Architecture
Architecture
Control plane vs data plane — how Bytstack builds, runs, and routes Node apps.
Bytstack splits into two planes:
- Control plane — NestJS API, auth, billing, webhooks, deploy scheduling, domain records, encrypted secrets (
apps/api). - Data plane — Kubernetes workloads for your apps, ingress/edge, static assets, and managed databases.
High-level flow
GitHub / CLI / Dashboard
│
▼
Control plane API ──► Redis queues
│ │
│ ┌──────┴──────┐
│ ▼ ▼
│ Builder Provisioner
│ │ │
│ ▼ ▼
│ Registry User Postgres
│ │
└──────────────┼──► Runtime cluster
▼
Ingress → Web / Worker / Cron| Worker | Role |
|---|---|
| Builder | Clone, install, build, push images / upload static assets (deploy queue) |
| Provisioner | Databases, credentials, backups, deprovision (provision, backup, …). Sole holder of PG_ADMIN_URL. |
Hierarchy
Workspace → Project → web / static / worker / cron services + databases.
Networking
| Surface | Example |
|---|---|
| Platform ingress | *.bytstack.app |
| Customer hosts | CNAME / ALIAS → project edge |
| External Postgres | TLS hostname + allowlist |
| Internal DB | Private DNS inside the cluster |
Isolation
Customer apps and databases run in isolated networking. Managed data is reachable from your services on a private network by default — not from the public internet unless you opt into external access.