%% title: 10-1 Network
%% description: Section 10 - System Environment - Figure 10-1 Network
graph LR
  subgraph External Services
    github["GitHub"]
    slack["Slack"]
    pagerduty["PagerDuty"]
    newrelic["New Relic"]
    statuspage["StatusPage"]
    codeclimate["Code Climate"]
    travis["Travis CI"]
    cloudability["Cloudability"]
    visualops["VisualOps"]
  end
  subgraph AWS
    api["API Endpoint"]
    apps-elb["Customer ELB"]
    ops-elb["UAA & Concourse ELB"]
    s3["S3"]
    cloudwatch["CloudWatch"]
    advisor["Trusted Advisor"]
    config["Config"]
    cloudtrail["CloudTrail"]
    route53["Route 53"]
    iam["IAM"]
    iam-perms["IAM Permissions"]
    iam-roles["IAM Roles"]
    aws-console["AWS Console"]
    subgraph cloud.gov Authorization Boundary
      subgraph Production VPC
        subgraph Availability Zones us-gov-west-1*
          subgraph Public Subnet
            prod-nat["NAT Gateway"]
            prod-elb-endpoint>"ELB Endpoint"]
          end
          subgraph Private Subnet - Core Tier A
            prod-cf{"Cloud Foundry<br>Core Components"}
          end
          subgraph Private Subnet - Core Tier B
            prod-diego{"Cloud Foundry<br>Container Management"}
          end
          subgraph Private Subnet - Database Tier
            prod-rds{"RDS instances"}
          end
          subgraph Private Subnet - Services Tier
            prod-services{"Service instances"}
          end
        end
        vpc-router-prod["VPC Router"]
      end
      vpc-peering["VPC Peering Connection"]
      subgraph Tooling VPC
        subgraph Tooling Availability Zones us-gov-west-1*
          subgraph Public Subnet
            tooling-nat["NAT Gateway"]
            tooling-elb-endpoint>"ELB Endpoint"]
          end
          subgraph Private Subnet - Operations Tier
            tooling-ops["BOSH Director/UAA"]
          end
          subgraph Private Subnet - Database Tier
            tooling-rds{"RDS instances"}
          end
          subgraph Private Subnet - Concourse Tier
            tooling-concourse["Concourse - production"]
          end
        end
        vpc-router-tooling["VPC Router"]
      end
    end
  end
  customer(("Customer"))
  ops(("Cloud Operations"))

  customer-.DNS.->route53
  customer--Web or CLI-->apps-elb
  customer-->statuspage

  ops-->ops-elb
  ops-->github
  ops-->slack
  ops---aws-console
  ops-->newrelic
  ops-->statuspage
  ops-->pagerduty

  codeclimate-- Static analysis --- github
  travis-- Continuous Testing --- github
  api--Monitoring-->newrelic
  api--Alerting-->pagerduty
  api--API Read-only for infrastructure visualization-->visualops
  api--API Read-only for cost and utilization data-->cloudability

  vpc-router-tooling-->vpc-peering
  vpc-router-prod-->vpc-peering
  aws-console-."Authentication/Authorization".->iam
  iam-.->iam-perms
  iam-perms-.->iam-roles

  apps-elb---prod-elb-endpoint
  prod-elb-endpoint---prod-nat
  prod-nat---prod-cf
  prod-nat---prod-diego
  prod-nat---prod-rds
  prod-nat---prod-services

  ops-elb---tooling-elb-endpoint
  tooling-elb-endpoint---tooling-nat
  tooling-nat---tooling-ops
  tooling-nat---tooling-rds
  tooling-nat---tooling-concourse
