🚀 SPY Options Trading - Hybrid Cloud Architecture

Infrastructure as Code with Terraform | Azure Cloud + On-Premises Edge Infrastructure

⚡ TERRAFORM - Infrastructure as Code Layer
📁 Terraform Modules
• networking/ (VPN, NSG, VNet)
• app-service/ (Backend API)
• static-web/ (Dashboard)
• signalr/ (Real-time messaging)
• monitoring/ (App Insights)
• acr/ (Container Registry)
• container-instances/ (Optional)
HCL, Azure Provider
🔄 CI/CD Pipeline
• GitHub Actions workflow
• Terraform plan on PR
• Auto-apply on merge to main
• Remote state in Azure Storage
• Automated rollback
GitHub Actions, Azure Backend
🌍 Multi-Environment
• Dev environment (low-cost)
• Prod environment (HA)
• Environment-specific variables
• Identical infrastructure
• Parallel deployment
Workspaces, tfvars
🔐 Secrets Management
• Azure Key Vault integration
• Rotatable IBKR API keys
• VPN pre-shared keys
• Connection strings
• GitHub Secrets
Key Vault, GitHub Secrets
🐳 CONTAINER & ORCHESTRATION LAYER
🐋 Docker Images
• spy-backend:v1.2 (Backend API)
• spy-trading-bot:v1.2 (Trading engine)
• spy-detector:v1.0 (Anomaly detection)
• ibkr-gateway:stable (TWS headless)
• fluentd:v1.16 (Log forwarder)
Multi-stage Dockerfiles | Alpine base
☸️ Kubernetes Resources
• Deployments: 3 replicas per service
• Services: ClusterIP + LoadBalancer
• StatefulSets: For IBKR gateway
• DaemonSets: For monitoring agents
• CronJobs: Daily cleanup tasks
kubectl | K8s API v1.28
🎛️ Container Orchestration
• Auto-scaling: HPA based on CPU/Memory
• Self-healing: Restart on failure
• Rolling updates: Zero downtime
• Resource quotas: Per namespace
• Network policies: Pod isolation
K8s Controllers | HPA | Network Policies
🔄 CI/CD for Containers
• Build: Docker build on PR merge
• Test: Container security scanning
• Push: Tag & push to ACR
• Deploy: Helm upgrade via GitHub Actions
• Rollback: Automatic on failure
GitHub Actions | Docker | Helm
📦 Container Deployment Flow:
1️⃣ Code Push: Developer pushes to GitHub main branch
2️⃣ CI Trigger: GitHub Actions workflow starts automatically
3️⃣ Build: Docker multi-stage build creates optimized images
4️⃣ Scan: Security vulnerability scanning (Trivy/Snyk)
5️⃣ Push: Tagged images pushed to Azure Container Registry
6️⃣ Deploy: Helm chart upgrade on edge K8s cluster
7️⃣ Rollout: Rolling update with zero downtime (3 replicas)
8️⃣ Verify: Health checks validate deployment success
9️⃣ Monitor: Prometheus collects metrics from new pods
☁️ AZURE CLOUD ~$53/mo TF managed
🌐 VPN Gateway
Site-to-Site VPN to On-Premises Edge
IPsec encrypted tunnel
Static routing configured
azurerm_virtual_network_gateway
Bidirectional | Latency: ~15-30ms
🐳 Azure Container Registry (ACR)
Private Docker image repository
Multi-architecture support (amd64/arm64)
Geo-replication enabled
Automated vulnerability scanning
azurerm_container_registry
Push/Pull: CI/CD + Edge K8s cluster
📦 Container Instances (Optional)
Serverless container deployment
Backend API containers
Auto-scaling based on load
Pay-per-second billing
azurerm_container_group
🔒 Network Security Group
Dynamic firewall rule management
Whitelist on-premises public IP
Connection audit logging enabled
DDoS protection tier integrated
azurerm_network_security_group
⚙️ App Service (Backend API)
Python Flask/FastAPI REST API
IBKR TWS API integration layer
Real-time strike data processing
Anomaly detection algorithms
azurerm_linux_web_app | Python 3.11
Publishes signals → SignalR Hub
📡 SignalR Service
Real-time WebSocket infrastructure
Alert broadcast to edge subscribers
Persistent connection management
Auto-scaling enabled
azurerm_signalr_service
Stream → On-Premises Trading Engine
🌐 Static Web App (Dashboard)
HTML5 Canvas + JavaScript SPA
Public-facing analytics dashboard
Azure CDN global distribution
SSL/TLS encryption enabled
azurerm_static_site
📊 Application Insights
Distributed tracing across hybrid infrastructure
Edge telemetry aggregation
Automated alert rules configured
Custom KPI dashboards
azurerm_application_insights
Ingests telemetry from edge nodes
💾 Table Storage
Anomaly event history retention
Trade execution audit log
Daily metrics aggregation
azurerm_storage_account
🔑 Key Vault
IBKR API credentials
VPN pre-shared key
Connection strings
Automated key rotation
azurerm_key_vault
🔐 VPN S2S
IPsec Tunnel
IKEv2 Protocol
⟷
Latency: 15-30ms RTT
Throughput: 100Mbps
Route Tables:
10.0.0.0/16 (Azure VNet) ↔ 192.168.1.0/24 (On-Prem)
Ports: UDP 500, 4500 (IKEv2/IPsec)
Data Flow Architecture
🟢 Azure → Edge: Trading signals (WebSocket)
🔴 Edge → Azure: Telemetry + metrics
🟡 Bidirectional: Keepalive heartbeat
🖥️ ON-PREMISES EDGE INFRASTRUCTURE $5/mo OpEx
🛡️ Edge Gateway / Firewall
VPN client endpoint configured
NAT traversal enabled
Port forwarding for VPN ingress
DDoS protection at edge
pfSense / Enterprise Firewall
☸️ Kubernetes Cluster (minikube/k3s)
Single-node K8s cluster on edge
3 namespaces: trading-bots, monitoring, system
Persistent volume provisioning
LoadBalancer via MetalLB
Kubernetes v1.28+ | Docker runtime
Pulls images from ACR
🎩 Helm Charts & Releases
Chart: spy-trading-bot (v1.2.0)
Values: dev.yaml / prod.yaml
Release management with rollback
Templated configurations
Helm 3 | Chart versioning
🐳 Trading Bot Pods (Deployment)
Replicas: 3 (High Availability)
Image: acr.azurecr.io/spy-bot:v1.2
Resource limits: 512Mi RAM, 500m CPU
Rolling update strategy
Pod: spy-trading-bot | Python 3.11
Ingests: Real-time anomaly signals
🔍 Liveness & Readiness Probes
HTTP health checks every 10s
Auto-restart on failure
Graceful shutdown (30s timeout)
Zero-downtime deployments
K8s Health Checks
📈 IBKR TWS Gateway (Containerized)
Docker image: ibkr-gateway:stable
StatefulSet for persistent connection
Paper trading account endpoint
Ultra-low latency local processing
K8s StatefulSet | TWS API 9.81+
Executes orders on IBKR infrastructure
⚙️ ConfigMaps & Secrets
ConfigMap: Trading strategies, bot config
Secrets: IBKR credentials, Azure keys
Environment-specific configurations
Hot-reload without pod restart
K8s ConfigMaps & Secrets
💾 Persistent Volumes
PV: 10GB for SQLite database
PV: 5GB for trade logs
PV: 2GB for cache
Local storage class provisioner
K8s PV/PVC | Local storage
📊 Monitoring Stack (Namespace: monitoring)
Prometheus for metrics collection
Grafana dashboards (K8s + Trading)
AlertManager for notifications
Node Exporter for host metrics
Prometheus + Grafana + AlertManager
📝 Telemetry Agent
Forwards logs to Azure Monitor
Performance metrics collection
Connection health monitoring
Local alerting system
Azure Monitor Agent / Fluentd
Telemetry → Application Insights
💾 Edge Data Store
Local signal cache and backup
Trade execution history
Strategy configuration cache
Failover data persistence
SQLite3 / Redis
🔔 Watchdog Service
VPN connection health monitoring
Auto-restart on trading engine failure
Health checks every 30s
Email/Telegram alert integration
systemd / Windows Service Manager
🌍 EXTERNAL SERVICE INTEGRATIONS
📊 Interactive Brokers API
Real-time market data feed
Order execution gateway
Paper trading sandbox environment
TWS API integration
IBKR TWS API | $4.50/mo data subscription
🐙 GitHub Enterprise
Source code repository
Terraform state versioning
CI/CD pipeline automation
Security vulnerability scanning
GitHub Actions | Free tier
📧 Email Gateway
Alert notification delivery
Trade execution confirmations
System health reports
SLA monitoring alerts
SendGrid API | Free tier (100/day)
📱 Telegram Bot API (Optional)
Mobile push notifications
Trade execution alerts
Remote command interface
Real-time status queries
Telegram Bot API | Free
Azure Cloud Resources
Containers & Orchestration
On-Premises Edge Infrastructure
Terraform Managed (IaC)
Site-to-Site VPN
Data Flow / Telemetry

