Unclassified

IntegrateWise Deployment Profiles & Infrastructure

Overview

IntegrateWise runs 3 distinct deployment profiles, each with isolated resources and configurations.

Deployment Profiles

1. DEV Profile

Purpose: Development & testing environment
Audience: Internal development team

Configuration:

Environment: development
Database: Neon (dev instance)
Workers: Cloudflare (dev workers)
KV: Cloudflare KV (dev namespace)
D1: Cloudflare D1 (dev binding)
Workers AI: Enabled (dev quota)
MCP Pool: Shared with Customer Zero dev
Feature Flags: All enabled
Rate Limits: Relaxed (1000 req/min per endpoint)

Components:

apps/platform (deployed to dev.integratewise.internal)
All 31 backend services (Workers)
Local Neon dev instance
Debug logging enabled

Connection Flow:

Developer Machine
    ↓
Platform UI (dev.integratewise.internal)
    ↓
Gateway Worker (dev)
    ↓
Service Workers (dev)
    ↓
Neon Tunnel (secure WebSocket)
    ↓
Neon PostgreSQL (dev instance)
    ↓
D1 (dev dataset)

2. CUSTOMER ZERO Profile

Purpose: First customer production environment
Audience: Customer Zero operations team

Configuration:

Environment: production
Database: Neon (customer-zero instance)
Workers: Cloudflare (customer-zero workers)
KV: Cloudflare KV (customer-zero namespace)
D1: Cloudflare D1 (customer-zero binding)
Workers AI: Enabled (customer-zero quota)
MCP Pool: Dedicated to Customer Zero
Feature Flags: Stable flags only
Rate Limits: Standard (100 req/sec per endpoint)
Redundancy: 3-region deployment

Components:

apps/platform (deployed to app.customer-zero.integratewise.com)
All 31 backend services (Workers)
Dedicated Neon customer-zero instance
Dedicated D1 database
Dedicated KV namespace
MCP Pool instance (isolated)

Connection Flow:

Customer Zero Users
    ↓
Platform UI (app.customer-zero.integratewise.com)
    ↓
Gateway Worker (customer-zero)
    ↓
Service Workers (customer-zero) ← MCP Pool
    ↓
Neon Tunnel (TLS 1.3 secure tunnel)
    ↓
Neon PostgreSQL (customer-zero instance)
    ↓
D1 (customer-zero dataset)

Neon Tunnel Configuration:

profile: customer-zero
tunnel:
  endpoint: neon.customer-zero.integratewise.internal
  auth: JWT (signed by Cloudflare service account)
  encryption: TLS 1.3
  pooling:
    min_connections: 10
    max_connections: 100
    idle_timeout: 60s
  retry:
    max_attempts: 3
    backoff: exponential

3. EXTERNAL USERS Profile

Purpose: Multi-tenant production for external end users
Audience: Public users, SaaS customers

Configuration:

Environment: production
Database: Neon (multi-tenant instance)
Workers: Cloudflare (multi-tenant workers)
KV: Cloudflare KV (multi-tenant namespace)
D1: Cloudflare D1 (multi-tenant binding)
Workers AI: Enabled (shared quota pool)
MCP Pool: Shared/load-balanced
Feature Flags: Stable flags only
Rate Limits: Strict (50 req/sec per tenant)
Redundancy: 5-region deployment
DDoS Protection: Enabled
WAF Rules: Full ruleset

Components:

apps/platform (deployed to app.integratewise.com)
All 31 backend services (Workers, load-balanced)
Shared Neon multi-tenant instance (RLS enforced)
Shared D1 database (tenant isolation via views)
Shared KV namespace (tenant-prefixed keys)
MCP Pool (load-balanced, shared)

Connection Flow:

