structure-deployment-tiers

name	structure-deployment-tiers
description	Organize deployment infrastructure into logical tiers (DMZ → AppTier → ProcTier → DataTier) with clear responsibility separation and firewall rules between zones.

Structure Deployment Tiers

Use this skill when designing deployment architecture. Organize zones/nodes into logical tiers following the standard layered architecture pattern.

Prerequisite: Read model-deployment and name-deployment-nodes skills for basic structure and naming.

Core Principle: Show Tier Hierarchy & Parent Context

All tiers and zones MUST be explicitly nested within their parent environment:

• Every zone belongs to a specific environment (Production/Development)
• Every VM belongs to a specific zone
• Every service instance belongs to a specific VM
• This creates clear parent-child relationships: Environment → Zone → VM → Instance
• Views of individual tiers must still show their parent environment for context

Standard Tier Architecture

The refactored reference pattern organizes infrastructure into 4-5 logical tiers:

Internet
    ↓
DMZ (Edge Security)
    ├─ API Gateway (Kong)
    ├─ Web Server (Nginx SPA)
    ↓
AppTier (Microservices)
    ├─ Upload Service
    ├─ Retrieval Service
    ↓
ProcTier (Async Processing)
    ├─ Message Queue (RabbitMQ)
    ├─ Worker (Processing)
    ↓
DataTier (Persistence)
    ├─ Database (MongoDB)
    ├─ Object Storage (MinIO)
    ↓
SecZone (Optional: Monitoring)
    └─ Monitoring Stack (Prometheus, Grafana)
InfraZone (Optional: Backup/DR)
    └─ Backup Storage

Tier Responsibilities

DMZ (Demilitarized Zone)

Purpose: Edge security with TLS termination and request routing

Services:

• API Gateway (Kong, Nginx Ingress) - Routes requests to microservices