Popcorn Societywatch together, after dark

Inside the system / Architecture

The big picture.
The important connections.

Two focused maps of a single-node k3s deployment. Open a diagram to explore the components, follow relationships and inspect the source behind each part.

01 / Application architecture

A request, end to end.

React provides the experience. Java owns the application domain. Python connects voice and model calls to the same protected domain capabilities.

Browser requests enter Traefik and reach the static frontend, Java backend or Python agent. Java owns PostgreSQL, OpenSearch, embeddings and media access.

Follow the main paths

  1. Browser → Traefik → Java → PostgreSQL
  2. Voice → Python → protected Java MCP tools
  3. Java → search index, embeddings and media
Open interactive map in a new tab

The interactive map opens in a new tab. Pan, zoom, switch themes or export a static image.

One owner for domain behaviour

The Spring Boot backend owns movies, accounts, ratings, watchlists and recommendations. The agent calls protected MCP tools; it does not query PostgreSQL or OpenSearch directly.

A deliberate overview

PostgreSQL is the source of truth; Java builds the derived search index. Public media delivery, OAuth providers, TMDB enrichment and certificate issuance are omitted to keep the main paths readable.

02 / Observability & operations

Four signals.
One investigation.

Metrics reveal a change. Logs and traces help locate it. Continuous profiles show where execution time and allocations are spent.

Java and Python supply metrics to Prometheus, traces through Alloy to Tempo and profiles directly to Pyroscope. Alloy sends Kubernetes logs and events to Loki. Grafana queries all four stores.

Follow each signal

  1. Metrics: application endpoints → Prometheus
  2. Logs and traces: Alloy → Loki and Tempo
  3. Profiles: Java / Python → Pyroscope
Open interactive map in a new tab

Arrows show the flow of telemetry and query results. Prometheus initiates metric scrapes; Grafana initiates queries.

Browser and infrastructure signals

The browser sends bounded timing and outcome batches to Java, which exposes the resulting metrics. Prometheus also scrapes cluster exporters, PostgreSQL and llama.cpp. Workload logs include the application containers and Traefik.

What this map does not claim

This is a view of the checked-in configuration, not a live health report. OpenSearch and RustFS currently have workload-readiness visibility, not native service metrics. Public dashboards are a future addition.

Reviewed September 17, 2026 · Repository baseline 8fbf5e17 · Diagrams generated with Archify. Each component links to its source evidence.