External Users
    ↓
CDN Cache (Cloudflare Edge)
    ↓
Platform UI (app.integratewise.com)
    ↓
Gateway Worker (multi-tenant, rate-limited)
    ↓
Service Workers (multi-tenant, RLS-enforced)
    ↓
Neon Tunnel (connection pooling, per-region)
    ↓
Neon PostgreSQL (multi-tenant, RLS policies)
    ↓
D1 (multi-tenant, query-time filtering)

Neon Tunnel Configuration:

profile: external-users
tunnel:
  endpoints:
    - us-east.neon.integratewise.io
    - eu-west.neon.integratewise.io
    - ap-south.neon.integratewise.io
  auth: mTLS (certificate rotation every 90 days)
  encryption: TLS 1.3 + TLS 1.2 fallback
  pooling:
    min_connections: 50
    max_connections: 500
    idle_timeout: 30s
    statement_cache_size: 50
  retry:
    max_attempts: 5
    backoff: exponential with jitter
  circuit_breaker:
    failure_threshold: 50%
    timeout: 60s
    half_open_requests: 3

Neon ↔ Cloudflare Tunnel Architecture

Tunnel Components

Cloudflare Workers
    ↓ (TLS Handshake)
Cloudflare Tunnel Proxy
    ↓ (Encrypted channel)
Neon Connection Pool
    ↓ (Query routing)
PostgreSQL (Neon Serverless)

Connection Flow

Initiation:

Worker makes outbound connection to Neon tunnel endpoint
mTLS handshake with certificate verification
JWT token exchange (OAuth2 Bearer token in HTTP upgrade)
Connection pool assigned to Worker instance

Query Execution:

Worker ─┐
        ├─→ Query Tunnel ─→ Connection Pool ─→ PostgreSQL
Worker ─┘                   (per-instance, 10-100 conns)
Worker ─┐
        └─→ Failover Pool ─→ Replica (read-only)

Monitoring & Failover:

Health check every 5 seconds
Automatic retry on connection failure
Circuit breaker (50% failure threshold)
Failover to replica on primary failure
Exponential backoff (1s, 2s, 4s, 8s, 16s)

MCP Pool Configuration

Architecture

MCP Pool
├── Dev Instance (development)
│   ├── 2 replicas
│   ├── 100 concurrent connections
│   ├── Auto-scaling: 1-5 pods
│   └── TTL: 24 hours
│
└── Customer Zero Instance (production)
    ├── 4 replicas
    ├── 500 concurrent connections
    ├── Auto-scaling: 5-20 pods
    └── TTL: 7 days

Resource Allocation

Dev MCP Pool:

CPU: 0.5 cores (shared)
Memory: 1 GB (shared)
Network: 100 Mbps (shared)
Cost: Shared infrastructure

Customer Zero MCP Pool:

CPU: 2 cores (dedicated)
Memory: 4 GB (dedicated)
Network: 1 Gbps (dedicated)
Cost: $500/month

Endpoint Routing

Dev:

GET  /mcp/v1/registry      → Dev MCP Pool
GET  /mcp/v1/tools/:id     → Dev MCP Pool
POST /mcp/v1/invoke        → Dev MCP Pool

Customer Zero:

GET  /mcp/v1/registry      → Customer Zero MCP Pool
GET  /mcp/v1/tools/:id     → Customer Zero MCP Pool
POST /mcp/v1/invoke        → Customer Zero MCP Pool

External Users:

GET  /mcp/v1/registry      → Load-balanced MCP Pool
GET  /mcp/v1/tools/:id     → Load-balanced MCP Pool
POST /mcp/v1/invoke        → Load-balanced MCP Pool (rate-limited)

Environment Variables by Profile

Dev Profile

# General
DEPLOYMENT_PROFILE=dev
ENVIRONMENT=development
LOG_LEVEL=debug

# Neon
NEON_DATABASE_URL=postgresql://user:pass@neon.dev.integratewise.internal/dev_db
NEON_TUNNEL_ENDPOINT=neon.dev.integratewise.internal
NEON_TUNNEL_AUTH_TOKEN=jwt_dev_token

