Installation Options and Architecture

The SOAP-2-REST platform is designed to run entirely within your network. It does not expose any public endpoints directly; access is managed through your own ingress controller, such as a cloud Identity-Aware Proxy (IAP), an internal load balancer, or a reverse proxy that you control.

This document provides an overview of the platform's architecture and the available deployment options to help you choose the best fit for your environment.

Architecture

The platform consists of a set of stateless services that rely on a single PostgreSQL database for all persistent configuration and state. The database serves as the single source of truth for the system.

flowchart TD
    subgraph "Your Network"
        direction LR
        subgraph "Ingress"
            direction TB
            ingress_proxy[Your Reverse Proxy /<br/>Load Balancer / IAP]
        end

        subgraph "Platform Services"
            direction TB
            admin_ui[Admin UI]
            runtime[Runtime]
            admin_api[Admin API]
            worker[Worker]
            ingest[Generic Ingest]
            cloud_adapter[Cloud Adapter]
        end

        subgraph "Data Store"
            direction TB
            db[(PostgreSQL DB)]
        end

        ingress_proxy -- "Admin Traffic" --> admin_ui
        ingress_proxy -- "Live API Traffic" --> runtime

        admin_ui -- "Proxies to" --> admin_api
        admin_ui -- "Proxies to" --> runtime

        admin_api --- db
        runtime --- db
        worker --- db
        ingest --- db
        cloud_adapter --- db
    end

    user[API Publisher] -- "Manages platform" --> ingress_proxy
    consumer[API Consumer] -- "Sends requests" --> ingress_proxy

Component Roles

All persistent data is stored in PostgreSQL tables, which are prefixed with s2r_. The admin-api service is responsible for applying all database schema migrations using Flyway upon startup.

Deployment Options

The following deployment topologies are generally available (GA) as of version 1.0.

Sample Terraform environments for AWS, Azure, and a vSphere relay are also available as a starting point. For more details, see the documentation on GCP & multi-cloud notes.

How to Choose a Deployment Option

• For evaluation or a single-host deployment: Use the Docker Compose option. It requires a single .env file and one command (docker compose up) to run. You will need to place your own TLS-terminating proxy or load balancer in front of it.

• For high availability on Kubernetes or OpenShift: Use the Helm chart. This allows you to scale the runtime service horizontally, connect to a managed PostgreSQL instance, and integrate with your cluster's ingress and OIDC provider.

• For a fully managed deployment on Google Cloud: Use the GCP-native option. It leverages Cloud Run for autoscaling, Cloud SQL with IAM database authentication for security, and Cloud IAP for edge access control, minimizing your operational footprint.

Before You Start

Before beginning an installation, you must make several planning decisions and prepare key credentials.

• PostgreSQL Strategy: Decide how you will run PostgreSQL. The container bundled with Docker Compose is suitable for demos and small installations. For production environments, a managed or high-availability PostgreSQL cluster is recommended.

• Secrets Generation: You must generate two critical secrets before installation:

  1. The password for the PostgreSQL database.
  2. The credential key, an AES key used to encrypt backend system credentials at rest in the database. For more information, see the Configuration reference.

• Bootstrap Administrator: Identify the email address(es) for the initial administrator(s). The first authenticated user to access the Admin UI after a fresh installation is automatically granted administrative privileges.

• Egress Firewall Rules: The platform requires outbound HTTPS access to Specaria for licensing and software updates. Plan to allow this egress traffic. The system includes a 14-day offline grace period to accommodate transient connectivity loss. For details, see the Egress allow-list.

After completing these steps, select your preferred deployment option from the list above and proceed to its specific installation guide.

See Also

• Backup & Restore Guide
• Configuration Reference
• Egress Allow-List for Licensing

All SOAP-to-REST docs