Legacy Production Fleet (current prod on Exoscale, being replaced by v7) Diagram

www → ui0/ui1 (sticky by client IP so one deploy never mixes two builds); tracking. → ui1
api → api0..2 round robin, 7 connections per server; per-IP 429 limits, scanner and bot denies before routing
images. → Varnish → images0/1; media. → SOS bucket c2corg-active, and /c2corg-dem/ terrain tiles (range GETs from camptocamp.org origins only)
Internal frontends on the HAProxies: :9200 Elasticsearch, :8080 API (UI head tags), :8081 images, allowed only from the Exoscale zone

All VMs: Exoscale ch-dk-2, public IPs, one security group production whose members trust each other on every port; Docker 1.12, Debian 8 to 10
One compose folder per VM in composition/production/, each .env sets DOCKER_HOST to that VM's remote Docker daemon (plaintext, protected only by the security group)
API_VERSION lives once in server-list.env and drives api0..2 plus syncer and scheduler
certbot on workers renews the certificate; the bastion copies it into both HAProxy images every week
forum-beta (old Discourse VM) is still routed for verification, to be deleted

c2corg-active: versioning, 30-day recovery window, deletes of versions denied, anonymous reads only from the HAProxies
c2corg-dem: CORS and HAProxy-only reads, served by HAProxy for the 3D map
collectd removed from the UI VMs; Grafana Cloud (free tier) set up outside this repository

Terraform + Ansible from the bastion, VPC, elastic IP, Debian 13
PostgreSQL 18 + WAL-G, ES 8.19, Redis 8, HAProxy 3.4; Prometheus replaced by Grafana Cloud + Alloy
See the v7 / preprod diagram; this fleet is switched off after the cutover