# Cloudflare
CLOUDFLARE_ACCOUNT_ID=dev_account_id
CLOUDFLARE_API_TOKEN=dev_api_token
CLOUDFLARE_ZONE_ID=dev_zone_id

# D1
D1_DATABASE_ID=dev_d1_db_id
D1_DATABASE_BINDING=dev_d1

# KV
KV_NAMESPACE_ID=dev_kv_namespace_id

# MCP Pool
MCP_POOL_ENDPOINT=mcp-dev.integratewise.internal
MCP_POOL_AUTH_TOKEN=jwt_dev_mcp_token

# Feature Flags
FF_EXPERIMENTAL_FEATURES=true
FF_DEBUG_MODE=true

Customer Zero Profile

# General
DEPLOYMENT_PROFILE=customer-zero
ENVIRONMENT=production
LOG_LEVEL=info

# Neon
NEON_DATABASE_URL=postgresql://user:pass@neon.customer-zero.integratewise.internal/customer_zero_db
NEON_TUNNEL_ENDPOINT=neon.customer-zero.integratewise.internal
NEON_TUNNEL_AUTH_TOKEN=jwt_customer_zero_token
NEON_TUNNEL_CERT=/secure/customer-zero.crt
NEON_TUNNEL_KEY=/secure/customer-zero.key

# Cloudflare
CLOUDFLARE_ACCOUNT_ID=customer_zero_account_id
CLOUDFLARE_API_TOKEN=customer_zero_api_token
CLOUDFLARE_ZONE_ID=customer_zero_zone_id

# D1
D1_DATABASE_ID=customer_zero_d1_db_id
D1_DATABASE_BINDING=customer_zero_d1

# KV
KV_NAMESPACE_ID=customer_zero_kv_namespace_id

# MCP Pool
MCP_POOL_ENDPOINT=mcp-customer-zero.integratewise.com
MCP_POOL_AUTH_TOKEN=jwt_customer_zero_mcp_token
MCP_POOL_REPLICAS=4

# Feature Flags
FF_EXPERIMENTAL_FEATURES=false
FF_DEBUG_MODE=false

External Users Profile

# General
DEPLOYMENT_PROFILE=external-users
ENVIRONMENT=production
LOG_LEVEL=warn

# Neon
NEON_DATABASE_URL=postgresql://user:pass@neon.integratewise.io/multi_tenant_db
NEON_TUNNEL_ENDPOINT=neon.integratewise.io
NEON_TUNNEL_AUTH_TOKEN=jwt_external_users_token
NEON_TUNNEL_CERT=/secure/external-users.crt
NEON_TUNNEL_KEY=/secure/external-users.key
NEON_TUNNEL_REGIONS=us-east,eu-west,ap-south

# Cloudflare
CLOUDFLARE_ACCOUNT_ID=external_users_account_id
CLOUDFLARE_API_TOKEN=external_users_api_token
CLOUDFLARE_ZONE_ID=external_users_zone_id

# D1
D1_DATABASE_ID=external_users_d1_db_id
D1_DATABASE_BINDING=external_users_d1

# KV
KV_NAMESPACE_ID=external_users_kv_namespace_id

# MCP Pool
MCP_POOL_ENDPOINT=mcp.integratewise.com
MCP_POOL_AUTH_TOKEN=jwt_external_users_mcp_token
MCP_POOL_REPLICAS=auto
MCP_POOL_MAX_REPLICAS=50

# Feature Flags
FF_EXPERIMENTAL_FEATURES=false
FF_DEBUG_MODE=false

# Rate Limiting
RATE_LIMIT_REQUESTS_PER_SEC=50
RATE_LIMIT_BURST=100

Deployment Pipeline

Dev Profile Deployment

# On commit to main (dev branch)
1. Run tests
2. Build apps/platform
3. Deploy to Vercel (dev subdomain)
4. Deploy Workers to Cloudflare (dev account)
5. Update dev Neon tunnel credentials
6. Run smoke tests
7. Notify dev team

