memories/docebo-k2m-engine-poc-deployment-architecture-662cbeb9.md

memory

Deployment architecture and design decisions for the K2M-engine (The Librarian fork) Proof of Concept (POC) hosted on AWS EC2.

Infrastructure

  • AWS Account: 236775298993 in region eu-west-1.
  • DNS & Networking: Stable Elastic IP mapped via Route53 A record within the existing dev.ai-ops.docebo.info hosted zone.
  • External Endpoint: Exposes a single public hostname k2m.dev.ai-ops.docebo.info utilizing Let's Encrypt TLS (Certbot) for auto-renewing certificates.
  • Source Repository: Private GitLab repository at gitlab.com/docebo/ai-operations/proof-of-concepts/k2m-librarian.git cloned using deployment tokens to bypass email username encoding issues.

Routing & Forwarding Decisions

  • Path-Based Routing: Deployed Nginx as a reverse proxy matching a single hostname rather than separate subdomains to maximize setup simplicity.
    • / -> Proxied to Admin Dashboard (container port 3042 -> 3000 internally).
    • /mcp -> Proxied to MCP JSON-RPC endpoint (container port 3838).
  • Security Group Open Ports: Container ports 3838 and 3042 are explicitly left open to 0.0.0.0/0 in the security group alongside Nginx. Since this POC is sheltered behind a corporate VPN, this exposure is accepted as a pragmatic trade-off to simplify debugging, not an oversight to flag in future reviews.