Azure Architecture

flowchart TB
  user([Investor Browser]):::ext
  admin([Admin User]):::ext
  fd{{Front Door - WAF - TLS 1.2}}:::edge

  subgraph RG[Resource Group gmiapp-prod - Central US]
    direction TB
    subgraph VNET[Virtual Network - NSGs]
      cw[Client Web<br/>Blazor WASM]:::app
      aw[Admin Web<br/>Blazor]:::app
      api[API<br/>Azure Functions]:::app
      vm[Report VM<br/>Linux - Managed Identity]:::vm
    end
    kv[(Key Vault<br/>soft-delete 90d)]:::sec
    db[(MySQL Flexible<br/>35-day PITR backup)]:::data
    blob[(Blob Storage<br/>ZRS - reports-prod)]:::data
  end

  subgraph EXT[External Services]
    ext[Stripe - SendGrid - Twilio<br/>FMP - Anthropic Claude]:::ext2
  end

  user --> fd
  admin --> fd
  fd --> cw
  fd --> aw
  fd --> api
  cw --> api
  aw --> api
  api --> db
  api --> blob
  api --> kv
  api --> ext
  vm --> db
  vm --> blob
  vm --> kv
  vm --> ext

  classDef ext fill:#1b1f27,stroke:#5A616B,color:#C4C0B8;
  classDef ext2 fill:#181b22,stroke:#5A616B,color:#C4C0B8;
  classDef edge fill:#2a2018,stroke:#C0894E,color:#F3EFE8;
  classDef app fill:#1f2630,stroke:#C0894E,color:#F3EFE8;
  classDef vm fill:#241c14,stroke:#E2B583,color:#F3EFE8;
  classDef sec fill:#1d2733,stroke:#5cc8e0,color:#eafaff;
  classDef data fill:#22201a,stroke:#C0894E,color:#EBD3AE;