Appearance
CE Infrastructure Status
Current and planned infrastructure for the Carrier Enterprise e-commerce platform.
Environments Overview
| Environment | PWA | Domain (GraphQL) | Shopware | Status |
|---|---|---|---|---|
| Staging | Webscale cluster | Webscale Docker Compose | Webscale standard | Active |
| Pre-production | — | — | Webscale standard | Partial |
| EKS (future) | EKS workload | EKS workload | Webscale standard | In progress |
Staging (Current)
All components hosted in Webscale within a single AWS VPC. Three logical "clusters" share the VPC: PWA, Domain, and Shopware.
Architecture
Key Details
- Frontend Proxy: Two Webscale "applications" — the frontend routes
/graphqlto the Domain cluster's router via a request web control. - PWA Cluster: Single-container traditional cluster, stateless.
- Domain Cluster: Webscale's semi-custom Docker Compose framework hosting the Apollo Router and all subgraphs.
- NFS Server: Provides shared storage for Shopware and hosts a proxy enabling in-VPC traffic from Domain → Shopware. Subgraph containers have
/etc/hostsentries pointing the Shopware hostname at this proxy. - Shopware Cluster: Standard Webscale Shopware hosting — web cluster for traffic, auxiliary cluster for cron. The auxiliary rotates in when the web cluster is deployed.
- Conduit: Connected via AWS Transit Gateway; subgraphs reach Conduit APIs through internal URLs.
Secrets & Configuration
| Component | Secret Source |
|---|---|
| PWA | AWS Secrets Manager (env vars) |
| Domain | AWS Secrets Manager (env vars) |
| Shopware | .env file pulled from S3 during deployment |
Deployment (Jenkins)
PWA
Domain
Shopware
Pre-production
Currently only the Shopware tier exists in pre-production while we evaluate EKS for domain/PWA hosting.
- Same Webscale paradigm as staging
- Jenkins deployment jobs do not yet exist (manual process)
- Transit gateway connectivity to Conduit is still a work in progress
EKS (Future State)
Webscale Engineering is building an EKS-based hosting solution for Domain and PWA tiers. We have proven successful deployment, but production readiness requires additional work.
Target Architecture
Blue/Green Deployment Model
Webscale manages the blue/green lifecycle. Each deployment targets a new namespace; once validated, Webscale updates the frontend proxy to route to the new namespace's NodePort service and tears down the old one.
EKS Workload: Domain API (Helm Chart)
The domain-api Helm chart deploys the Apollo Router and all subgraphs as a single release:
Chart components:
| Resource | Description |
|---|---|
| Router Deployment | Apollo Router, ports 4000/8089 |
| Router Service | NodePort — exposes port 4000 to Webscale load balancer |
| Router ConfigMap | Router configuration (supergraph, CORS, headers, telemetry, subgraph URL overrides) |
| Subgraph Deployments | 22 subgraphs, each with its own Deployment + ClusterIP Service |
| ExternalSecret | Pulls secrets from AWS Secrets Manager via ClusterSecretStore (TBD — requires negotiation with Webscale) |
| NetworkPolicy | Default-deny ingress; allows LB→Router, Router→Subgraphs |
| HPA / VPA / PDB | Available but disabled in staging |
Outstanding Work
| Item | Owner | Status | Notes |
|---|---|---|---|
| Blue/green namespace rotation | Webscale | In progress | Webscale Engineering building this |
| Correct VPC CIDR | Webscale | Not started | Current test cluster has wrong CIDR |
| Nodes in private subnets | Webscale | Not started | Current nodes in public subnets — can't use allowlists |
| NAT egress | Webscale | Not started | Required for private subnet internet access |
| Transit Gateway for Conduit | Conduit team | Not started | Required for subgraph → Conduit connectivity |
| Shopware connectivity from EKS | Webscale | TBD | Options: VPC peering, TGW, or other |
| PWA workload in EKS | Chris N | Not started | Same cluster, separate Helm release |
| ElastiCache provisioning | Webscale | Not started | Replaces in-cluster Valkey for cache |
| Secrets management | Webscale / Chris | TBD | ExternalSecret operator preferred; Webscale suggested Secrets Manager CSI driver but it mounts as files, not env vars |
| Jenkinsfile for EKS deploy | Chris | Not started | Values generation + Webscale API calls |
| Production HPA/VPA/PDB tuning | Chris / Webscale | Not started | Available in chart, disabled for staging |
Subgraph Inventory (CE Staging)
All images from ECR 442898733491.dkr.ecr.us-east-2.amazonaws.com:
| Subgraph | Port | Upstream |
|---|---|---|
| watsco-shopware-core | 5001 | Shopware |
| ce-shopware-extension | 5002 | Shopware |
| ce-shopware-pricing | 5003 | Shopware |
| ce-shopware-inventory | 5004 | Shopware |
| ce-shopware-lists | 5005 | Shopware |
| watsco-conduit-locations | 5006 | Conduit |
| ce-conduit-curb-adapter | 5007 | Conduit |
| ce-conduit-order-history | 5008 | Conduit + Flow API |
| ce-conduit-ahri | 5009 | Conduit (AI) |
| watsco-conduit-fbt | 5010 | Conduit |
| ce-conduit-where-used | 5011 | Conduit |
| ce-conduit-part-finder | 5012 | Conduit (legacy) |
| ce-conduit-supersede-history | 5013 | Conduit |
| ce-conduit-part-cross-reference | 5014 | Conduit |
| ce-conduit-documents | 5015 | Conduit |
| ce-conduit-scratch-and-dent | 5016 | Conduit |
| ce-conduit-warranty | 5017 | Conduit |
| ce-conduit-security | 5018 | Conduit |
| ce-conduit-notifications | 5019 | Conduit |
| ce-rewards-points | 5020 | Rewards API |
| ce-shopware-system-builder | 5205 | Shopware |
| ce-shopware-dmi | 5206 | Shopware |
| ce-flow-api-catalog | 5021 | Flow API |
| ce-conduit-co-op-claims | 5022 | Conduit |