%%{init: {"theme": "base", "flowchart": {"wrappingWidth": 400}, "themeVariables": {"primaryColor": "#161b22", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#30363d", "lineColor": "#8b949e", "clusterBkg": "#0d1117", "clusterBorder": "#30363d", "titleColor": "#e6edf3", "edgeLabelBackground": "#161b22", "tertiaryColor": "#0d1117"}}}%%
flowchart TB
    subgraph PLAN["🧭 1 · PLAN & CODE"]
        direction LR
        BACKLOG["📋 Backlog<br/>issues · incidents · tech debt"] --> CODE["💻 App code + IaC<br/>Dockerfile · Terraform · Ansible"] --> PR["🔀 Pull request<br/>review · branch protection"]
    end

    subgraph CI["⚙️ 2 · BUILD & TEST"]
        direction LR
        BUILD["🏗️ Build<br/>Jenkins · GitHub Actions"] --> TEST["🧪 Tests<br/>unit · integration"] --> SCAN["🔍 SonarQube<br/>quality gate"] --> IMAGE["📦 OCI image<br/>tagged with git SHA"] --> REG[("🗄️ Zot<br/>private registry")]
    end

    subgraph REL["🧱 3 · PROVISION"]
        direction LR
        TF["🧱 Terraform apply<br/>Proxmox · Incus · EC2"] --> ANS["🔧 Ansible<br/>harden · users · Docker"] --> DEPLOY["🚢 Deploy job<br/>compose pull + up<br/>secrets from OpenBao"]
    end

    subgraph RUN["🚀 4 · PRODUCTION"]
        direction LR
        USERS(["🌍 Users"]) --> CF["☁️ Cloudflare<br/>DNS · WAF · CDN"] --> CADDY["🔒 Caddy<br/>reverse proxy · auto-TLS"]
        CADDY --> APP1["🖥️ App host 1<br/>Docker Compose"]
        CADDY --> APP2["🖥️ App host 2<br/>Docker Compose"]
        APP1 --> DB[("🐘 Database")]
        APP2 --> DB
    end

    subgraph OBS["🔭 5 · OBSERVE"]
        direction LR
        METRICS["📈 VictoriaMetrics<br/>metrics"] --> GRAFANA["📊 Grafana<br/>dashboards · alert rules"]
        LOGS["📜 VictoriaLogs<br/>central logs"] --> GRAFANA
        GATUS["✅ Gatus<br/>uptime · SSL expiry"]
    end

    subgraph PROTECT["🛡️ 6 · PROTECT"]
        direction LR
        BACKUP["💾 Portabase<br/>DB backups"] --> OFFSITE[("☁️ Off-site S3<br/>Garage")] --> DRILL["♻️ Restore drill<br/>prove backups work"]
        HC["⏰ Healthchecks<br/>missed-backup alarm"]
    end

    subgraph RESPOND["🚨 7 · ALERT & RESPOND"]
        direction LR
        APPRISE["📣 Apprise API"] --> CHANNELS["📱 ntfy · Slack · Email"] --> ONCALL["🧑‍🚒 On-call DevOps"] --> RUNBOOK["📖 Runbook<br/>rollback · scale · fix"] --> PM["📝 Blameless<br/>post-mortem"] --> LOOP(["🔁 New backlog issues<br/>back to step 1"])
    end

    subgraph ACCESS["🔐 ADMIN ACCESS"]
        direction LR
        LAPTOP["💻 Admin laptop"] -. WireGuard .-> VPN["🕸️ NetBird<br/>zero-trust overlay"]
    end

    PLAN ==>|merge to main| CI
    CI ==>|image pushed to Zot| REL
    REL ==>|rolling deploy| RUN
    RUN -->|metrics · logs · probes| OBS
    RUN -->|nightly backups| PROTECT
    OBS -->|alert fires| RESPOND
    PROTECT -->|backup missed| RESPOND
    ACCESS -.->|SSH · dashboards · DB| RUN

    classDef plan stroke:#a371f7,stroke-width:2px
    classDef ci stroke:#58a6ff,stroke-width:2px
    classDef rel stroke:#d29922,stroke-width:2px
    classDef run stroke:#3fb950,stroke-width:2px
    classDef obs stroke:#39c5cf,stroke-width:2px
    classDef prot stroke:#f778ba,stroke-width:2px
    classDef resp stroke:#f85149,stroke-width:2px
    classDef acc stroke:#8b949e,stroke-width:2px
    class BACKLOG,CODE,PR plan
    class BUILD,TEST,SCAN,IMAGE,REG ci
    class TF,ANS,DEPLOY rel
    class USERS,CF,CADDY,APP1,APP2,DB run
    class METRICS,LOGS,GRAFANA,GATUS obs
    class BACKUP,OFFSITE,DRILL,HC prot
    class APPRISE,CHANNELS,ONCALL,RUNBOOK,PM,LOOP resp
    class LAPTOP,VPN acc
    style PLAN stroke:#a371f7,stroke-width:2px
    style CI stroke:#58a6ff,stroke-width:2px
    style REL stroke:#d29922,stroke-width:2px
    style RUN stroke:#3fb950,stroke-width:2px
    style OBS stroke:#39c5cf,stroke-width:2px
    style PROTECT stroke:#f778ba,stroke-width:2px
    style RESPOND stroke:#f85149,stroke-width:2px
    style ACCESS stroke:#8b949e,stroke-width:2px