---
module: platform.topology
title: Infrastructure Topology — VMs, Access, Deploy Paths
tab: Overview
order: 10
audience: dev
---

> **DRAFT · internal.** Written 2026-07-01 to stop the most expensive recurring mistake:
> guessing where a service runs or how to reach the database. Verify a specific IP/path against
> the live host before destructive actions.

## The two clouds

HiveIQ runs on **OpenMetal (OpenStack)**. Workloads run inside **Nova VMs** — never SSH or
deploy to the `.229 / .230 / .231` bare-metal hypervisors.

- **hiveiq-*** VMs = the HiveOps platform (services, db, cdn, ollama, dev).
- **bcos-*** VMs = supporting services (mail, office/Nextcloud, share/Pingvin, proxy/NPM,
  **pw/Vaultwarden**).

## VM map (production)

| VM | Floating IP | Internal IP | Purpose |
|----|-------------|-------------|---------|
| hiveiq-services | **173.231.195.250** | 10.10.10.164 | All microservices + NGINX |
| hiveiq-database | *(internal only)* | **10.10.10.188** | PostgreSQL + pgAdmin |
| hiveiq-cdn | **173.231.195.252** | 10.10.10.103 | Browser/agent CDN + Docker registry |
| hiveiq-ollama | *(internal only)* | 10.10.10.7 | Ollama LLM inference |
| hiveiq-dev | **173.231.195.251** | 10.10.10.235 | Dev environment (bcos.dev) — all-in-one, isolated |
| bcos-share | **173.231.195.254** | 10.10.10.170 | Pingvin Share **and Vaultwarden (pw.bcos.cloud, :8200)** |
| bcos-proxy | **173.231.195.253** | 10.10.10.12 | Nginx Proxy Manager (proxy.bcos.cloud) |

## Access

- **SSH user** `bcosadmin`, key `~/.ssh/id_ed25519_hiveiq`. Always
  `ssh -i ~/.ssh/id_ed25519_hiveiq bcosadmin@<IP>`.
- At the office use **floating IPs**; over WireGuard VPN use **internal IPs**.

### The database is NOT on the services VM

`hiveiq-postgres` runs on **10.10.10.188** (database VM), reachable only via ProxyJump through
the services VM. Running `docker exec hiveiq-postgres …` on `.250` **always fails** —
"No such container".

```bash
ssh -i ~/.ssh/id_ed25519_hiveiq -J bcosadmin@173.231.195.250 bcosadmin@10.10.10.188 \
  "docker exec hiveiq-postgres psql -U hiveiq -d hiveiq_journal -c 'SELECT 1'"
```

## Deploy paths on the services VM (`173.231.195.250`)

```
~/hiveiq/hiveops-openmetal/hiveops/instances/services/   # microservices + NGINX compose
```
Standard microservice deploy: build/push locally, then on the services VM
`docker compose pull hiveiq-<svc> && docker compose up -d hiveiq-<svc>`.

- **dev = bcos.dev = 173.231.195.251** (all-in-one). CDN files there live under
  `downloads/downloads/`.
- **CDN VM = 173.231.195.252** — browser + agent installers served as static files; also hosts
  the Docker registry `registry.bcos.cloud`.

## Registries

- **Dev:** `registry.bcos.dev` (tag `:dev`) — dev/bcos.dev only.
- **Production:** `registry.bcos.cloud` (tag `:latest`/`:<sha>`).
- **Never mix them.** `192.168.200.200:5000` is removed — never use it.

## Do NOT
- Do not SSH/deploy to `.229/.230/.231` (bare metal).
- Do not assume Postgres is on the services VM — it is on 10.10.10.188.
- Do not trust a plaintext credential from memory for production — **Vaultwarden (pw.bcos.cloud)
  is the source of truth**; fetch the current value when one fails.
