Car Dealer — Runtime Architecture

Laravel 5.7 monolith with queued integrations and CDN-fronted assets

Car Dealer — Runtime Architecture Laravel 5.7 monolith with queued integrations and CDN-fronted assets Dealer Browser · Vue 2 SPA · Public trust zone — edge and clients · Untrusted Dealer Browser Vue 2 SPA Untrusted CDN · static + images · Public trust zone — edge and clients · Edge cache CDN static + images Edge cache Nginx + PHP-FPM · TLS :443 · Application trust zone — Laravel app · Reverse proxy Nginx + PHP-FPM TLS :443 Reverse proxy Identity & Bot · OAuth + reCAPTCHA · External services — third-party trust zones Identity & Bot OAuth + reCAPTCHA Laravel 5.7 · Web + REST · Application trust zone — Laravel app · App / API Laravel 5.7 Web + REST App / API Inventory Feeds · FTP / HTTP scrapers · External services — third-party trust zones Inventory Feeds FTP / HTTP scrapers MySQL · primary + chat DBs · Application trust zone — Laravel app · Durable MySQL primary + chat DBs Durable AWS · S3 + SES · AWS trust zone · AWS AWS S3 + SES AWS Facebook Graph · Leads + Marketplace · External services — third-party trust zones · External Facebook Graph Leads + Marketplace External Pusher · realtime · External services — third-party trust zones Pusher realtime Twilio · SMS + WhatsApp · External services — third-party trust zones Twilio SMS + WhatsApp DB Queue · jobs + failed_jobs · Application trust zone — Laravel app DB Queue jobs + failed_jobs Queue Worker · artisan queue:work · Application trust zone — Laravel app · Async Queue Worker artisan queue:work Async Downstream · WP + Shopify + Amazon · External services — third-party trust zones · Sync targets Downstream WP + Shopify + Amazon Sync targets HTTPS static origin pull PHP-FPM SQL dispatch pop upload + mail broadcast SMS Graph OAuth + captcha scrape sync Public trust zone — edge and clients Application trust zone — Laravel app AWS trust zone External services — third-party trust zones Legend Backend Database Cloud Security Message bus External

Primary path + async

  • • Browser → Nginx → PHP-FPM → Laravel 5.7 → MySQL
  • • Static assets served from CDN with Nginx as origin
  • • Database queue drained by artisan queue:work
  • • FTP scrapers: Auto123, SM360, Kijiji, Dealer.com, …

Outbound + trust boundaries

  • • Outbound: Facebook, WordPress, Shopify, Amazon PA-API, Twilio, Pusher
  • • Public edge: browser + CDN (untrusted)
  • • Application: Nginx + Laravel + MySQL (private)
  • • AWS trust zone: S3 + SES (IAM-scoped)
  • • Crossings: TLS, OAuth, signed Graph tokens, HMAC