Architecture

Noxus has a flexible runtime topology that is kept consistent on the different deployment methods, based on a few key services. The following graph provides a quick overview of this topology:

​

Core Noxus Components

​

Data Layers

• PostgreSQL: domain entities, analytics, platform audit logs, embeddings (pgvector), and the job queue
• Redis: cache, distributed locks, and live-stream coordination
• Cold Storage: object/file persistence (s3, gcloud, minio, local-compatible options)

​

The job queue lives in PostgreSQL

Workers poll a PostgreSQL-backed queue rather than consuming from a message broker. Two consequences worth planning around:

• Database connection count scales with worker replicas. Each Backend and Worker pod opens its own connection pools — POSTGRES_POOL_SIZE (default 64) plus a separate vector pool and a queue pool. A deployment with 2 Backend and 10 Worker replicas can request well over a thousand connections before any user traffic. Run a connection pooler; the Helm chart bundles PgBouncer for this.
• Backlog is directly observable, which is what makes queue-driven autoscaling accurate. KEDA reacts to actual queue depth instead of waiting for CPU to rise after work has already been sitting.

Redis losing its data costs a cold cache and any in-flight stream — not durable state. Configure it with allkeys-lru eviction so it degrades under memory pressure rather than erroring on write.

​

Traffic And Domains

The platform default ingress model uses three entrypoints for the platform. As an example:

• <domain> -> Noxus Frontend
• api.<domain> -> Noxus Backend
• relay.<domain> -> Noxus Relays (if enabled)

These however can be mapped differently, in case of limitations such as:

• <domain> -> Noxus Frontend
• <domain>/api/backend -> Noxus Backend
• <domain>/relays -> Noxus Relays (if enabled)

​

Long-lived connections

Agent responses stream over SSE and WebSocket connections held open for minutes. Default proxy read timeouts are 60 seconds, which truncates responses mid-answer. Raise the timeout on whatever terminates TLS — load balancer idle timeout, proxy-read-timeout on nginx, a BackendConfig on GKE — and check any CDN or WAF in front, which applies its own limit regardless of the origin setting.