{"slug":"operations/DEPLOYMENT_PROFILES","title":"IntegrateWise Deployment Profiles & Infrastructure","section":"operations","sectionLabel":"Operations","status":"unclassified","type":"document","path":"operations/DEPLOYMENT_PROFILES.mdx","bytes":13589,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n## Overview\n\nIntegrateWise runs 3 distinct deployment profiles, each with isolated resources and configurations.\n\n---\n\n## Deployment Profiles\n\n### 1. DEV Profile\n\n**Purpose**: Development & testing environment  \n**Audience**: Internal development team\n\n**Configuration**:\n\n```\nEnvironment: development\nDatabase: Neon (dev instance)\nWorkers: Cloudflare (dev workers)\nKV: Cloudflare KV (dev namespace)\nD1: Cloudflare D1 (dev binding)\nWorkers AI: Enabled (dev quota)\nMCP Pool: Shared with Customer Zero dev\nFeature Flags: All enabled\nRate Limits: Relaxed (1000 req/min per endpoint)\n```\n\n**Components**:\n\n- `apps/platform` (deployed to `dev.integratewise.internal`)\n- All 31 backend services (Workers)\n- Local Neon dev instance\n- Debug logging enabled\n\n**Connection Flow**:\n\n```\nDeveloper Machine\n    ↓\nPlatform UI (dev.integratewise.internal)\n    ↓\nGateway Worker (dev)\n    ↓\nService Workers (dev)\n    ↓\nNeon Tunnel (secure WebSocket)\n    ↓\nNeon PostgreSQL (dev instance)\n    ↓\nD1 (dev dataset)\n```\n\n---\n\n### 2. CUSTOMER ZERO Profile\n\n**Purpose**: First customer production environment  \n**Audience**: Customer Zero operations team\n\n**Configuration**:\n\n```\nEnvironment: production\nDatabase: Neon (customer-zero instance)\nWorkers: Cloudflare (customer-zero workers)\nKV: Cloudflare KV (customer-zero namespace)\nD1: Cloudflare D1 (customer-zero binding)\nWorkers AI: Enabled (customer-zero quota)\nMCP Pool: Dedicated to Customer Zero\nFeature Flags: Stable flags only\nRate Limits: Standard (100 req/sec per endpoint)\nRedundancy: 3-region deployment\n```\n\n**Components**:\n\n- `apps/platform` (deployed to `app.customer-zero.integratewise.com`)\n- All 31 backend services (Workers)\n- Dedicated Neon customer-zero instance\n- Dedicated D1 database\n- Dedicated KV namespace\n- MCP Pool instance (isolated)\n\n**Connection Flow**:\n\n```\nCustomer Zero Users\n    ↓\nPlatform UI (app.customer-zero.integratewise.com)\n    ↓\nGateway Worker (customer-zero)\n    ↓\nService Workers (customer-zero) ← MCP Pool\n    ↓\nNeon Tunnel (TLS 1.3 secure tunnel)\n    ↓\nNeon PostgreSQL (customer-zero instance)\n    ↓\nD1 (customer-zero dataset)\n```\n\n**Neon Tunnel Configuration**:\n\n```yaml\nprofile: customer-zero\ntunnel:\n  endpoint: neon.customer-zero.integratewise.internal\n  auth: JWT (signed by Cloudflare service account)\n  encryption: TLS 1.3\n  pooling:\n    min_connections: 10\n    max_connections: 100\n    idle_timeout: 60s\n  retry:\n    max_attempts: 3\n    backoff: exponential\n```\n\n---\n\n### 3. EXTERNAL USERS Profile\n\n**Purpose**: Multi-tenant production for external end users  \n**Audience**: Public users, SaaS customers\n\n**Configuration**:\n\n```\nEnvironment: production\nDatabase: Neon (multi-tenant instance)\nWorkers: Cloudflare (multi-tenant workers)\nKV: Cloudflare KV (multi-tenant namespace)\nD1: Cloudflare D1 (multi-tenant binding)\nWorkers AI: Enabled (shared quota pool)\nMCP Pool: Shared/load-balanced\nFeature Flags: Stable flags only\nRate Limits: Strict (50 req/sec per tenant)\nRedundancy: 5-region deployment\nDDoS Protection: Enabled\nWAF Rules: Full ruleset\n```\n\n**Components**:\n\n- `apps/platform` (deployed to `app.integratewise.com`)\n- All 