Telemetry architecture

@@ -22,15 +22,15 @@ This article describes the architecture as of the initial deployment. The routin
## Key Takeaways

- Telemetry routes through four tiers: edge capture → WireGuard encrypted transit → local processing node → control workstation pull. No payload passes through a third-party cloud aggregation service at any step.
- All traffic is written to a single shared ledger on the local processing node (`assets/ledger_telemetry.csv`) — there is no per-tenant ledger separation today.
- The control workstation pulls only compiled Markdown reports from the processing node's `outbox/` directory over rsync — not the raw CSV ledger, which stays on the processing node. This limits the blast radius of a workstation compromise to summary data, not the full traffic record.
- All traffic is written to a single shared CSV ledger file on the local processing node — there is no per-tenant ledger separation today.
- The control workstation pulls only compiled Markdown reports from a dedicated output directory on the processing node over rsync — not the raw CSV ledger, which stays on the processing node. This limits the blast radius of a workstation compromise to summary data, not the full traffic record.
- Local-first telemetry is a precondition of the tenancy isolation model and the [[customer-hostability|customer-rooted data custody]] property. The operator holds full custody of traffic analytics; no third party holds or processes the raw data.

## Four-tier routing path

### Tier 1 — Edge capture

Live Nginx relays on the cloud edge nodes capture JSON payloads from organic web traffic and route them to the local network over designated ports: `10.50.0.2:8081` for the PointSav tenant and `10.50.0.2:8082` for the Woodfine tenant. The relays do not inspect or buffer payloads; they forward them directly to the tunnel endpoint.
Live Nginx relays on the cloud edge nodes capture JSON payloads from organic web traffic and route them to the local network over a dedicated port assigned per tenant. The relays do not inspect or buffer payloads; they forward them directly to the tunnel endpoint.

### Tier 2 — Encrypted transit

@@ -38,7 +38,7 @@ Payloads traverse a WireGuard mesh (`wg0`) between the cloud edge and the local 

### Tier 3 — Local processing

A Rust telemetry daemon running on the local processing node binds to all interfaces, receives the decrypted payloads, and appends them to a single shared CSV ledger. A separate reporting binary reads that ledger, consults a local GeoLite2 City database to resolve each recorded IP address to a geographic region, and writes a structured Markdown report to the outbox directory.
A Rust telemetry daemon running on the local processing node binds to all interfaces, receives the decrypted payloads, and appends them to a single shared CSV ledger. A separate reporting binary reads that ledger, consults a local GeoLite2 City database to resolve each recorded IP address to a geographic region, and writes a structured Markdown report to a dedicated output directory.

### Tier 4 — Analysis extraction