💰 MONTHLY OPERATING COST BREAKDOWN

Azure Cloud
VPN Gateway: $27
App Service B1: $13
Static Web App: $0
SignalR Free: $0
Storage: $1
App Insights: $5
Container Registry (Basic): $5
Bandwidth: $2
TOTAL AZURE: ~$53/mo
On-Premises Infrastructure
Compute node: $0 (existing asset)
Power consumption: ~$5
Network connectivity: $0 (existing)
Software licenses: $0 (OSS stack)
TOTAL ON-PREMISES: ~$5/mo OpEx
External Services
IBKR Market Data: $4.50
GitHub: $0 (free tier)
SendGrid: $0 (free tier)
Telegram: $0
TOTAL EXTERNAL SERVICES: ~$4.50/mo
💵 TOTAL MONTHLY OPERATING COST: ~$62.50
Enterprise-grade hybrid cloud infrastructure with container orchestration | Fully scalable | 99.9% SLA uptime

🛠️ COMPLETE TECHNOLOGY STACK

Infrastructure as Code
• Terraform 1.6+
• Azure Provider
• GitHub Actions
• Git version control
Containers & Orchestration
• Docker 24+
• Kubernetes 1.28+
• Helm 3
• minikube / k3s
• kubectl CLI
Cloud Platform
• Azure App Service
• Azure VPN Gateway
• Azure SignalR
• Azure Monitor
• Azure Key Vault
• Azure Container Registry
Backend
• Python 3.11
• Flask / FastAPI
• asyncio / WebSockets
• IBKR TWS API
• pandas, numpy
Frontend
• HTML5 + CSS3
• JavaScript (Vanilla)
• Canvas API
• WebSocket client
Networking
• IPsec VPN
• Site-to-Site
• NSG rules
• Static routing
• MetalLB (K8s)
Monitoring
• Application Insights
• Log Analytics
• Prometheus
• Grafana
• AlertManager
Storage & Data
• Azure Table Storage
• SQLite (edge)
• Redis (cache)
• K8s Persistent Volumes