PGB Hub
System Architecture & Cloud Mesh

Engineered for Zero-Trust Programmable Resilience

Consolidated edge ingress, automated TLS termination, sub-10ms serverless execution, CRIU microVMs, dedicated PostgreSQL 17, and Agent MCP in a unified sovereign mesh.

System Architecture

Unified Cloud Ingress & Runtime Mesh

One sovereign wildcard endpoint serving client traffic, AI agent sessions, serverless compute, microVM containers, maps, and dedicated PostgreSQL 17.

1. Client & Agent Ingress

Unified entry points for mobile apps, web clients, AI coding agents, and external database drivers.

Web & Mobile Apps (Flutter/React)HTTPS
AI Agents (Cursor / Claude MCP)MCP
PostgreSQL Clients (Prisma / psql)TLS 5433
S3 / MinIO File ClientsS3 REST
Direct ingress over https://<project>.pgbhub.app
2. Sovereign Cloud Gateway

Internal proxy routing requests to the appropriate subsystem with zero public internet latency.

Edge TLS 1.3 TerminationSub-1ms
Automated Wildcard SSL + HSTS
Fail2ban Active Watchdog0-Trust
Brute-force & DDoS IP quarantine
Private Docker DNS Mesh0.1ms
Direct Unix sockets & bridge network
Zero-latency intra-cluster communication
3. Runtime & Storage Core

Dedicated compute runtimes and state engines provisioned per project.

Dedicated PostgreSQL 17JSONB + PostGIS
Serverless Functions<10ms Cold Start
CRIU MicroVM ContainersScale-to-Zero
PGB Maps & RoutingVector Tiles
Encrypted point-in-time S3 backup vault

Detailed Layer-by-Layer Architecture

Each subsystem is isolated in minimal container environments designed for high throughput, sub-millisecond internal routing, and zero vulnerabilities.

LAYER 01Managed Ingress (*.pgbhub.app)

Global Edge Gateway & Wildcard TLS 1.3 Termination

Direct entry point for web clients, mobile apps, serverless functions, and AI agent sessions. Every project receives a dedicated wildcard domain with automated TLS 1.3 termination, HSTS, and CORS routing.

Guarantees & Specs
  • Cryptographically isolated TLS 1.3 termination with strict certificate validation
  • Sub-1ms internal reverse proxy routing to compute, database, and container runtimes
  • Prevents man-in-the-middle exploits across untrusted public client networks
LAYER 02Zero-Trust Security Layer

Intrusion Defense & Fail2ban Active Watchdog

Continuous real-time analysis of connection logs. Remote IP addresses exhibiting repeated failed password attempts, anomalous query patterns, or port scanning are instantly quarantined at the kernel firewall level.

Guarantees & Specs
  • Pre-configured jail with maxretry=5 and progressive exponential ban times
  • Protects public database ports (5433), HTTP gateway, and control plane
  • Zero latency impact on legitimate verified client queries
LAYER 03Compute & Execution Engine

Sub-10ms Serverless Compute & CRIU MicroVM Containers

Pre-warmed V8 and Python runtimes execute modular functions with sub-10ms cold starts, while microVM containers run full Docker OCI workloads with hardware cgroups v2 quotas and CRIU memory snapshots that freeze idle workloads to 0 RAM.

Guarantees & Specs
  • Instant sub-10ms function start times triggered by HTTP, webhooks, or cron
  • CRIU memory snapshots automatically freeze idle containers to zero RAM and resume in <20ms
  • Configurable active schedules (e.g. business hours always-on)
LAYER 04Storage Core (TLS Port 5433 + Internal Mesh)

Dedicated PostgreSQL 17 Core, PostGIS 3.4 & pgvector

Dedicated PostgreSQL 17 engine with GIN path indexing for schema-free JSON collections, PostGIS 3.4 spatial suite, and pgvector embeddings. 100% compliant with the official PostgreSQL wire protocol.

Guarantees & Specs
  • SIMD-accelerated JSONB query planner and automated GIN path indexes
  • Built-in PostGIS 3.4 for geofencing, distance sorting, and polygon spatial joins
  • Integrated pgvector extension for LLM embeddings and AI semantic search
LAYER 05Geospatial Ingress (/maps/*)

Self-Hosted PGB Maps & Navigation Gateway

A self-hosted geospatial gateway serving dark & street vector map tiles, Search Box autocomplete, reverse geocoding, and traffic-aware turn-by-turn routing at a fraction of traditional map costs.

Guarantees & Specs
  • Standard vector map tile delivery compatible with Flutter Map, Leaflet, and modern map engines
  • Sub-50ms tile delivery cached via edge reverse proxies
  • High-performance turn-by-turn driving and walking routing with traffic congestion annotations
LAYER 06Platform Services (/auth, /storage, /mail)

Built-In Auth, S3 Object Storage & Transactional Mail

Complete platform services without external SaaS markups: 6-digit OTP auth with automated PostgreSQL RLS claim injection, S3-compatible partitioned object buckets with 15-minute presigned URLs, and high-deliverability transactional mail with automated reputation tracking.

Guarantees & Specs
  • Passwordless OTP, magic links, JWTs, and automated RLS session injection
  • 15-minute presigned S3 URLs for high-speed direct client uploads
  • Automated webhook sync with bounce/complaint handling and reputation tracking
LAYER 07AI Tooling & Resilience

Agent-Native Model Context Protocol (MCP) & Durability Vault

Direct bridge connecting Cursor IDE, Claude Desktop, and autonomous AI agents to live schemas and backend APIs via MCP, backed by scheduled automated S3-compatible database snapshots and point-in-time recovery.

Guarantees & Specs
  • Native MCP server exposing live schemas and safe parameterized query execution
  • Automated point-in-time database snapshots encrypted with AES-256-GCM
  • 1-click snapshot restore directly from the visual cloud console
Compliance & Hardening

PGB Hub Security Standard

Specification Version: 2026.9.1 · PostgreSQL 17 Core
Cryptographic Standards

TLS 1.3 encryption with ChaCha20-Poly1305 and AES-256-GCM cipher suites. Internal role credentials generated with 32-byte cryptographic entropy.

Access Control & Row-Level Security

Row-level security (RLS) scoping automatically injected into PostgreSQL connection sessions. Superuser privileges locked strictly to internal maintenance.

Disaster Recovery SLA

Point-in-time recovery capabilities via scheduled compressed SQL dumps. Direct streaming to cloud object storage with zero host disk bloat.

Build AI-Native Applications Today

Ready to build on a truly programmable cloud?

Provision databases, serverless compute, microVM containers, maps, auth, storage, and agent MCP tooling under one unified sovereign endpoint.

Launch Free Cloud InstanceOpen Cloud Console
No Credit Card Required
8 Sovereign Cloud Services
Sub-10ms Global Edge Ingress