Architecture
Architecture
Control plane vs data plane — how Bytstack builds, runs, and routes Node apps.
Bytstack splits into two planes:
- Control plane — NestJS API, auth, billing, webhooks, deploy scheduling, domain records, encrypted secrets (
apps/api). - Data plane — Kubernetes workloads for your apps, ingress/edge, static assets, and managed databases.
High-level flow
GitHub / CLI / Dashboard
│
▼
Control plane API ──► Redis queues
│ │
│ ┌──────┴──────┐
│ ▼ ▼
│ Builder Provisioner
│ │ │
│ ▼ ▼
│ Registry User Postgres
│ │
└──────────────┼──► Runtime cluster
▼
Ingress → Web / Worker / Cron| Worker | Role |
|---|---|
| Builder | Clone, install, build, push images / upload static assets (deploy queue) |
| Provisioner | Databases, credentials, backups, deprovision (provision, backup, …). Sole holder of PG_ADMIN_URL. |
Hierarchy
Workspace → Project → web / static / worker / cron services + databases.
Networking
| Surface | Example |
|---|---|
| Platform ingress | *.bytstack.app |
| Customer hosts | CNAME / ALIAS → project edge |
| External Postgres | TLS hostname + allowlist |
| Internal DB | Private DNS inside the cluster |
Isolation
Customer apps and databases run in isolated networking. Managed data is reachable from your services on a private network by default — not from the public internet unless you opt into external access.
Observability (what you see vs what we see)
Your dashboard shows service Metrics, Logs, custom alert rules, and optional BYO tracing. Platform Grafana is for Bytstack operators only and is not on the public internet. Do not point a customer OTLP endpoint at Bytstack Tempo.