🚗 crAPI Architecture

⚠️ Intentionally Vulnerable Application — OWASP API Security Top 10 Demo
ℹ️ crAPI uses direct NodePort routing (no NGINX Gateway Fabric in path). NGF is used by Online Boutique & Travel Assistant on this cluster.
User
💬 Browser
crapi-cmiller.amer-ent.f5demos.com
HTTPS
F5 Distributed Cloud · Regional Edge (PoP)
☁️ XC Load Balancer
https-lb-cmiller-crapi
WAF · TLS · DDoS · API Discovery
Encrypted tunnel → Customer Edge
F5 Distributed Cloud · Customer Edge
🏢 XC CE — sms-cmiller-vmware
192.168.1.226 · outside_network
On-premises gateway
HTTP → 192.168.1.187:31136 (NodePort direct)
OpenShift · crapi ns
🔀 nginx-inject sidecar :8090
Serves /diagram · proxies all other traffic → crapi-web :80
React SPA — car API, user mgmt, community
Native chatbot widget
OpenShift · crapi ns
🤖 crapi-chatbot :5002
LangGraph ReAct Agent · FastAPI · Python
MCP tools · RAG · Multi-turn conversation
Chat completions
OpenShift · ai-demo ns
🛡️ calypso-shim :8000
/v1/chat/completions
Content scanning proxy
Scanned request
External SaaS
🔍 CalypsoAI
cmiller-ollama project
Semantic scanning · Red-team detection
Scanned request
Docker · 192.168.1.212
🦙 Ollama
qwen2.5-coder:latest
LLM inference
Embeddings (direct, no scan)
OpenShift · ai-demo ns
📐 calypso-shim :8000
/v1/embeddings → Ollama /api/embed
Bypass scan for embeddings
Tools / RAG
OpenShift · crapi ns (sidecar)
🔧 MCP Server :5500
crAPI OpenAPI spec as MCP tools
search_vehicles · get_community_posts · etc.
Vector search
OpenShift · crapi ns
🗃️ ChromaDB :8000
RAG knowledge base
crAPI docs · API context
OpenShift · nginx-gateway-fabric ns (cluster-wide)
🔵 NGINX Gateway Fabric
Routes Online Boutique & Travel Assistant — not in crAPI path
Also on this cluster · NGINX Plus mode
F5 XC RE (PoP)
F5 XC CE (on-prem)
OpenShift
CalypsoAI
Ollama
ChromaDB (RAG)
MCP Server
NGINX GF (not in path)