Cropwright — System Overview

Cropwright — System Overview An architecture diagram generated by Archify. Browser · SvelteKit static bundle · Architecture component Browser SvelteKit static bundle Cropwright nginx · non-root, :8080 · Architecture component Cropwright nginx non-root, :8080 OpenProcessor API · curation service, no own DB · Architecture component OpenProcessor API curation service, no own DB OpenSearch · crops / clusters / classes index · Architecture component OpenSearch crops / clusters / classes index Triton · model registry + inference · Architecture component Triton model registry + inference VLM · suggestions + verification · Architecture component VLM suggestions + verification Trainer / evaluator · train jobs, bake-off, probe · Architecture component Trainer / evaluator train jobs, bake-off, probe Segmenter · region candidates (SAM3) · Architecture component Segmenter region candidates (SAM3) Vendored contract · contracts/openprocessor/* · Architecture component Vendored contract contracts/openprocessor/* same-origin HTTPS docker network, prefix proxy generates Legend Frontend Backend Database External

Cropwright owns no database

  • • Every read/write goes through the OpenProcessor API's one prefix (default /curation); each project is served under it
  • • nginx re-resolves the upstream via Docker's embedded DNS every 10s so a backend restart never pins a stale IP

One prefix, substituted at container start

  • • PUBLIC_API_PREFIX must equal the API's own OP_API_PREFIX — the API builds some URLs (region thumbnails) from its own prefix
  • • API_UPSTREAM (default http://op-api:8000) is a Docker container name on the shared network, not a public host

No request authentication (owner decision)

  • • Every write — label, discard, export, train, ingest — is reachable by anyone who can reach the nginx origin
  • • Deploy on a trusted LAN/VPN only, never the public internet, until the backend adds opt-in auth