The Microservices Core
The system isolates workloads into dedicated services. A central Proxy Gateway handles rigorous authentication before routing traffic to specific functional nodes, ensuring stability and infinite scalability.
📱 Edge Layer
User-facing interfaces built on Next.js, segmented by subdomain for strict access control.
- ▪ app.domain.com (Citizens)
- ▪ rescue.domain.com (Responders)
- ▪ admin.domain.com (Command)
🚦 Gateway Layer
ElysiaJS acting as the central proxy. It decrypts AES tokens, verifies Ed25519 signatures, and drops malicious traffic.
Verify: Asymmetric(EdDSA)
Decrypt: AES-256-GCM
Forward -> Internal Network
🧠 Worker Layer
Internal services connected via RabbitMQ, ensuring zero dropped requests during peak accident spikes.
Infrastructure Workload Allocation Strategy
Shows the theoretical CPU/Memory allocation percentages across the core microservices to handle high-concurrency emergency events.
The Lifecycle of an Incident Report
When an emergency occurs, speed is critical. Our event-driven pipeline utilizes asynchronous message queues (RabbitMQ) to ensure users aren't left waiting while heavy AI analysis takes place.
1. Submission
User submits GPS location and images via Next.js. The Proxy validates the auth token.
2. Image Storage
Reporting Service securely uploads media to Self-hosted MinIO and creates initial MongoDB metadata.
3. Message Queuing
A message `incident_analyze` is injected into RabbitMQ. The HTTP response is returned to the user instantly.
4. AI Analysis
The AI Worker consumes the queue, calls OpenRouter (GPT-4o), processes the image, and determines severity.
5. Dispatch & Notify
WebSocket Service broadcasts the AI findings to the Rescue App and sends a confirmation request back to the User.
Military-Grade Security Matrix
Standard JWTs expose payload data. Our platform implements dual-layer token cryptography alongside field-level database encryption to ensure absolute data sovereignty.
Composition of active cryptographic defenses securing the reporting pipeline.
1. Token Encryption (AES-256-GCM)
Unlike Base64 JWTs, session tokens are encrypted symmetrically. Even if intercepted, the user IDs and role payloads remain unreadable.
2. Token Signature (Ed25519)
An asymmetric key pair signs the encrypted payload. The ElysiaJS Proxy verifies the public key instantly, mathematically proving the token's origin.
3. Data at Rest (Field-Level)
Personally Identifiable Information (PII) like phone numbers in MongoDB are encrypted via AES before storage. MinIO images require strict Pre-signed URLs.
Scalability & Latency Projections
Replacing Node.js with Bun allows ElysiaJS to handle significantly higher throughput. Below is the projected system latency under increasing concurrent emergency reports.