System Architecture — Cluster · GitOps · Monitoring
The infrastructure shared by the services, explained in one diagram
Lurus uses a hybrid-cloud architecture, building a unified service deployment and governance system on Kubernetes + GitOps. All 12 products share the same account, billing, memory, LLM gateway, and observability foundation — not a patchwork of independent services, but a single picture you can explain in one pass.
Architecture Overview
Layered view Five layers top to bottom, from consumer-facing products down to the operations foundation; each layer provides capabilities to the one above, and the upper layers are unaware of how the lower ones are implemented.
graph TB
subgraph C[Consumer Product Layer]
Lucrum[Lucrum Quant]
Switch[Switch Desktop]
Creator[Creator Content]
Lutu[Lutu Mobile]
end
subgraph B[Business Product Layer]
API[Lurus API LLM Gateway]
Forge[Forge Workbench]
Lumen[Lumen Developer Tools]
end
subgraph E[Core Engine Layer]
Kova[Kova Durable Execution Rust]
MemX[MemX Smart Memory Python]
end
subgraph I[Infrastructure Layer]
Platform[Platform Account Billing]
Auth[Auth OIDC]
Notify[Notification Multi-channel]
end
subgraph O[Operations Layer]
Ops[K8s Traefik ArgoCD Prometheus Grafana Jaeger Loki]
end
C --> B
B --> E
E --> I
I --> OText version of the layered diagram (for accessibility / copying)
┌─────────────────────────────────────────────────────────────────┐
│ C 端产品层 │
│ Lucrum (量化) · Switch (桌面) · Creator (内容) · Lutu (移动) │
├─────────────────────────────────────────────────────────────────┤
│ B 端产品层 │
│ Lurus API (LLM 网关) · Forge (工作台) · Lumen (开发者工具) │
├─────────────────────────────────────────────────────────────────┤
│ 核心引擎层 │
│ Kova (持久执行, Rust) · MemX (智能记忆, Python) │
├─────────────────────────────────────────────────────────────────┤
│ 基础设施层 │
│ Platform (账号/计费) · Auth (OIDC) · Notification (多渠道通知) │
├─────────────────────────────────────────────────────────────────┤
│ 运维层 │
│ K8s · Traefik · ArgoCD · Prometheus · Grafana · Jaeger · Loki │
└─────────────────────────────────────────────────────────────────┘Design Principles
Five principles Unified entry, unified models, automated deployment, integrated observability, and self-healing failures.
Core Design
Unified gateway
Traefik ingress, TLS termination, automatic wildcard certificate management
Multi-model AI gateway
Unified access to 50+ LLM channels (OpenAI / Claude / Gemini / Deepseek / Qwen / Moonshot, etc.), with per-channel circuit-breaker protection
GitOps deployment
GitHub Actions → GHCR container images → ArgoCD auto-sync
Full-stack observability
Prometheus metrics + Grafana dashboards + Loki logs + Jaeger distributed tracing
High-availability design
Automatic channel failover, priority + weighted routing, PodDisruptionBudget protection
Request Processing Flow
Data flow A single LLM request travels from entry to upstream through five gates: authentication, rate limiting, circuit breaking, billing, and logging.
graph LR
Client[Client] --> Traefik[Traefik TLS]
Traefik --> GW[API Gateway]
GW --> Route[Smart Routing]
Route --> Up[Upstream AI 50+ Providers]
Up --> Resp[Response]
GW -.-> Mid[Auth / Rate Limit / Circuit Breaker / Billing / Logging]The API Gateway automatically matches an available channel based on the model name, supporting priority ordering and weighted random distribution. When a high-priority channel fails, the per-channel circuit breaker automatically isolates the faulty channel and shifts traffic to a fallback channel.
Technology Stack Overview
Tech choices A polyglot hybrid stack, matching the most appropriate runtime to each workload.
| Layer | Technology |
|---|---|
| Backend services | Go (Gin), Rust, Python (FastAPI) |
| Frontend | React / Next.js / Vue 3 / Flutter |
| Desktop apps | Wails (Go + Web), single dependency-free exe |
| Database | PostgreSQL (CNPG), per-service schema isolation |
| Cache | Redis, per-service DB isolation |
| Messaging | NATS JetStream (event broadcasting) |
| Workflow | Temporal (subscription renewals / scheduled tasks) |
| Identity | Casdoor (OIDC) |
| Containers | Minimal scratch/alpine images, multi-stage builds |
| Security | Kyverno policy engine + NetworkPolicy + Trivy container scanning |
Hybrid-Cloud Deployment
Deployment topology Dual public-network ingress + mixed orchestration — balancing domestic reachability with operational cost.
Dual public ingress across Sanfengyun + Alibaba Cloud, mixed K3s + Docker-Compose deployment, with infrastructure isolated per workload.
End-to-end automation via GitHub Actions → GHCR → ArgoCD, with image tags locked to main-<sha7>.
A unified Grafana + Prometheus + Jaeger + Loki panel, integrating metrics, logs, and traces.
Security Design
Defense in depth Seven layers of defense in depth, from transport to container runtime.
| Layer | Measure |
|---|---|
| Transport | Site-wide HTTPS (TLS 1.3), automatic wildcard certificate renewal |
| Network | VPN networking, NetworkPolicy namespace isolation |
| Authentication | Unified identity authentication: dual-mode OIDC JWT + API Key, WebAuthn Passkey, enterprise SSO federation |
| Authorization | RBAC role-based access control, automatic multi-tenant GORM isolation |
| Encryption | ChaCha20-Poly1305 + SM4-GCM (Chinese state cryptography, compliance) |
| Audit | Structured JSON logs + OpenTelemetry distributed tracing |
| Containers | readOnlyRootFilesystem, drop ALL capabilities, runAsUser:65534 |
Data sovereignty
End-to-end SM4-GCM encryption, on-premises deployment, and data that never leaves the enterprise boundary. A single SSO / Passkey / MFA setup integrates with your existing IdP, is compatible with the OpenAI SDK, and offers zero exit cost for export.
Detailed Architecture Docs
Single source of truth
The detailed architecture diagrams live in the governance repo: lurus.yaml + doc/architecture.md. This site no longer embeds the full diagram, to avoid maintaining two sources of truth.