Chapter 2: Architecture

← Back to Index | Previous: Introduction | Next: Prerequisites →

2.1 Split topology

Enterprise deployments use two hosts by default:

Host role	Product	Public entry
AI host	Deslicer AI + Control	`https://<dai-host>/` and `https://<dai-host>/control`
DAP host	Deslicer Automation Platform	Observer API on `https://<dap-host>/` (443); Observer UI on `https://<dap-host>:8443`

Keep Compose projects separate even if you later colocate them. That preserves the ability to move products independently.

flowchart LR Users["Operators_and_users"] DaiCaddy["DAI_Caddy_443"] DaiWeb["DAI_web_127.0.0.1_13000"] DaiControl["DAI_control_127.0.0.1_13001"] DapCaddyApi["DAP_Caddy_443"] DapCaddyUi["DAP_Caddy_8443"] ObserverApi["Observer_API_loopback"] ObserverUi["Observer_UI_loopback"] Users --> DaiCaddy DaiCaddy -->|"/"| DaiWeb DaiCaddy -->|"/control"| DaiControl Users --> DapCaddyApi Users --> DapCaddyUi DapCaddyApi --> ObserverApi DapCaddyUi --> ObserverUi DaiWeb -->|"HTTPS_public_edge"| DapCaddyApi

2.2 Deslicer AI URL map

Deslicer AI does not publish the application directly on the public interface. Containers listen on loopback; Deslicer Caddy terminates TLS on port 443 and routes:

Public URL	Upstream
`https://<dai-host>/`	`127.0.0.1:13000` (main application)
`https://<dai-host>/control`	`127.0.0.1:13001` (Control)
`https://<dai-host>/api/control*`	`127.0.0.1:13001`

The same hostname certificate covers / and /control.

2.3 DAP URL map

DAP uses Deslicer Caddy for its public edge. On the default split-host enroll path, Caddy publishes:

Public URL	Role
`https://<dap-host>/` (port 443)	Observer API (data / management multiplex as configured)
`https://<dap-host>:8443`	Observer management UI

Application containers stay on loopback; only Caddy listens on the public ports. Always use the URLs Control shows when installing if an engagement overrides the defaults.

On a split topology (DAI and DAP on separate hosts), Deslicer AI Control stores the public edge URL (HTTPS on 443) for both the server-side backend probe and the tenant-facing Observer URL. Probes and dashboard calls leave the AI host over HTTPS to that hostname. Always use the Observer URL Control shows for your engagement.

2.4 Why Caddy is part of the product

Deslicer ships and configures Caddy through the shared edge proxy role used by both products:

Loopback-only application binds reduce accidental exposure of app ports
Path routing for / and /control on one certificate
Certificate modes: automatic HTTPS (ACME) or customer-provided PEM
Certificate changes can be applied without recreating the full Compose stack (proxy-only apply)

You do not need to design your own nginx/HAProxy config for the primary install path. An optional corporate load balancer in front of Caddy is an advanced overlay; Deslicer still installs and manages Caddy on the product hosts.

2.5 Data and secrets layout (host)

Typical paths after install:

Path	Purpose
`/opt/deslicer/ai`	Deslicer AI Compose project and `.env`
`/opt/deslicer/dap`	DAP Compose project and `.env`
`/opt/deslicer/bin`	Published install and uninstall scripts (Chapter 5, Chapter 7)
`/etc/caddy/`	Caddyfile and certificate material

Treat install answers, age identities, and registry passwords as secrets. Do not commit them to git.

2.6 DAP Ansible install-bundle updates

DAP host install uses an Ansible tarball served by Deslicer AI Control (token-gated). That tarball is an independent release train from the Deslicer AI application image:

Plane	Host / product	Role
Metadata	`registry.deslicer.io`	Version, sha256, download URL, optional `minDaiVersion`
Bytes	`artifact-registry.deslicer.io`	Immutable versioned tarball
Pin + cache	Control + Docker volume on the AI host	Operator-applied bundle used by enroll / `--update`

Operators apply updates in Control → Updates → DAP (Apply update or air-gapped Import package). There is no day-2 env var to pin the playbook. Auto-apply on registry poll is not used.

Reading version numbers (three independent surfaces)

The UI shows three version-like strings that come from different release trains. They can look similar but never move together; the digest / sha256 is the identity that matters.

Surface	What it versions	Example	Real identity
Control → Updates → Deslicer AI web	OCI image tip (`enterprise-ui`) on the floating channel	`0.2.14` + short git SHA	OCI digest — Installed = Available means digests match
Web footer "Build"	Build stamp baked into the running image (`/api/v1/version`)	`preview-0.2.14-20260807T212922Z`	`build_id` / `image_tag` from the image bake, not a registry lookup
Control → Updates → DAP install package	Ansible tarball (registry product `dap-ansible-bundle`)	`20260808.72420.0`	tarball sha256 — up to date when the applied pin's sha matches the registry tip

DAP install-bundle registry versions use a build-stamp form (YYYYMMDD.HHMMSS.seq) or a git SHA — never DAI-style 0.x.y — so they cannot be mistaken for the Deslicer AI image version. The bundle's minDaiVersion field is a compatibility floor for Apply, not a claim that the bundle "is" that DAI version. Applying a DAP package never changes the Deslicer AI image, and promoting a new DAI image never changes the DAP package pin.

Trust boundaries:

Control verifies sha256 before writing the cache and again when serving the bundle
Downloads are restricted to allowlisted artifact-registry HTTPS hosts
Incompatible bundles (minDaiVersion above the running DAI) are blocked; applying a non-latest pin requires explicit confirmation
Roll back restores the previous verified cache entry
A new Deslicer AI image is still required when enroll APIs or provision schema change—not for playbook-only hotfixes

← Back to Index | Previous: Introduction | Next: Prerequisites →