Appearance
Shopware Network Architecture
Overview
The Shopware platform uses 10.34.0.0/16 (primary) and 10.35.0.0/16 (DR). Each business unit receives a /20 (4,096 IPs) that is split into two /21 environments (Production and Staging), each deployed in a separate AWS account.
Components
Each Shopware deployment consists of three application tiers plus supporting services:
| Tier | Technology | Compute | Notes |
|---|---|---|---|
| Frontend | Next.js | EKS or Cloudflare Workers | SSR, static assets; runs in the EKS VPC or off-VPC on Cloudflare |
| Domain API | GraphQL (Apollo Federation) | EKS | Pods in the dedicated EKS VPC |
| Backend | Shopware 6 | Webscale-managed EC2 | Admin, cron workers, API |
| Data | RDS, ElastiCache, OpenSearch, RabbitMQ | Webscale-managed | In the Webscale VPC private subnets |
BU Allocation — 10.34.0.0/16
Each BU receives a /20, split into a Production /21 and a Staging /21:
| CIDR Block | BU |
|---|---|
10.34.0.0/20 | SupplySync |
10.34.16.0/20 | Baker |
10.34.32.0/20 | Gemaire |
10.34.48.0/20 | CENA |
10.34.64.0/20 | ECMDI |
10.34.80.0/20 | Peirce Phelps |
10.34.96.0/20 | CELATAM |
10.34.112.0/20 | Homans |
10.34.128.0/20 | GreeComfort |
10.34.192.0/20 | Shared Services |
10.34.144.0/20–10.34.176.0/20 are unassigned BU slots. For the precomputed Production/Staging /21 values and every per-system block, see CIDR Allocations.
Per-Environment Layout
Each BU's /21 is carved into two VPCs following the Webscale-managed model, with a reserved block between them:
| Offset | CIDR | Purpose |
|---|---|---|
+0 | /23 | Webscale VPC — Shopware Backend, data services, ingress |
+2 | /23 | Reserved / overflow |
+4 | /22 | EKS VPC — Domain API (GraphQL) + PWA / Next.js Frontend |
See CIDR Allocations for the authoritative per-BU values, subnet detail, and sizing rationale.
Design Rationale
Two VPCs per environment
The two VPCs (offsets above) are peered to each other:
- The Webscale VPC is provisioned by Webscale with a simplified template (2 public + 3 private subnets) using security-group-level isolation between workloads rather than a subnet per tier. It holds the Shopware Backend on Webscale-managed EC2, the data services, and the Webscale ADCs that serve as the environment's single ingress point.
- The EKS VPC is a dedicated per-BU cluster for the Domain API and PWA pods.
The EKS block is a /22 rather than the originally planned /23, revised after a live IP-exhaustion incident on the CENA staging cluster during a blue/green rollout. See CIDR Allocations for the exact per-BU blocks, subnet templates, and the full sizing rationale.
Ingress and connectivity
The Webscale ADCs are the single ingress point — there is no internet-facing ingress and no AWS ALBs in the EKS VPC. Inbound traffic reaches the Domain API and PWA pods from the ADCs over the VPC peering link. Peering also gives the pods a path to the Shopware backend and, in production, to a shared ElastiCache (an in-cluster Valkey deployment is a convenience measure only; a shared cache lets state survive rolling and blue/green deployments). The EKS VPC uses its public subnets solely for NAT egress to third-party APIs.
Why not a full per-tier layout
A per-tier layout (one subnet per application tier across the full /21) was rejected in favor of the Webscale model:
| Aspect | Per-tier /21 (rejected) | Two-VPC Webscale + EKS (adopted) |
|---|---|---|
| Webscale VPC size | /21 (2,048 IPs) | /23 (512 IPs) |
| Subnet count | 18+ (3 AZ × 6 tiers) | 5 per VPC |
| Tier isolation | Network-level (separate subnets) | Security-group-level |
| Data tier | Dedicated /24 | Shared private subnets |
| Expansion model | Pre-allocated per tier | Separate EKS VPC + peering |
| Provisioning complexity | Significant custom labor from Webscale | Webscale standard template |
Shared EKS Option (Not Adopted)
A single shared EKS cluster per environment — with all BU Domain API workloads running as namespaced deployments — was considered as an alternative to per-BU clusters. It was not adopted: the platform uses a dedicated EKS VPC per BU/environment (offset +4). See CIDR Allocations for the authoritative model.
Diagrams
Per-Environment VPC Subnet Layout
DR — 10.35.0.0/16
Identical structure deployed in the DR region. Same BU offsets, same subnet pattern. No CIDR overlap enables Transit Gateway route propagation between primary and DR without conflicts.
Comparison with Magento (10.33)
| Aspect | 10.33 (Magento) | 10.34 (Shopware) |
|---|---|---|
| Per-BU allocation | 10× /24 (2,560 IPs) | /20 (4,096 IPs) |
| Per-environment allocation | /23 (512 IPs) | /21 (2,048 IPs) |
| Component isolation | None — shared subnets | Two VPCs (Webscale + EKS), SG-level within each |
| EKS support | N/A | Dedicated /22 EKS VPC for Domain API + PWA |
| Data tier | Mixed with compute | Webscale VPC private subnets |
| Expansion headroom | Tight (CENA marked "Full") | Reserved /23 per env (offset +2) |
| DR strategy | Adjacent /23 in same /16 | Separate /16 (10.35) |