Adrian Olias
· DevOps Engineer
GitHub
LinkedIn
ES
Architecture Diagram
Architecture of a self-hosted AI platform, provisioned with Terraform.
Architecture Diagram
GitHub Actions pushes images to the container registry with OIDC. A GPU VM with no public IP pulls them with its managed identity and reaches Storage and Key Vault only through private endpoints. Users come in through a Cloudflare tunnel that the VM opens outbound; nothing can connect in.
Azure
spaincentral · rg-privateai-lab
vnet-privateai-lab
10.1.0.0/16
snet-compute
10.1.1.0/24
NSG · deny all inbound
snet-endpoints
10.1.2.0/24
NSG · 443 from compute only
GPU VM
10.1.1.10
· NVIDIA T4
managed identity
Docker stack · runner
Private endpoint
blob
Private endpoint
vault
VNet link
Storage Account
public off · keys off
Blob Data Reader
Key Vault
public off · RBAC only
Secrets User
Private DNS zones
privatelink · blob, vault
OIDC · AcrPush
AcrPull
runner · outbound
GitHub Actions
build · 3 images
Container Registry
Basic · admin user off
outbound tunnel
HTTPS
Cloudflare
tunnel edge
Browser
no public IP · no inbound
Back to home