MTB Digital Payments — DEV Environment Diagram

Route 53 — dev.mps.mtb.ua

• Public NLB: mgate, vrtp, api-inv, api-pub-inv, api-int-inv, admin-inv
• Internal NLB: admin, merchant, admin-int, keycloak, kafka-int
• Internal NLB: event-int, kafka-ui, esb-api, esb-portal, kestra-int
• Internal NLB: esb-db :5432, esb-db-read :5433, docs
• Internal NLB: service-admin-inv, conductor-inv
• Bank PHZ: tdhost1.pcl.mtb.ua → 192.168.100.3 (VPN)

RDS PostgreSQL 15.12 (3 instances)

• appdb (db.t3.small, max_conn=500) — payment services
• iamdb (db.t3.small, max_conn=300) — Keycloak IAM
• eventdb (db.t3.small, max_conn=300) — event-router, is-card-trx
• All: gp3, backup 7d, data subnets, encrypted
• SG: EKS pods + VPN (WireGuard 10.8/24 + Pritunl 10.9/24)

Traefik Ingress (public + internal)

• PUBLIC (a282bbf...): mgate, vrtp, api-inv, api-pub-inv
• PUBLIC: api-int-inv (+ vpn-whitelist middleware), admin-inv
• INTERNAL (a54b60e...): admin, merchant, admin-int, keycloak
• INTERNAL: kafka-int, event-int, kafka-ui, esb-api, esb-portal
• INTERNAL: esb-db :5432, esb-db-read :5433, kestra-int, docs

Security and Connectivity

• VPN to MTB Bank: 195.47.202.128, IKEv2 AES-256, BGP 65521
• VPC Peering INFRA: 10.2.0.0/16 (Grafana/Vault/ArgoCD)
• VPC Peering MTB360: 192.168.20.0/22 (Kafka access)
• Pritunl VPN: 10.9.0.0/24, WireGuard: 10.8.0.0/24
• S3: dev-bin-range-files (versioned, AES256, lifecycle)