6), services_yml (8). The estate's internal copy of this map fails closed if any one of them dies or answers thinly, so a half-empty graph is never published in place of a complete one.

Why the labels are pseudonyms

Section titled “Why the labels are pseudonyms”

The internal copy of this map names every service and host, and links each node to its dashboard, its documentation page and its hostname. That is the correct design for an operator and the wrong thing to publish: it is an enumeration of the estate’s attack surface, and information disclosure is the one genuine risk this site carries.

So the build strips names, hostnames, URLs and descriptions, replaces each label with a role word derived from the node’s own attributes, and then asserts its own output — any surviving estate identifier, internal domain or private address aborts the build. That assertion is proven to fire against a deliberately poisoned graph before it is trusted, in line with the gate testing rule every control here follows.

What survives is the part worth reading anyway: how many things there are, how they cluster by domain, which kinds of relationship exist between them, and that four independent derivations agree about all of it.

How to read it

Section titled “How to read it”
  • Radius is degree — how many derived relationships a node takes part in. The large nodes are the ones a lot of other things depend on.
  • Colour is domain. Eight domains, held at one lightness so no category reads as more important than another.
  • Thick-stroked nodes are hosts, the rest are services.
  • Filtering by edge kind hides nodes that take no part in that kind of relationship, rather than leaving them floating unattached — an isolated node under a filter would read as this thing has no dependencies, which is the opposite of true.

What it does not show, and why that is the point

Section titled “What it does not show, and why that is the point”

This is a build-time snapshot, stamped with the moment it was taken, and it is never presented as live. The site is a static bundle with no origin and no estate API — a deliberate posture decision, because a live panel would require publishing an interface into the estate, which is a larger change than any visualisation is worth.

The internal map has one further property this one inherits: it refuses to publish a confidently-wrong version of itself. If a derivation source dies the render aborts; if a source answers thinly, a calibrated per-source gate rejects the staged graph and the previous map stays live. A stale map announces its age. A half-empty one announces nothing at all — that story is the map that could not be trusted.

Reasoning: ADR-0359 · ADR-0371