# studio-infra Architecture
<!-- wiki:featured -->

**Version:** 1.0.0  
**Track:** studio-infra  
**Baseline:** 2026-10-06  
**Host:** Oracle VM · `ubuntu@orcl-vm` · 150.136.13.171

## Overview

studio-infra is the server-side foundation for Venture Studio. It runs a Docker Compose stack of data and workflow services on a single Oracle Cloud VM, fronted by nginx, with systemd managing long-lived processes. The infra also hosts the IBGateway integration for brokerage connectivity and the E2E testing pipeline.

## Services

| Service | Image | Port (internal) | Memory | Purpose |
|---------|-------|-----------------|--------|---------|
| studio-postgres | studio-postgres-timescaledb:pg16 | 5432 | 1.5 GB | Primary DB (TimescaleDB + time-series) |
| studio-redis | redis:7-alpine | 6379 | 256 MB | Cache · session · LRU eviction |
| studio-qdrant | qdrant/qdrant | 6333 | 2 GB | Vector store for embeddings |
| studio-n8n | n8nio/n8n:latest | 5678 | 512 MB | Workflow automation · webhooks |
| ibgateway | custom | 4001/4002 | — | Interactive Brokers TWS Gateway |
| studio-api | fastapi.service | 8000 | — | Studio FastAPI backend (systemd) |
| studio-wiki | studio-wiki.service | 8080 | — | Auto-generated wiki (systemd) |

**Stopped (2026-10-03):** Langfuse + workers + ClickHouse + MinIO — 0 traces received, DB connection errors. Pending rewire to LiteLLM before restart.

All Docker services share `studio_net` (external bridge network) for DNS resolution by container name.

## Network

```
Internet
    │
    ▼
nginx (reverse proxy)
    ├── /api         → studio-api :8000
    ├── /workflows/  → studio-n8n :5678
    └── /            → studio-console :3001
```

- All Docker ports bound to `127.0.0.1` (localhost-only)
- IBGateway: 4001 (live), 4002 (paper) — internal only
- Wiki: `:8080` — Oracle security list ingress open
- Domain: `studio-venky.duckdns.org` (DuckDNS)
- Oracle VCN: `vm1-nvcn` · `10.0.0.0/16`

## Data Volumes

| Path | Service | Contents |
|------|---------|----------|
| `/data/postgres` | Postgres | TimescaleDB data |
| `/data/redis` | Redis | AOF persistence |
| `/data/qdrant` | Qdrant | Vector collections |
| `/data/n8n` | n8n | Workflows · credentials |
| `/data/studio-dev-repo` | — | Source repo |

## IBGateway

Interactive Brokers TWS Gateway for brokerage API access.

- Install: `ibgateway/install-ibgateway-binaries.sh`
- Systemd unit: `ibgateway/ibgateway.service`
- Config sync: `ibgateway/sync-ibc-config.sh`
- Run: `ibgateway/run-ibgateway.sh`
- Ports: 4001 (live trading), 4002 (paper trading)
- IBC: headless TWS automation

## Systemd Services

| Unit | Purpose |
|------|---------|
| `fastapi.service` | Studio API — auto-restart |
| `ibgateway.service` | IB Gateway — auto-restart |
| `studio-wiki.service` | Wiki server on `:8080` — auto-restart |

## Ops Scripts

| Script | Purpose |
|--------|---------|
| `session-start.sh` | Bootstrap dev session on VM |
| `oracle_toronto_retry.py` | Oracle → Toronto connectivity retry logic |
| `bw-helpers.sh` | Bitwarden CLI helpers for secret retrieval |
| `infra-utilities/discord-intake` | Discord webhook intake utility |

## E2E Testing Pipeline

- Framework: Playwright v1.62.1
- Visual regression: Argos CI (`@argos-ci/playwright`)
- Accessibility: axe-playwright v2.2.2
- Test selection: `selectTests.js` (dynamic subset runner)
- Version: e2e-testing v1.1.0
- Docs: `docs/architectures/e2e-testing/ARCHITECTURE.md`

## Environment

Secrets managed via `.env` (not committed). Key vars:

- `POSTGRES_PASSWORD` — shared across Postgres + n8n
- `N8N_ENCRYPTION_KEY` — n8n credential encryption
- `N8N_HOST`, `N8N_WEBHOOK_URL` — public webhook URLs
- IBGateway credentials via `ibgateway.env` (from `ibgateway.env.example`)

Bitwarden CLI (`bw-helpers.sh`) used for secret injection in scripts.

## Pending

| Item | Status |
|------|--------|
| Langfuse rewire to LiteLLM | ⏳ blocked — pending LiteLLM config |
| Nominatim geocoding service | ⏳ referenced in CHANGELOG, not in Compose |
| studio-products arch doc | ⏳ pending |

---

_Generated: 2026-10-07 · studio-infra v1.0.0_