C4 — Containers (niveau 2)
Décomposition de la plateforme Nex en containers exécutables : apps, dashboards, microservices, datastores.
Diagramme
Containers
Apps mobiles (3)
| App | Port dev | Bundle | Audience |
|---|---|---|---|
Nex (mobile-client) | Metro | com.noki.services.nokipay | Consumer |
Nex Pro (mobile-pro) | Metro | com.paywithnex.pro | Agent, master-agent |
Nex Business (mobile-business) | Metro | com.paywithnex.business | Merchant |
Toutes en Expo SDK 55 / React Native 0.83 / React 19.2 / Zustand, partagent les packages @nex/tokens, @nex/ui-mobile, @nex/mobile-auth.
Dashboards web (2)
| Dashboard | Stack | Audience |
|---|---|---|
| CMMS | Nuxt 4.2.2 / Nuxt UI 4.3 / Tailwind v4 | Ops, support, KAM, compliance |
| Backoffice | Nuxt 4.2.2 / Nuxt UI 4.3 / Tailwind v4 | Administration plateforme |
Microservices NestJS (11)
| Service | Port | Responsabilité | Fiche |
|---|---|---|---|
| Auth | 3001 | PIN, OTP, Firebase custom tokens, sessions, devices, QR | → |
| Ledger Wallets | 3002 | Soldes, écritures double-entrée, intents, cards | → |
| Customer Profiles & KYC | 3003 | People, contacts, KYC, KYB, merchants, merchant_members | → |
| Orchestrator | 3004 | Point d’entrée API publique, routage vers downstream | → |
| Notifications | 3005 | SMS, push, email | → |
| Configuration | 3006 | Flows config-driven, canaux, paramètres | → |
| File Service | 3007 | Upload, stockage, signed URLs | → |
| Providers Gateway | 3008 | Adaptateurs Mobile Money et providers tiers | → |
| Risk Engine | 3009 | Évaluation anti-fraude, preflight, scoring | → |
| Service Catalog | 3010 | Catalogue des services métier (~90 endpoints) | → |
| Logs & Reporting | 3011 | Audit trail cross-services | → |
Datastores
| Datastore | Usage | ADR |
|---|---|---|
| PostgreSQL RDS | Une instance par environnement, schéma logique par service | ADR-0014 |
| Redis | Cache, sessions auth, rate limiting, cache JWKS | — |
| Stockage objets (S3 ou équivalent) | Fichiers KYC, KYB, photos de profil | — |
Edge & infra
- Cloudflare : WAF, CDN, DNS — voir ADR-0010.
- AWS EKS : runtime K8s — voir ADR-0009.
- ingress-nginx + cert-manager : exposition publique + Let’s Encrypt.
- External Secrets Operator : synchronisation Doppler → K8s secrets.
Communication inter-services
- Externe (Internet → API publique) : HTTPS via Cloudflare → NLB AWS → Ingress NGINX → Orchestrator.
- Interne (Orchestrator → services back) : HTTP REST avec JWT inter-services (scope
internal-service-jwt). Réseau bridge K8s, namespace-isolé via NetworkPolicy. - Pas de communication directe app → services back : toujours via Orchestrator.
Liens
- Niveau plus haut : /architecture/c4-context
- Niveau plus détaillé : /architecture/c4-components/
- Catalogue services : /architecture/services-catalog
- Topologie réseau : /architecture/network-topology