31 backend services (Workers, load-balanced)\n- Shared Neon multi-tenant instance (RLS enforced)\n- Shared D1 database (tenant isolation via views)\n- Shared KV namespace (tenant-prefixed keys)\n- MCP Pool (load-balanced, shared)\n\n**Connection Flow**:\n\n```\nExternal Users\n    ↓\nCDN Cache (Cloudflare Edge)\n    ↓\nPlatform UI (app.integratewise.com)\n    ↓\nGateway Worker (multi-tenant, rate-limited)\n    ↓\nService Workers (multi-tenant, RLS-enforced)\n    ↓\nNeon Tunnel (connection pooling, per-region)\n    ↓\nNeon PostgreSQL (multi-tenant, RLS policies)\n    ↓\nD1 (multi-tenant, query-time filtering)\n```\n\n**Neon Tunnel Configuration**:\n\n```yaml\nprofile: external-users\ntunnel:\n  endpoints:\n    - us-east.neon.integratewise.io\n    - eu-west.neon.integratewise.io\n    - ap-south.neon.integratewise.io\n  auth: mTLS (certificate rotation every 90 days)\n  encryption: TLS 1.3 + TLS 1.2 fallback\n  pooling:\n    min_connections: 50\n    max_connections: 500\n    idle_timeout: 30s\n    statement_cache_size: 50\n  retry:\n    max_attempts: 5\n    backoff: exponential with jitter\n  circuit_breaker:\n    failure_threshold: 50%\n    timeout: 60s\n    half_open_requests: 3\n```\n\n---\n\n## Neon ↔ Cloudflare Tunnel Architecture\n\n### Tunnel Components\n\n```\nCloudflare Workers\n    ↓ (TLS Handshake)\nCloudflare Tunnel Proxy\n    ↓ (Encrypted channel)\nNeon Connection Pool\n    ↓ (Query routing)\nPostgreSQL (Neon Serverless)\n```\n\n### Connection Flow\n\n**Initiation**:\n\n1. Worker makes outbound connection to Neon tunnel endpoint\n2. mTLS handshake with certificate verification\n3. JWT token exchange (OAuth2 Bearer token in HTTP upgrade)\n4. Connection pool assigned to Worker instance\n\n**Query Execution**:\n\n```\nWorker ─┐\n        ├─→ Query Tunnel ─→ Connection Pool ─→ PostgreSQL\nWorker ─┘                   (per-instance, 10-100 conns)\nWorker ─┐\n        └─→ Failover Pool ─→ Replica (read-only)\n```\n\n**Monitoring & Failover**:\n\n- Health check every 5 seconds\n- Automatic retry on connection failure\n- Circuit breaker (50% failure threshold)\n- Failover to replica on primary failure\n- Exponential backoff (1s, 2s, 4s, 8s, 16s)\n\n---\n\n## MCP Pool Configuration\n\n### Architecture\n\n```\nMCP Pool\n├── Dev Instance (development)\n│   ├── 2 replicas\n│   ├── 100 concurrent connections\n│   ├── Auto-scaling: 1-5 pods\n│   └── TTL: 24 hours\n│\n└── Customer Zero Instance (production)\n    ├── 4 replicas\n    ├── 500 concurrent connections\n    ├── Auto-scaling: 5-20 pods\n    └── TTL: 7 days\n```\n\n### Resource Allocation\n\n**Dev MCP Pool**:\n\n- CPU: 0.5 cores (shared)\n- Memory: 1 GB (shared)\n- Network: 100 Mbps (shared)\n- Cost: Shared infrastructure\n\n**Customer Zero MCP Pool**:\n\n- CPU: 2 cores (dedicated)\n- Memory: 4 GB (dedicated)\n- Network: 1 Gbps (dedicated)\n- Cost: $500/month\n\n### Endpoint Routing\n\n**Dev**:\n\n```\nGET  /mcp/v1/registry      → Dev MCP Pool\nGET  /mcp/v1/tools/:id     → Dev MCP Pool\nPOST /mcp/v1/invoke        → Dev MCP Pool\n```\n\n**Customer Zero**:\n\n```\nGET  /mcp/v1/registry      → Customer Zero MCP Pool\nGET  /mcp/v1/tools/:id     → Customer Zero MCP Pool\nPOST /mcp/v1/invoke        → Customer Zero MCP Pool\n```\n\n**External Users**:\n\n```\nGET  /mcp/v1/registry      → Load-balanced MCP Pool\nGET  /mcp/v1/tools/:id     → Load-balanced MCP Pool\nPOST /mcp/v1/invoke        → Load-balanced MCP Pool (rate-limited)\n```\n\n---\n\n## Environment Variables by Profile\n\n### Dev