Skip to content

Production — account 704081087743

Region: ap-southeast-2.

Traffic flow

%%{init: {'flowchart': {'nodeSpacing': 70, 'rankSpacing': 110, 'padding': 20, 'curve': 'basis'}}}%%
flowchart TB
    Internet((Public Internet))

    subgraph DNS["Route 53 — prod account"]
        direction TB
        AC["arep.co apex<br/>Failover: PRIMARY → gateway1,<br/>SECONDARY → gateway2"]
        ACC["arep.cc apex<br/>Weighted: 200 → gateway2,<br/>0 → 52.64.21.46 (unassociated EIP)"]
        AI["arep.ink apex<br/>Simple A → gateway2"]
        AT["automated.arep.co<br/>Weighted, only entry → 52.64.21.46<br/>currently resolves to a dead address"]
        APP["app.audiencerepublic.com"]
        MGR["m.arep.co/&lt;id&gt;"]
        PORTAL["&lt;promoter&gt;.portal.arep.co"]
        SDK["sdk-cdn.arep.co/prod/..."]
    end

    subgraph NGINX["nginx — EC2, VPC 10.0.0.0/16"]
        direction TB
        GW1["gateway1 — 52.62.81.96"]
        GW2["gateway2 — 54.252.142.125"]
    end

    subgraph BACKEND["C2 application backends — same VPC"]
        direction TB
        CN["campaign-1 / 2 / 3<br/>(C2 app servers, port 4350)"]
        AM["audience-manager-1 / 2<br/>(AM2 API, port 4360)"]
        COL["collector-1<br/>(tracking/collector, port 8000)"]
    end

    subgraph NETLIFY["Netlify"]
        NF["app-2.netlify.com"]
    end

    subgraph CF["CloudFront + S3"]
        CFN["Notification Manager distribution"]
        CFS["Widget SDK distribution"]
    end

    Internet --> AC & ACC & AI & AT & APP & MGR & PORTAL & SDK
    AC -->|primary| GW1
    AC -.->|failover| GW2
    ACC -->|weight 200| GW2
    AI --> GW2
    APP --> NF
    MGR --> CFN
    SDK --> CFS
    PORTAL --> GW1

    GW1 --> CN & AM & COL
    GW2 --> CN & AM & COL

Hostnames

Hostname App Routing Current target
arep.co C2 Route 53 Failover policy Primary: gateway1 (52.62.81.96). Secondary: gateway2 (54.252.142.125)
arep.cc C2 (alt domain) Route 53 Weighted policy Weight 200: gateway2. Weight 0 entry points at 52.64.21.46, an unassociated Elastic IP, not a live fallback target
arep.ink C2 (shortlinks) Simple A record gateway2
automated.arep.co C2 (automated/QA testing surface) Route 53 Weighted policy, single entry 52.64.21.46 — this address currently has nothing behind it, the hostname does not resolve to a working service
app.audiencerepublic.com AM2 CNAME Netlify (app-2.netlify.com)
m.arep.co/<id> Notification Manager CNAME CloudFront
<promoter>.portal.arep.co Privacy Portal Wildcard A gateway1 (52.62.81.96) — real, active backend confirmed live, but its TLS cert expired 2026-07-29; real clients get a hard TLS error today
sdk-cdn.arep.co/prod/... Widget SDK CNAME CloudFront

Compute

nginx gateways (vpc-3dd4bc58, 10.0.0.0/16) terminate TLS and reverse-proxy for C2 and the Privacy Portal:

Host Public address Role
gateway1 52.62.81.96 (Elastic IP) Primary for arep.co, serves <promoter>.portal.arep.co
gateway2 54.252.142.125 (no EIP, address not fixed across a stop/start) Primary for arep.cc/arep.ink, failover for arep.co

Backend application servers, reached from the gateways over the internal private.a DNS zone:

Instance Role
campaign-1, campaign-2, campaign-3 C2 application servers, port 4350
audience-manager-1, audience-manager-2 AM2 API backend, port 4360
collector-1 Tracking/collector service, port 8000
automated-testing Backs automated.arep.co when the hostname is pointed at it; currently stopped
deferred-collector-work-1..4 Running; specific role not yet documented
deferred-work-1..5 Running; specific role not yet documented
campaign-1, campaign-2 (again, port 5000) Backs arep.co's /api/v1/mn/ (monitor-backend) in nginx — actively routed (not commented out, contrary to an earlier assumption), but confirmed dead: a live check from inside the VPC gets Connection refused on port 5000 on both hosts. Nothing is listening.

Static files still served from gateway disk, not S3/CloudFront: arep.co/zoomverify/ is confirmed live and unmigrated — the file's Last-Modified is 2021-06-16 with Accept-Ranges/ETag headers, a genuine static file response straight from nginx, not a CloudFront/S3 one. This was planned as an AR-internal prerequisite ahead of the ALB cutover; it hasn't happened yet.

Internal DNS

private.a, private.b, private.c are private Route 53 hosted zones providing internal service discovery inside the VPC, used by EC2, RDS, and ElastiCache resources alike. A backend's internal hostname (e.g. campaign-1.private.a) and its EC2 Name tag are two independent labels for the same instance, they are not guaranteed to match, and in this account frequently don't.