DO Infrastructure Architecture

Hosts

#	Host	env	type	app	fw
1	~~prod-www-ghost-0~~ (DECOMMISSIONED, SAG-2385)	prod	www	ghost	fw:www
2	prod-tools-n8n-0	prod	tools	n8n (+ Portainer server)	fw:www
3	prod-storage-nfs-0	prod	storage	nfs	fw:internal-only
4	prod-api-platform-0	prod	api	api-platform	fw:www
5	prod-www-platform-0	prod	www	www-platform	fw:www
6	prod-www-io-0	prod	www	io, ghost	fw:www
7	prod-www-stack-0	prod	www	www-stack (parallel; not cut over, SAG-2587)	fw:www
8	nonprod-stack-dev-0	nonprod	stack	dev (app+io WordPress, full Platform surface)	fw:internal-only

prod-tools-portainer-0 and prod-tools-tools-0 (previously listed here) were deleted in SAG-2581 — Portainer’s server now runs as a compose service on prod-tools-n8n-0.

Firewalls

Name	Purpose
fw.www	Public web traffic (80/443)
fw.www-only-ssl	SSL only (443)
fw.www-with-mysql	Public web + MySQL client
fw.portainer	Portainer control plane
fw.internal-only	No public internet access

Tag Schema

Five keys applied to all Terraform-managed resources. Droplet naming convention: ENV-TYPE-APP-# (e.g. prod-tools-portainer-0)

Key	Values	Purpose
env	prod, nonprod, dev, stage	Environment
type	www, tools, storage, api, ai, app, stack	Box category
app	portainer, nfs, n8n, ghost, io, etc.	Specific workload
fw	fw:www, fw:internal-only, fw:portainer, etc.	Firewall membership
managed-by	terraform	Provenance

NFS Shares

Mounted on prod-storage-nfs-0, exported to VPC CIDR 10.108.0.0/20.

Volume	Mount	Size
nfs-n8n	/mnt/n8n	10GB
nfs-io	/mnt/io	25GB
nfs-app	/mnt/app	25GB
nfs-ghost	/mnt/ghost	10GB
nfs-unleash	/mnt/unleash	10GB
nfs-portainer	/mnt/portainer	5GB