Services

The services

Service	Port	Role
console-ui	8084	Nginx. Serves the management console at /console/ and proxies /v1, /beta, /admin and /console/api to the gateway. The only public service.
gateway-service	8088	Authentication, tenant isolation, rate limits, request ids, error envelope. Signs an assertion for every proxied call.
main-service	8080	Orchestrates detection: windowing, fan-out, normaliser, role layer, verifier, clustering, rendering, vault, restore, audit.
regex-service	8081	Format rules with checksums, built-in and custom.
model-service	8082	The Turkish entity model (person, organisation, location) on ONNX Runtime.
verifier-service	8083	The verifier model that re-checks every model candidate in context.
model-service-dob	8085	The role model, used for dates of birth and the optional type judge. On by default.
ocr-service and ocr-engine	8086	Optional. Rasterises pages and runs the OCR model. Off by default.

Backing stores: PostgreSQL 16 (vault, audit, console, keys, rules), Redis 7 (rate limits, cache, FPE ledger). An optional object store holds review originals.

Trust between services

The gateway strips the caller’s authorisation header and adds signed assertion headers, key id, tenant, source address, issue time and rule revision, under a shared HMAC key with a thirty-second window. The main service accepts a data call only with a valid assertion, so even a caller that reaches the main service on the cluster network cannot act without passing through the gateway. Do not create a route or ingress for anything but the console service.

Models in the release

Model	Service	Job	Pinning
Turkish entity model	model-service	Person, organisation, location in free text	Baked into the image
Verifier	verifier-service	Keep or drop each model candidate, in context	Hash-checked at start; a mismatch refuses to serve
Role model	model-service-dob	Date of birth by role; type judge when enabled	Baked into the image
OCR model	ocr-engine	Text from scanned pages and images	Hash-checked at image build; engine pinned by digest

All ONNX models run on CPU through a statically linked ONNX Runtime. The OCR engine runs on GPU by default and has a CPU variant. Model files ship inside the service images, so pinning an image tag pins its model.

Health and metrics

Every service answers GET /health. The gateway also answers GET /ready, which checks PostgreSQL and Redis and is what the readiness probe uses. Model services load their model at start and exit if loading fails, so a running model service is a loaded one. Metrics are served on a separate port (9090 in the containers) in OpenMetrics format; see Audit and logging.

Scaling notes

Detection services are stateless and scale horizontally; the chart runs two replicas of the entity model and the verifier by default. The main service holds the LiteLLM guardrail’s streaming state in memory, so run one replica when that path is in use. The gateway’s rate limiting and the detection cache live in Redis and are shared across replicas.