graph TD
    subgraph MONO["Mono-Repo: 4 Boundaries"]
        INF["infrastructure/\nAWS Terraform\n33 files · 6 modules"]
        PLT["platform/\nK8s Bootstrap\nTerraform + Helm"]
        APP["applications/\nFinTech Service\nDocker + Helm Chart"]
        GIT["gitops/\nArgoCD Manifests\nApp of Apps"]
    end

    subgraph AWS["AWS 3-Tier Production Design"]
        ALB["Application Load Balancer\nports 80 · 443"]
        EC2["EC2 + Auto Scaling Group\nt2.micro · IMDSv2 enforced"]
        RDS["RDS MySQL 8.0\ndb.t3.micro · AES-256 encrypted"]
        SM["Secrets Manager\nzero hardcoded credentials"]
        S3["S3 + DynamoDB\nRemote State + Lock"]
    end

    subgraph LOCAL["Local K3d Platform"]
        K3D["K3d Cluster\n1 server + 2 agents\nK3s v1.28.8"]
        ARGO["ArgoCD v2.10.4\nGitOps Controller"]
        NGINX["NGINX Ingress\nHTTP routing"]
        OBS["Observability\nPrometheus · Grafana · Loki"]
        PS["payment-service\nFastAPI · port 8000"]
    end

    INF --> ALB
    ALB --> EC2
    EC2 --> RDS
    RDS --> SM
    INF --> S3

    PLT --> K3D
    K3D --> ARGO
    K3D --> NGINX
    K3D --> OBS
    ARGO --> PS

sequenceDiagram
    participant Dev as Developer
    participant Git as GitHub Repo
    participant Argo as ArgoCD
    participant K3d as K3d Cluster

    Dev->>Git: git push
    Git-->>Argo: poll / webhook
    Argo->>Git: detect diff
    Argo->>K3d: helm upgrade
    K3d-->>Argo: Healthy
    Argo-->>Dev: Synced + Healthy

graph LR
    PUSH["git push"] --> S1["Stage 1\nCheckout + Cache"]
    S1 --> S2["Stage 2\nterraform fmt\n-check -recursive"]
    S1 --> S3["Stage 3\nTrivy\nIaC + Secret Scan\nSARIF upload"]
    S2 --> S4["Stage 4\nTFLint\nAWS ruleset\n8 modules"]
    S3 --> S4
    S4 --> S5["Stage 5\nterraform validate\n-backend=false\nall modules"]

graph TD
    I([Internet]) -->|"TCP 80, 443"| ALB_SG
    subgraph ALB_SG["ALB Security Group"]
        A1["INBOUND: 80 + 443 from 0.0.0.0/0"]
    end
    ALB_SG -->|"port 80 · Source = ALB SG ID"| APP_SG
    subgraph APP_SG["App Security Group — EC2"]
        B1["INBOUND: 80 from ALB SG only"]
        B2["INBOUND: 22 from VPC CIDR only"]
    end
    APP_SG -->|"port 3306 · Source = App SG ID"| DB_SG
    subgraph DB_SG["DB Security Group — RDS"]
        C1["INBOUND: 3306 from App SG only"]
        C2["OUTBOUND: VPC CIDR only"]
    end

graph LR
    PS["payment-service\npods"] -->|"metrics :8000"| PROM["Prometheus\nkube-prometheus-stack\nv58.3.3"]
    NODES["K3d nodes"] -->|"node metrics"| PROM
    PROM -->|"query"| GRAF["Grafana\ndashboards\nlocalhost:3000"]
    PROM --> ALERT["Alertmanager\npod restarts\nhigh CPU\nnot-ready alerts"]

    PS -->|"structured logs"| PROMTAIL["Promtail\nDaemonSet"]
    PROMTAIL -->|"push"| LOKI["Loki\nlog aggregation"]
    LOKI -->|"query"| GRAF

graph LR
    L["Local K3d\nfintech-local\nCurrent"] -->|"Change destination\nserver in ArgoCD"| E["AWS EKS\nfintech-prod\nNext"]

    subgraph CHANGES["Migration Delta"]
        C1["NGINX Ingress\n→ ALB Controller"]
        C2["/etc/hosts\n→ Route 53 + ExternalDNS"]
        C3["K8s ServiceAccount\n→ IRSA + IAM Role"]
        C4["Local Prometheus\n→ Amazon Managed Prometheus"]
        C5["Local Loki\n→ CloudWatch Logs"]
    end

graph TD
    subgraph FRONTEND["User Layer"]
        UI["React Frontend\nNetflix-style UI\nport 80"]
    end

    subgraph BACKEND["Application Layer"]
        API["Node.js Backend\nREST API\nport 3001"]
        PROC["Python + FFmpeg\nVideo Processor\n480p · 720p · 1080p\nport 5001"]
    end

    subgraph DATA["Data Layer"]
        MONGO["MongoDB\nVideo Metadata\nport 27017"]
        REDIS["Redis Cache\nSessions · Metadata\nport 6379"]
        S3["AWS S3\nVideo Storage\nCloudFront CDN"]
    end

    subgraph OBS["Observability"]
        PROM["Prometheus\nport 9090"]
        GRAF["Grafana\nport 3002"]
        LOKI2["Loki\nLogs"]
    end

    subgraph CICD["CI/CD"]
        GHA["GitHub Actions\nTrivy · Build · Deploy"]
        JENKINS["Jenkins\nParallel Pipeline\n7 stages"]
    end

    UI --> API
    API --> MONGO
    API --> REDIS
    PROC --> S3
    API --> PROC
    PROM --> GRAF
    LOKI2 --> GRAF
    GHA --> JENKINS