¶ Backend Infrastructure
Server architecture, APIs, and cloud services powering the eCozy platform.
¶ High-Level Architecture
PlantUML source
¶ Services
¶ API Gateway
- Entry point for all client traffic
- TLS termination
- Rate limiting and DDoS protection
- Request routing to internal services
¶ Auth Service
- JWT-based authentication
- OAuth2 / OpenID Connect support
- Role-based access control (RBAC): Owner, Admin, Guest
- Device token management (Central Unit pairing)
¶ Device Management Service
- Central Unit registration and lifecycle
- Device inventory (thermostats, sensors per home)
- OTA update orchestration and rollout management
- Online/offline status monitoring
¶ Rule Engine
- User-defined automations (if/then logic)
- AI-assisted schedule suggestions
- Cross-room energy optimization
- Geofencing triggers (arrival/departure)
¶ Notification Service
- Push notifications (FCM / APNs)
- Email alerts (critical events)
- In-app notification history
¶ Data Storage
| Store | Technology | Purpose |
|---|---|---|
| Time-series DB | InfluxDB / TimescaleDB | Sensor telemetry, energy consumption |
| Relational DB | PostgreSQL | Users, homes, devices, configuration |
| Cache | Redis | Session tokens, device state cache |
| Object Storage | S3-compatible | Firmware images, log archives |
¶ MQTT Broker
- Protocol: MQTT 3.1.1 / 5.0 over TLS (port 8883)
- Authentication: mutual TLS (client certificates per Central Unit)
- Topic structure:
ecozy/{home_id}/{device_id}/{type} - QoS levels: QoS 1 for telemetry, QoS 2 for commands
- Retained messages used for last-known device state
¶ Security
- All external communication over TLS 1.3
- Secrets managed via Vault / Secrets Manager
- Telemetry data encrypted at rest (AES-256)
- Regular penetration testing and vulnerability scanning
- See IT Security for full security policy
¶ Environments
| Environment | Purpose |
|---|---|
production |
Live customer traffic |
staging |
Pre-release validation |
development |
Internal development and integration testing |