Customer Zero Profile Deployment

# On tag: customer-zero-v*
1. Run full test suite
2. Build apps/platform (production)
3. Deploy to Vercel (customer-zero subdomain)
4. Deploy Workers to Cloudflare (customer-zero account)
5. Update customer-zero Neon tunnel credentials
6. Run integration tests
7. Health check all endpoints
8. Notify ops team

External Users Profile Deployment

# On tag: release-v*
1. Run full test suite + performance tests
2. Build apps/platform (production, optimized)
3. Deploy to Vercel (production domain)
4. Deploy Workers to Cloudflare (production account, multi-region)
5. Update external-users Neon tunnel credentials
6. Run canary deployment (10% traffic)
7. Run load tests
8. Full rollout (100% traffic)
9. Notify customers via status page

Security & Isolation

Profile Isolation

Aspect	Dev	Customer Zero	External Users
Database Access	Shared dev instance	Dedicated instance	Shared multi-tenant
Row-Level Security	Disabled	Enabled (1 org)	Enabled (per tenant)
Encryption	TLS 1.2	TLS 1.3	TLS 1.3 + mTLS
Network	Shared VPC	Dedicated VPC	Public with WAF
Backup	Hourly	Continuous + daily	Continuous + daily
Compliance	None	SOC 2 ready	SOC 2 + GDPR

Tunnel Security

Dev Tunnel:

JWT token authentication
TLS 1.2
Certificate: self-signed
Rotation: manual

Customer Zero Tunnel:

mTLS with certificate pinning
TLS 1.3
Certificate: Let's Encrypt (90-day)
Rotation: automatic every 60 days

External Users Tunnel:

mTLS with certificate pinning
TLS 1.3 with fallback
Certificate: DigiCert EV (1-year)
Rotation: automatic every 330 days
Cert pinning: 3 backup certs

Monitoring & Alerting

Metrics by Profile

Dev Profile:
  - Platform uptime: 95% SLA
  - Worker errors: alert if > 5% error rate
  - Neon tunnel latency: alert if > 500ms
  - MCP pool usage: alert if > 80% capacity

Customer Zero Profile:
  - Platform uptime: 99.5% SLA
  - Worker errors: alert if > 1% error rate
  - Neon tunnel latency: alert if > 100ms
  - MCP pool usage: alert if > 70% capacity
  - Database backup: verify every 6 hours

External Users Profile:
  - Platform uptime: 99.9% SLA
  - Worker errors: alert if > 0.1% error rate
  - Neon tunnel latency: alert if > 50ms
  - MCP pool usage: alert if > 60% capacity
  - Database backup: verify every hour

Health Checks

Every 30 seconds:
  - Platform UI reachability
  - Gateway worker health
  - Neon tunnel connectivity
  - MCP pool availability
  - D1 database connectivity

Every 5 minutes:
  - Query performance (p95 latency)
  - Error rate by service
  - Rate limiter effectiveness

Every hour:
  - Database backup integrity
  - Certificate expiration
  - Cache hit ratio
  - Worker cold start time

Cost Estimation

Monthly Infrastructure Cost

Dev Profile:

Vercel: $50 (dev tier)
Cloudflare Workers: $5 (included in free tier)
Neon: $50 (dev instance)
Total: ~$105/month

Customer Zero Profile:

Vercel: $300 (production tier)
Cloudflare Workers: $50/month (3 regions)
Neon: $500/month (prod instance, dedicated)
Total: ~$850/month

External Users Profile:

Vercel: $500 (production tier, autoscaling)
Cloudflare Workers: $200/month (5 regions, 1M+ requests)
Neon: $1,500/month (multi-tenant instance, high compute)
Total: ~$2,200/month

Next Steps

Create profile-specific wrangler.toml configs
Set up Neon tunnel endpoints per profile
Configure MCP pool auto-scaling per profile
Create profile selector in apps/platform
Add profile-aware logging and telemetry
Document profile-switching procedures