# Infrastructure map

[中文](infrastructure.zh-CN.md) · English

This document separates shared infrastructure from the parts that define
K1412 Agent behavior.

## Request path

```text
Internet
  -> DNS / TLS
  -> Nginx Proxy Manager
  -> Unraid NAS : K1412 web stack
  -> Tailscale + SSH
  -> home-node-itx : per-user Docker workspaces
```

## Shared infrastructure

These services make the application reachable or deployable, but changing
them does not change the Agent loop:

| Service | Responsibility |
| --- | --- |
| `git.k1412.top` | Public source repository |
| `docker.k1412.top` | Private immutable container images |
| Nginx Proxy Manager | HTTPS entry and reverse proxy |
| k1412 homepage | Service discovery entry |
| Tailscale | Private NAS-to-execution-host network |
| Unraid Compose Manager | Application lifecycle on the NAS |
| Ollama + 32 GB NVIDIA GPU | Luna, Terra, and Sol model serving |

Other NAS applications are independent tenants. They are not dependencies of
K1412 Agent merely because they share the host.

## K1412 platform services on the NAS

| Container | Responsibility | Agent core? |
| --- | --- | --- |
| `k1412-agent-web` | Open WebUI auth, RBAC, history, and UI | Product shell |
| `k1412-agent-runtime` | Agent loop and provider gateway | Yes |
| `k1412-agent-gateway` | Identity, execution policy, workspace lifecycle | Yes |
| `k1412-agent-postgres` | Open WebUI and Runtime durable state | State |
| `k1412-agent-redis` | Open WebUI coordination/cache | State |
| `k1412-agent-bootstrap` | Idempotent admin/tool bootstrap job | Operations |

Only Web publishes a host port. Runtime, Gateway, PostgreSQL, and Redis stay on
private Compose networks.

## Physical execution host

`home-node-itx` is a dedicated, replaceable Docker execution node:

- Intel Core i3-12100F, 4 cores / 8 threads;
- approximately 14 GiB usable RAM;
- 120 GB NVMe system disk;
- 500 GB SSD formatted ext4 and mounted at `/srv/k1412-data`;
- Docker root at `/srv/k1412-data/docker`;
- user workspace volumes stored on the same data disk.

The NAS Gateway connects with a dedicated Ed25519 key and strict host-key
checking. The execution host stores no web/database secrets. Replacing it
requires migrating Docker volumes and changing SSH configuration, not changing
the Agent loop.

## Agent core

The code intended for continuous experimentation is:

- `agent_platform/runtime/loop.py`: loop and evidence policy;
- `agent_platform/runtime/context.py`: context policy;
- `agent_platform/runtime/tools.py`: tools and scheduling metadata;
- `agent_platform/store.py`: events, plans, and memory;
- `agent_platform/gateway/`: isolated execution providers.

Frontend branding, reverse proxy configuration, and registry automation are
important product/operations work, but they are not Agent intelligence.