Pod Architecture

The AEGIS platform deploys as a set of Podman pods, each grouping related containers with shared networking. This page provides the complete reference for every pod, its containers, ports, health checks, and persistent volumes.

Pod Topology

┌─────────────────────────────────────────────────────────────┐
│                    aegis-network (bridge)                     │
│                                                               │
│  pod-core          pod-temporal        pod-database           │
│  ┌──────────────┐  ┌──────────────┐   ┌──────────────────┐  │
│  │aegis-runtime │  │temporal      │   │postgres          │  │
│  │:8088 :50051  │  │:7233         │   │:5432             │  │
│  │:2049 :9091   │  │temporal-ui   │   │postgres-exporter │  │
│  │              │  │:8233         │   │:9187             │  │
│  │              │  │temporal-worker│   │                  │  │
│  │              │  │:3000         │   │                  │  │
│  └──────────────┘  └──────────────┘   └──────────────────┘  │
│                                                               │
│  pod-secrets       pod-iam            pod-storage             │
│  ┌──────────────┐  ┌──────────────┐   ┌──────────────────┐  │
│  │openbao       │  │keycloak      │   │seaweedfs-master  │  │
│  │:8200         │  │:8180         │   │:9333 :19333 :9324│  │
│  │              │  │              │   │seaweedfs-volume  │  │
│  │              │  │              │   │:8080 :18080 :9325│  │
│  │              │  │              │   │seaweedfs-filer   │  │
│  │              │  │              │   │:8888 :9326       │  │
│  │              │  │              │   │seaweedfs-webdav  │  │
│  │              │  │              │   │:7333             │  │
│  └──────────────┘  └──────────────┘   └──────────────────┘  │
│                                                               │
│  pod-observability                    pod-seal-gateway        │
│  ┌──────────────────────────────┐    ┌──────────────────┐   │
│  │jaeger     :16686 :4317 :4318│    │seal-gateway      │   │
│  │prometheus :9090              │    │:8089 :50055      │   │
│  │grafana    :3300              │    │                  │   │
│  │loki       :3100              │    │                  │   │
│  │promtail   :9080              │    │                  │   │
│  └──────────────────────────────┘    └──────────────────┘   │
└─────────────────────────────────────────────────────────────┘

pod-core

The central AEGIS orchestrator. Manages agent lifecycle, execution, tool routing, NFS gateway, and all core business logic.

Health check: HTTP GET /health on port 8088 (30s interval)

Volumes:

• aegis-runtime-data -> /app/data (agent execution outputs)
• Podman socket (read-only) for spawning agent containers
• aegis-config.yaml and runtime-registry.yaml mounted as config

Key environment variables: RUST_LOG, DATABASE_URL, AEGIS_CONTAINER_NETWORK, AEGIS_ORCHESTRATOR_URL, SEAL_PRIVATE_KEY_PATH, AEGIS_OTLP_ENDPOINT, CORTEX_GRPC_URL

pod-database

PostgreSQL and its Prometheus metrics exporter.

Health check: pg_isready -U aegis (10s interval)

Volumes:

• aegis-postgres-data -> /var/lib/postgresql/data
• Init scripts for database creation (aegis, temporal, keycloak)

Authentication: SCRAM-SHA-256

pod-temporal

Temporal workflow engine with its web UI and the AEGIS workflow worker.

Health check: temporal operator cluster health (10s interval)

Volumes:

• aegis-temporal-worker-data -> /app/data
• Temporal dynamic config mounted

Key environment: TEMPORAL_ADDRESS, DATABASE_URL, AEGIS_RUNTIME_GRPC_URL

pod-secrets

OpenBao secrets management (open-source Vault alternative).

Health check: bao status JSON query (10s interval)

Volumes:

• aegis-openbao-data -> /openbao/data
• openbao-config.hcl mounted

Auth method: AppRole (role_id + secret_id). Initialize with make bootstrap-secrets.

pod-iam

Keycloak OIDC identity provider.

Health check: HTTP GET /health/ready on port 8180 (15s interval)

Database: PostgreSQL (aegis-database:5432/keycloak)

Key environment: KEYCLOAK_ADMIN, KEYCLOAK_ADMIN_PASSWORD, KC_DB_URL

Initialize realms and clients with make bootstrap-keycloak.

pod-storage

SeaweedFS distributed storage with master, volume server, filer, and WebDAV.

Health checks: HTTP on respective ports (10s interval)

Volumes:

• aegis-seaweedfs-master-data -> /data
• aegis-seaweedfs-volume-data -> /data
• aegis-seaweedfs-filer-data -> /data

pod-observability

Full monitoring stack: distributed tracing, metrics, dashboards, and log aggregation.

Health checks: HTTP on respective ports (10s interval)

Volumes:

• aegis-prometheus-data -> /prometheus (15-day retention)
• aegis-grafana-data -> /var/lib/grafana
• aegis-loki-data -> /loki (7-day retention)
• Config mounts for Prometheus, Grafana datasources/dashboards, Loki, Promtail

Grafana access: Port 3300, anonymous viewer access enabled by default.

pod-seal-gateway

SEAL tooling gateway for REST workflow macros, API explorer, and ephemeral CLI tools.

Health check: HTTP GET / on port 8089 (10s interval)

Volumes:

• aegis-seal-gateway-data -> /app/data (SQLite database)
• Podman socket (for ephemeral container execution)

Persistent Volume Summary

Inter-Pod Communication

All pods share the aegis-network Podman bridge network. Containers within the same pod communicate via localhost. Cross-pod communication uses pod DNS names:

See Also

• Deployment Profiles — which pods are included in each profile
• Podman Deployment — platform deployment guide
• Observability — monitoring stack details
• Infrastructure Requirements — hardware and network requirements