Open BFlow Studio

BFlow AWS architecture

Application runtime and release/DNS process

Application services

BFlow application runtime AWS cloud and region contain the VPC, two public subnets, two private subnets, and regional application services. AWS Cloud Region · us-east-1 (default) VPC · 10.0.0.0/16 DNS support and hostnames enabled Internet gateway routes public traffic to the internet. · network.tf · public route table and public subnets Internet gateway Public route table · 0.0.0.0/0 → IGW ECS security group Public A · AZ A 10.0.1.0/24 The API runs on Fargate tasks in the public subnets. · deploy.yml · ECS service and task definition Fargate task Public B · AZ B 10.0.2.0/24 The API runs on Fargate tasks in the public subnets. · deploy.yml · ECS service and task definition Fargate task Private A · AZ A 10.0.10.0/24 Private route table · no IGW route Private B · AZ B 10.0.20.0/24 Private route table · no IGW route Optional PostgreSQL database; default provider is Supabase. · storage-and-compute.tf · private subnet group Amazon RDS · optional PostgreSQL · db_provider=rds Supabase is the default Regional services Outside the VPC ECS cluster · Terraform declares the cluster; deploy.yml creates and updates the service.ECS cluster Stores immutable backend images. · storage-and-compute.tf · deploy.yml pushes images.ECR Private file bucket with encryption and temporary-object expiry. · storage-and-compute.tf · ECS task roleS3 files Secret containers for DB, Wompi and Firebase. · storage-and-compute.tf · ECS execution roleSecrets OCR request/results queues and dead-letter queues. · iam-and-messaging.tf · ECS task roleSQS · OCR OCR result and alarm topics. · iam-and-messaging.tf, observability.tf · SQS and emailSNS Application logs, API alarms and dashboard. · storage-and-compute.tf, observability.tfCloudWatch ECS roles, service permissions and GitHub OIDC deploy role. · iam-and-messaging.tf, github-and-outputs.tfIAM · OIDC Optional OAuth client for an existing user pool. · github-and-outputs.tfCognito client Monthly cost budget with optional email alerts. · storage-and-compute.tfBudgets Optional DNS sync function; detailed in the separate release flow. · dns-sync.tf · disabled by defaultLambda · DNS ECS task state events trigger DNS sync. · dns-sync.tf · disabled by defaultEventBridge Dashed border = optional resource IaC files are named in each hover.
AWS Cloud

Region · us-east-1

VPC · 10.0.0.0/16

Internet Gateway · public route · ECS security group

Public subnets · 2 AZ

Fargate API tasks · public IP

Private subnets · 2 AZ

Optional RDS subnet group · Supabase is the app default

Regional services · outside the VPC

ECS clusterECRS3Secrets ManagerSQSSNSTextract API · externalCloudWatchIAM / OIDCEventBridgeLambda DNS · optionalCognito client · optionalBudgets
Hover or focus a service for a short purpose, IaC source and connection.

Push, deploy and DNS update

GitHub Actions deployment and Cloudflare DNS flow A push to main deploys an image to ECS. A later RUNNING task event invokes an optional Lambda that updates the Cloudflare A record. Push to main (or manual run) · deploy workflow: .github/workflows/deploy.yml Push to main starts security, environment validation and deployment. · deploy.yml GitHub Actions push: main · workflow_dispatch Security + environment checks GitHub exchanges its OIDC token for the scoped AWS deploy role. · github-and-outputs.tf AWS OIDC Assume deploy role No static AWS keys Docker image is built and pushed with the commit SHA tag. · deploy.yml · ECR Build + push ECR · image tag = commit SHA ECR scan on push Workflow renders/registers the task definition and creates or updates the Fargate service. · deploy.yml Deploy to ECS Register task · update service Wait for service stability ECS task reaches RUNNING EventBridge watches RUNNING Fargate task events for the configured ECS cluster. · dns-sync.tf · optional EventBridge rule RUNNING · FARGATE Invokes DNS Lambda Finds the newest running task, resolves its public IP, then compares and updates the Cloudflare record. · dns-sync.tf + infra/dns-sync/main.go · optional DNS sync Lambda ECS + ENI lookup → public IP Reads Cloudflare config from Secrets Manager Updates the configured Cloudflare A record when the task public IP changes. Record name and IDs come from the bflow/cloudflare-dns secret. Cloudflare DNS A record · bflow-studio.com Record IP ← active task Optional · disabled by default · config: bflow/cloudflare-dns Set CLOUDFLARE_DNS_RECORD_NAME in the secret; Cloudflare stores the A record and Lambda updates its IP. Lambda calls ECS and network-interface APIs; no EC2 instance runs.

Budget choice: Cloudflare provides free DNS record management, so the task IP is published directly without an Application Load Balancer (ALB).

1
GitHub logo
GitHub Actions

Push to main · validate · deploy workflow

2AWS OIDC

Assume scoped deploy role without stored AWS keys

3ECR → ECS

Push image, register task definition, update Fargate service

4RUNNING event

EventBridge invokes the optional DNS Lambda

5DNS Lambda

Reads ECS task ENI and gets its public IP using AWS APIs

Cloudflare logo
Cloudflare DNS

Updates the existing A record for bflow-studio.com

DNS sync runs from the ECS task-state event after deployment; it is not a direct GitHub step.

Receipt OCR · S3 + Textract

Asynchronous flow used when the app processes receipt images and extracts expense fields.

1API uploads receipt

ECS stores the original file in the private S3 bucket.

storage-and-compute.tf · S3StorageService
2Queue OCR request

The app sends the receipt ID to the encrypted SQS requests queue.

iam-and-messaging.tf
3ECS starts analysis

A worker reads the S3 object key and starts asynchronous expense analysis.

iam-and-messaging.tf · ECS task role
4Amazon Textract

AnalyzeExpense reads the object from S3; this is an AWS API integration, not a Terraform resource.

not provisioned in Terraform
5Completion notification

Textract publishes to SNS, which delivers the notification to the SQS results queue.

iam-and-messaging.tf
6ECS saves extraction

The results worker fetches fields from Textract and updates receipt status for review.

iam-and-messaging.tf · application
Dead-letter queues handle messages that exceed retry limits. Textract uses the SNS publish role declared in Terraform.