Containerization & NGINX Edge

Relevant source files

The following files were used as context for generating this wiki page:

• docker-compose.yml
• infrastructure/nginx/nginx.conf
• README.md
• infrastructure/aws/cdk/lib/atlasclean-stack.ts
• infrastructure/terraform/main.tf

AtlasCleanAI Enterprise uses a containerized architecture to ensure consistent environments across local development and cloud production. The platform employs Docker for service isolation and NGINX as an edge reverse proxy to manage ingress traffic, TLS termination, and request rate limiting.

This system provides the operational foundation for the platform's API tier, persistence layers, and AI services. It supports immutable image deployments via Amazon ECR and repeatable infrastructure through AWS CDK or Terraform.

Sources: README.md:10-18, README.md:86-88

Container Architecture

The platform orchestrates multiple services using Docker. In local development, docker-compose.yml defines the interaction between the Node.js backend, PostgreSQL database, Redis cache, and the NGINX proxy.

Service Definitions

Service	Image/Source	Purpose	Port
nginx	nginx:alpine	Edge proxy and TLS termination	80, 443
backend	infrastructure/docker/Dockerfile.backend	Node.js API tier	3000
postgres	postgres:15-alpine	Relational data storage	5432
redis	redis:7-alpine	Caching and background workflows	6379

Sources: docker-compose.yml:9-52

Dependency Flow

The backend service depends on the availability of the data tier. NGINX subsequently depends on the backend to be operational before routing traffic.

The diagram illustrates the request path from the client through the edge proxy to the application and data layers.
Sources: docker-compose.yml:38-44, infrastructure/nginx/nginx.conf:45-48

NGINX Edge Configuration

NGINX acts as the entry point for all HTTP/HTTPS traffic. It handles load balancing, security headers, and request optimization.

Security and Optimization

The NGINX configuration enforces several production-grade security measures:

• Rate Limiting: Limits requests to 20 per second with a burst capacity of 40 to prevent DDoS attacks.
• TLS Management: Supports TLS v1.2 and v1.3 with high-security ciphers.
• Headers: Injects security headers including X-Frame-Options: DENY and Strict-Transport-Security.
• Gzip Compression: Compresses JSON, Javascript, CSS, and SVG types at level 5.

Sources: infrastructure/nginx/nginx.conf:29-37, infrastructure/nginx/nginx.conf:56-70, infrastructure/nginx/nginx.conf:75-84

Proxy Logic

NGINX defines an upstream block named atlas_backend that targets the backend container on port 3000. It supports WebSockets by mapping Upgrade headers.

upstream atlas_backend {
  server backend:3000;
  keepalive 64;
}

server {
  listen 80;
  location / {
    proxy_pass http://atlas_backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
  }
}

Sources: infrastructure/nginx/nginx.conf:40-44, infrastructure/nginx/nginx.conf:54-65

Cloud Infrastructure Integration

For production deployments, containerization is managed via Amazon ECS Fargate. The infrastructure is defined using either AWS CDK or Terraform to provide network isolation and automated scaling.

Network Isolation

Containers are deployed into specific VPC subnets to maintain security boundaries:

• Public Subnets: Host the Application Load Balancer (ALB) and NGINX (if applicable).
• Application Subnets: Host the containerized ECS services (Private with Egress).
• Data Subnets: Host RDS (PostgreSQL) and ElastiCache (Redis) instances (Isolated).

Sources: infrastructure/aws/cdk/lib/atlasclean-stack.ts:29-45, infrastructure/terraform/main.tf:46-77

Deployment Sequence

The CI/CD pipeline builds immutable images and pushes them to Amazon ECR before updating the ECS task definitions.

The sequence shows how images transition from build to active service behind a load balancer.
Sources: README.md:79-88, infrastructure/aws/cdk/lib/atlasclean-stack.ts:167-175

Scaling Configuration

Both CDK and Terraform implementations define auto-scaling policies based on CPU utilization.

• Target Utilization: 60%
• Minimum Capacity: 1 (Staging) / 2 (Production)
• Maximum Capacity: 3 (Staging) / 8 (Production)

Sources: infrastructure/aws/cdk/lib/atlasclean-stack.ts:219-228, infrastructure/terraform/main.tf:408-428

Health Monitoring

The system uses a standardized /health endpoint for container orchestration and load balancer health checks.

Component	Check Type	Endpoint
NGINX	Ingress Health	/healthz
Backend	App Status	/health
PostgreSQL	Database Connectivity	pg_isready

Sources: infrastructure/nginx/nginx.conf:50-54, docker-compose.yml:19-21, infrastructure/aws/cdk/lib/atlasclean-stack.ts:210-215

The containerized environment provides a predictable lifecycle for AtlasCleanAI Enterprise services, moving from local docker-compose development to highly available AWS ECS Fargate clusters. NGINX serves as the critical security boundary, managing traffic flow and protecting application resources.