Docker Swarm Architecture

Cluster Overview

Node	IP	Role	Engine
Synology NAS DS3617xs	100.126.73.29 (Tailscale)	Docker Swarm Manager	20.10.3
Contabo VPS	13.140.161.244 (public) / 100.64.109.105 (Tailscale)	Swarm Worker + Edge	29.5.3
Colima	—	Worker	29.2.1
Colima (2nd)	—	Worker (Down)	29.2.1

Swarm Services (Production)

Service	Stack	Purpose
`falah_traefik`	Swarm	Reverse proxy — routes HTTPS, TLS termination
`gitea_gitea`	Swarm	Git hosting — git.falahos.my (:3080)
`falah_casdoor`	Swarm	Identity provider — auth.falahos.my (:8000)
`falah_falah-mobile`	Swarm	Next.js frontend — falahos.my
`falah_falah-mobile-staging`	Swarm	Staging environment
`falah_postgres`	Swarm	Main application database
`falah_redis`	Swarm	Cache layer
`falah_casdoor-db`	Swarm	Casdoor auth database (Postgres 16)
`falah_temporal`	Swarm	Workflow orchestration engine
`falah_finance`	Swarm	Financial services
`falah_wallet`	Swarm	Wallet service
`falah_ramz`	Swarm	RAMZ service
`traefik_traefik`	Swarm	Traefik monitoring node
`falah_mocknet`	Swarm	Blockchain mock network
`falah_falah-os-app-static`	Swarm	Static app assets
`falah_falah-desktop`	Swarm	Desktop application
`falah_falah-backend`	Swarm	Backend API services
`falah_falah-ui`	Swarm	UI services
`falah_falah-tunnel`	Swarm	Tunnel services
`falah_falah-dns-healer`	Swarm	DNS auto-healer
`falah_nextcloud`	Swarm	Nextcloud file sync
`falah_nextcloud-db`	Swarm	Nextcloud database
`falah_nextcloud-redis`	Swarm	Nextcloud cache
`falah_wordpress`	Swarm	WordPress instance
`falah_vaultwarden`	Swarm	Password manager
`falah_uptime-kuma`	Swarm	Uptime monitoring
`falah_bookstack`	Swarm	Documentation wiki
`falah_listmonk`	Swarm	Email newsletter
`falah_postiz`	Swarm	Social media scheduler
`falah_garage`	Swarm	S3-compatible object storage
`falah_prometheus`	Swarm	Metrics collection
`falah_grafana`	Swarm	Dashboards & visualization
`falah_loki`	Swarm	Log aggregation
`falah_netdata`	Swarm	Real-time monitoring
`falah_komodo`	Swarm	GitOps deployment manager
`falah_faraid`	Swarm	Faraid (inheritance) service

Traffic Flow

Users → Cloudflare (DNS proxy + WAF) → cloudflared Tunnel → Traefik (Swarm) → Services

Cloudflare handles DNS proxying, WAF security rules, and CDN caching
cloudflared tunnel connects Cloudflare to the Swarm's Traefik node on Contabo
Traefik v2 on the Contabo edge node routes incoming HTTPS to the correct Swarm service
Internal Swarm traffic uses the overlay network between Synology (manager) and Contabo (worker)

Standalone Containers (Synology)

In addition to Swarm services, Synology runs standalone containers:

Stack	Containers	Purpose
Falah Umbrel	wallet, app, ramz, ummahid, istore, mocknet, carbon, faraid, halal, redis, api-gateway, postgres	Core FalahOS services
Halal Monitor	postgrest, postgis db, nginx gateway	Halal certification monitoring
Karakeep	web, meilisearch, chrome browser	Bookmarking & content keep
Mattermost	app, db	Team chat (internal)
Infrastructure	Portainer, Dockge x2, Watchtower, Garage S3	Docker management + storage
CI/CD	Gitea Runners x3 (act_runner)	Gitea Actions execution
Falah Services	falah-desktop, falah-backend, falah-ui, falah-tunnel, falah-mobile-staging, falah-auto-healer, falah-dns-healer	Supporting services
Other	Linkstack, Affine, iStore, Identity-layer, Auth, Tor proxy, Faraid-anvil (Foundry)	Supporting apps

Key Facts

Docker Swarm manager lives on Synology NAS, not Contabo — Contabo is a worker node
All production containers run on Synology (via Swarm + standalone)
Gitea runs as a Swarm service on Synology (:3080), fronted by Traefik
Casdoor (auth.falahos.my) replaced the old UmmahID service
Garage S3 provides object storage on Synology
Tailscale connects all nodes in a mesh VPN (100.x.x.x range)
Cloudflare proxies DNS, WAF, and CDN — Traefik handles internal routing
Imunify360 on cPanel blocks datacenter IPs — MacBook Air residential IP used as bypass