Profile\n\n```env\n# General\nDEPLOYMENT_PROFILE=dev\nENVIRONMENT=development\nLOG_LEVEL=debug\n\n# Neon\nNEON_DATABASE_URL=postgresql://user:pass@neon.dev.integratewise.internal/dev_db\nNEON_TUNNEL_ENDPOINT=neon.dev.integratewise.internal\nNEON_TUNNEL_AUTH_TOKEN=jwt_dev_token\n\n# Cloudflare\nCLOUDFLARE_ACCOUNT_ID=dev_account_id\nCLOUDFLARE_API_TOKEN=dev_api_token\nCLOUDFLARE_ZONE_ID=dev_zone_id\n\n# D1\nD1_DATABASE_ID=dev_d1_db_id\nD1_DATABASE_BINDING=dev_d1\n\n# KV\nKV_NAMESPACE_ID=dev_kv_namespace_id\n\n# MCP Pool\nMCP_POOL_ENDPOINT=mcp-dev.integratewise.internal\nMCP_POOL_AUTH_TOKEN=jwt_dev_mcp_token\n\n# Feature Flags\nFF_EXPERIMENTAL_FEATURES=true\nFF_DEBUG_MODE=true\n```\n\n### Customer Zero Profile\n\n```env\n# General\nDEPLOYMENT_PROFILE=customer-zero\nENVIRONMENT=production\nLOG_LEVEL=info\n\n# Neon\nNEON_DATABASE_URL=postgresql://user:pass@neon.customer-zero.integratewise.internal/customer_zero_db\nNEON_TUNNEL_ENDPOINT=neon.customer-zero.integratewise.internal\nNEON_TUNNEL_AUTH_TOKEN=jwt_customer_zero_token\nNEON_TUNNEL_CERT=/secure/customer-zero.crt\nNEON_TUNNEL_KEY=/secure/customer-zero.key\n\n# Cloudflare\nCLOUDFLARE_ACCOUNT_ID=customer_zero_account_id\nCLOUDFLARE_API_TOKEN=customer_zero_api_token\nCLOUDFLARE_ZONE_ID=customer_zero_zone_id\n\n# D1\nD1_DATABASE_ID=customer_zero_d1_db_id\nD1_DATABASE_BINDING=customer_zero_d1\n\n# KV\nKV_NAMESPACE_ID=customer_zero_kv_namespace_id\n\n# MCP Pool\nMCP_POOL_ENDPOINT=mcp-customer-zero.integratewise.com\nMCP_POOL_AUTH_TOKEN=jwt_customer_zero_mcp_token\nMCP_POOL_REPLICAS=4\n\n# Feature Flags\nFF_EXPERIMENTAL_FEATURES=false\nFF_DEBUG_MODE=false\n```\n\n### External Users Profile\n\n```env\n# General\nDEPLOYMENT_PROFILE=external-users\nENVIRONMENT=production\nLOG_LEVEL=warn\n\n# Neon\nNEON_DATABASE_URL=postgresql://user:pass@neon.integratewise.io/multi_tenant_db\nNEON_TUNNEL_ENDPOINT=neon.integratewise.io\nNEON_TUNNEL_AUTH_TOKEN=jwt_external_users_token\nNEON_TUNNEL_CERT=/secure/external-users.crt\nNEON_TUNNEL_KEY=/secure/external-users.key\nNEON_TUNNEL_REGIONS=us-east,eu-west,ap-south\n\n# Cloudflare\nCLOUDFLARE_ACCOUNT_ID=external_users_account_id\nCLOUDFLARE_API_TOKEN=external_users_api_token\nCLOUDFLARE_ZONE_ID=external_users_zone_id\n\n# D1\nD1_DATABASE_ID=external_users_d1_db_id\nD1_DATABASE_BINDING=external_users_d1\n\n# KV\nKV_NAMESPACE_ID=external_users_kv_namespace_id\n\n# MCP Pool\nMCP_POOL_ENDPOINT=mcp.integratewise.com\nMCP_POOL_AUTH_TOKEN=jwt_external_users_mcp_token\nMCP_POOL_REPLICAS=auto\nMCP_POOL_MAX_REPLICAS=50\n\n# Feature Flags\nFF_EXPERIMENTAL_FEATURES=false\nFF_DEBUG_MODE=false\n\n# Rate Limiting\nRATE_LIMIT_REQUESTS_PER_SEC=50\nRATE_LIMIT_BURST=100\n```\n\n---\n\n## Deployment Pipeline\n\n### Dev Profile Deployment\n\n```bash\n# On commit to main (dev branch)\n1. Run tests\n2. Build apps/platform\n3. Deploy to Vercel (dev subdomain)\n4. Deploy Workers to Cloudflare (dev account)\n5. Update dev Neon tunnel credentials\n6. Run smoke tests\n7. Notify dev team\n```\n\n### Customer Zero Profile Deployment\n\n```bash\n# On tag: customer-zero-v*\n1. Run full test suite\n2. Build apps/platform (production)\n3. Deploy to Vercel (customer-zero subdomain)\n4. Deploy Workers to Cloudflare (customer-zero account)\n5. Update customer-zero Neon tunnel credentials\n6. Run integration tests\n7. Health check all endpoints\n8. Notify ops team\n```\n\n### External Users Profile Deployment\n\n```bash\n# On tag: release-v*\n1. Run full test suite + performance tests\n2. Build apps/platform (production, optimized)\n3. Deploy to Vercel (production domain)\n4. Deploy Workers to Cloudflare (production