# Current Architecture: Per-Group Deployment Model

_____

The current NGX Ramblers architecture deploys a single Docker image to multiple independent Fly.io apps. Each app connects to its own MongoDB database and S3 bucket, providing complete data isolation.

## Architecture Diagram

```mermaid
flowchart TD
    IMG@{ icon: "logos:docker-icon", label: "Single Docker Image", pos: "b", h: 48 }

    IMG --> APP1@{ icon: "logos:fly-icon", label: "Group A (512MB)", pos: "b", h: 48 }
    IMG --> APP2@{ icon: "logos:fly-icon", label: "Group B (512MB)", pos: "b", h: 48 }
    IMG --> APP3@{ icon: "logos:fly-icon", label: "Group C (512MB)", pos: "b", h: 48 }
    IMG --> APPN["... x 13 apps"]

    APP1 --> DB1@{ icon: "ngx:mongodb", label: "Group A DB", pos: "b", h: 48 }
    APP2 --> DB2@{ icon: "ngx:mongodb", label: "Group B DB", pos: "b", h: 48 }
    APP3 --> DB3@{ icon: "ngx:mongodb", label: "Group C DB", pos: "b", h: 48 }

    APP1 --> S31@{ icon: "ngx:aws", label: "Group A bucket", pos: "b", h: 48 }
    APP2 --> S32@{ icon: "ngx:aws", label: "Group B bucket", pos: "b", h: 48 }
    APP3 --> S33@{ icon: "ngx:aws", label: "Group C bucket", pos: "b", h: 48 }
```

## Key Characteristics

- **13 separate Fly.io apps**, each with 512MB–1GB memory
- **One MongoDB database per group** (complete data isolation)
- **One S3 bucket per group** (separate image/file storage)
- **One AUTH_SECRET per group** (independent JWT signing)
- **One Cloudflare subdomain per group** (e.g. `group-a.ngx-ramblers.org.uk`)
- Groups also have custom domains (e.g. `group-a-ramblers.org.uk`)
- The Angular frontend is identical across all sites — all site-specific behaviour comes from runtime config loaded from the database

## What Already Works

| Capability | Status |
|------------|--------|
| Single codebase | One repo, one team |
| Single build artifact | One Docker image for all sites |
| Automated group provisioning | CLI tool creates new groups end-to-end |
| Per-group custom domains | Each group has its own domain and branding |
| Complete data isolation | Physically separate databases — no cross-group leakage possible |

## Strengths of This Model

- **Data isolation is inherent** — no risk of cross-group data leakage because databases are physically separate
- **Blast radius is limited** — a bug or outage on one group's app doesn't affect others
- **Resource isolation** — one group's heavy traffic doesn't starve others
- **Simple application code** — no tenant context needed in queries, middleware, or auth