Zero-Trust Network Topology & Subdomain Mapping

1. Zero-Trust Network Topology

The GERCIA ecosystem operates under a Zero-Trust Network Architecture. No public ports are opened directly on bare metal servers. All external ingress is routed through encrypted Cloudflare Tunnels (cloudflared).

graph TD
    subgraph Public_Internet [External Internet & Cloudflare Pro Ingress]
        USER_PUB["Public Users & Patients"]
        USER_B2B["B2B Clients (Doctors & Pharmacies)"]
        STAFF["GERCIA Staff (WARP / Zero Trust)"]
    end

    subgraph Cloudflare_Edge [Cloudflare Edge & WAF Layer]
        CF_WAF["Cloudflare WAF (DDoS Mitigation & Pro Rules)"]
        CF_ACCESS["Cloudflare Access (Zero Trust Policy)"]
        CF_TUNNEL["Cloudflare Tunnel (cloudflared daemon)"]
    end

    subgraph EVEO_Server [EVEO Bare Metal Infrastructure]
        subgraph Docker_Bridge [Docker Private Networks]
            WEB_CONT["Gercia.Web (Blazor Host)"]
            API_CONT["Gercia.Api (Gateway & OpenIddict)"]
            WORKER_CONT["Gercia.Worker (Daemon)"]
            DB_CONT["Percona PostgreSQL (gercia)"]
        end
    end

    USER_PUB -->|gercia.com.br, docs.gercia.com.br| CF_WAF
    USER_B2B -->|app.gercia.com.br, api.gercia.com.br| CF_WAF
    STAFF -->|ops.gercia.com.br, eng.gercia.com.br| CF_ACCESS

    CF_WAF --> CF_TUNNEL
    CF_ACCESS --> CF_TUNNEL

    CF_TUNNEL --> WEB_CONT
    CF_TUNNEL --> API_CONT
    WEB_CONT --> DB_CONT
    API_CONT --> DB_CONT
    WORKER_CONT --> DB_CONT

---

2. Official Subdomain Mapping & Access Topology

Subdomain	Target Application / Service	Technology Stack	Access Audience & Security Policy
gercia.com.br	Public Institutional Website	Astro	Public Internet (Cloudflare Pages)
app.gercia.com.br	B2B Multi-Tenant SaaS Portal	Blazor Server / WASM (Gercia.Web)	Clinics, Doctors, Pharmacies (OpenIddict Local / Enterprise SSO)
ops.gercia.com.br	Operations & Platform Backoffice	Blazor (Gercia.Web)	GERCIA Staff Only (Auto-Redirect Google Workspace hd=gercia.com.br + Cloudflare Access)
docs.gercia.com.br	Public Help Center & User Manuals	Astro Starlight (docs/public/)	Public Internet, Doctors, Patients (Cloudflare Pages)
eng.gercia.com.br	Internal Engineering & Architecture Portal	Astro Starlight (docs/private/)	GERCIA Engineering Only (Cloudflare Zero Trust WARP / Google SSO)
api.gercia.com.br	Central REST API Gateway & Sovereign STS	ASP.NET Core 10 (Gercia.Api)	Mobile Apps, Web Frontends, Third-Party Integrations

---

3. Docker Network Segregation

The monorepo enforces physical Docker network isolation between staging and production environments:

• Staging (Homologation):
  • gercia-svc-stg: Services network for staging API, Web, Worker, and McP containers.
  • gercia-db-stg: Isolated database network connecting exclusively to the staging Percona PostgreSQL cluster.
• Production (Main):
  • gercia-svc-prd: Services network for production container workloads.
  • gercia-db-prd: Isolated database network with restricted mTLS certificate validation.

---

4. Hardware Edge vs. Mobile Connection Security

• Hardware Edges (Gercia.Edge): Authenticated using Secure Station Tokens (X-Edge-Token) over TLS 1.3, routed through Cloudflare Tunnels into persistent duplex SignalR hubs (/hubs/scale, /hubs/print).
• Mobile Clients (Gercia.Health.Mobile): Authenticated using JWT (Access Token 15 min + Refresh Token Rotation 30 days) stored in hardware-backed SecureStorage (iOS Keychain / Android Keystore) combined with SSL Pinning to prevent Man-in-the-Middle (MitM) attacks.