account, multi-region)\n5. Update external-users Neon tunnel credentials\n6. Run canary deployment (10% traffic)\n7. Run load tests\n8. Full rollout (100% traffic)\n9. Notify customers via status page\n```\n\n---\n\n## Security & Isolation\n\n### Profile Isolation\n\n| Aspect                 | Dev                 | Customer Zero      | External Users       |\n| ---------------------- | ------------------- | ------------------ | -------------------- |\n| **Database Access**    | Shared dev instance | Dedicated instance | Shared multi-tenant  |\n| **Row-Level Security** | Disabled            | Enabled (1 org)    | Enabled (per tenant) |\n| **Encryption**         | TLS 1.2             | TLS 1.3            | TLS 1.3 + mTLS       |\n| **Network**            | Shared VPC          | Dedicated VPC      | Public with WAF      |\n| **Backup**             | Hourly              | Continuous + daily | Continuous + daily   |\n| **Compliance**         | None                | SOC 2 ready        | SOC 2 + GDPR         |\n\n### Tunnel Security\n\n**Dev Tunnel**:\n\n- JWT token authentication\n- TLS 1.2\n- Certificate: self-signed\n- Rotation: manual\n\n**Customer Zero Tunnel**:\n\n- mTLS with certificate pinning\n- TLS 1.3\n- Certificate: Let's Encrypt (90-day)\n- Rotation: automatic every 60 days\n\n**External Users Tunnel**:\n\n- mTLS with certificate pinning\n- TLS 1.3 with fallback\n- Certificate: DigiCert EV (1-year)\n- Rotation: automatic every 330 days\n- Cert pinning: 3 backup certs\n\n---\n\n## Monitoring & Alerting\n\n### Metrics by Profile\n\n```\nDev Profile:\n  - Platform uptime: 95% SLA\n  - Worker errors: alert if > 5% error rate\n  - Neon tunnel latency: alert if > 500ms\n  - MCP pool usage: alert if > 80% capacity\n\nCustomer Zero Profile:\n  - Platform uptime: 99.5% SLA\n  - Worker errors: alert if > 1% error rate\n  - Neon tunnel latency: alert if > 100ms\n  - MCP pool usage: alert if > 70% capacity\n  - Database backup: verify every 6 hours\n\nExternal Users Profile:\n  - Platform uptime: 99.9% SLA\n  - Worker errors: alert if > 0.1% error rate\n  - Neon tunnel latency: alert if > 50ms\n  - MCP pool usage: alert if > 60% capacity\n  - Database backup: verify every hour\n```\n\n### Health Checks\n\n```\nEvery 30 seconds:\n  - Platform UI reachability\n  - Gateway worker health\n  - Neon tunnel connectivity\n  - MCP pool availability\n  - D1 database connectivity\n\nEvery 5 minutes:\n  - Query performance (p95 latency)\n  - Error rate by service\n  - Rate limiter effectiveness\n\nEvery hour:\n  - Database backup integrity\n  - Certificate expiration\n  - Cache hit ratio\n  - Worker cold start time\n```\n\n---\n\n## Cost Estimation\n\n### Monthly Infrastructure Cost\n\n**Dev Profile**:\n\n- Vercel: $50 (dev tier)\n- Cloudflare Workers: $5 (included in free tier)\n- Neon: $50 (dev instance)\n- **Total: ~$105/month**\n\n**Customer Zero Profile**:\n\n- Vercel: $300 (production tier)\n- Cloudflare Workers: $50/month (3 regions)\n- Neon: $500/month (prod instance, dedicated)\n- **Total: ~$850/month**\n\n**External Users Profile**:\n\n- Vercel: $500 (production tier, autoscaling)\n- Cloudflare Workers: $200/month (5 regions, 1M+ requests)\n- Neon: $1,500/month (multi-tenant instance, high compute)\n- **Total: ~$2,200/month**\n\n---\n\n## Next Steps\n\n1. Create profile-specific `wrangler.toml` configs\n2. Set up Neon tunnel endpoints per profile\n3. Configure MCP pool auto-scaling per profile\n4. Create profile selector in apps/platform\n5. Add profile-aware logging and telemetry\n6. Document profile-switching procedures\n"}