direction: down

internet: "Internet"
opnsense: "OPNsense\nfirewall, routeur, Tailscale" { class: accent }
admin: "Nœud Proxmox (admin)" {
  authentik: "Authentik\nOIDC, SSO"
  secrets: "OpenBao\nsecrets dynamiques"
  pki: "OpenBao PKI\ncertificats internes"
}
cluster: "Cluster (workloads)" {
  apps: "Applications"
  services: "Services applicatifs"
  ingress: "Ingress"
}
internet -> opnsense: "HTTPS" { class: principal }
opnsense -> admin: "LAN admin"
opnsense -> cluster: "LAN workloads"
cluster -> admin: "consomme : identité OIDC,\nsecrets, certificats" { class: indirect }