Architecture
How the NNO platform is structured — from the API gateway down to your feature packages.
Architecture
NNO is a platform orchestration layer built on Cloudflare. It provisions cloud infrastructure for you, manages a multi-tenant runtime, and gives your users a console shell composed from pluggable feature packages.
The simplest mental model:
NNO = Infrastructure provisioner + Feature package runtime + Multi-tenant shell + CLI toolchainRequest flow
Every API call from your users travels the same path:
Browser / API client
↓
Gateway (single entry point — auth, rate limiting, routing)
↓
Internal services (Registry, IAM, Billing, Provisioning, …)
↓
Cloudflare D1 / R2 / KV (per-platform resources)The Gateway is the only public surface. All internal services are reachable only through it.
Core services
| Service | What it does |
|---|---|
| Gateway | Routes all API traffic. Enforces auth, rate limiting, CORS, and request tracing. |
| IAM | Identity and access management for NNO itself. Issues API keys per platform. |
| Registry | Source of truth for all platforms, tenants, stacks, resources, and active features. |
| Provisioning | Calls the Cloudflare API to create Workers, Pages apps, D1 databases, R2 buckets, and KV namespaces on your behalf. |
| Billing | Stripe-backed subscriptions, usage metering, and quota enforcement. |
| Stack Registry | Versioned catalogue of NNO-authored stack templates that platform admins can activate. |
| CLI Service | Manages per-platform GitHub repositories and triggers Cloudflare Pages builds. |
Four layers
NNO organises everything into four layers:
- NNO Core — the meta-platform itself (Gateway + services above). You interact with it via the console or CLI.
- Platform — your product. One platform per client. Gets its own isolated Cloudflare resources.
- Tenant / Sub-Tenant — logical partitions within a platform (business units, customer accounts, teams).
- Feature Packages & Stacks — the UI and backend Workers that make up your application, grouped into Stacks.
Your users only ever see Layer 3 (the console shell) and the features inside it. Layers 1 and 2 are infrastructure that NNO operates on your behalf.
What NNO provisions for you
When you onboard a platform, NNO automatically creates:
- An auth Worker and D1 database (
{platformId}-default-auth) - A console shell deployed to Cloudflare Pages
- DNS entries under
*.{platformId}.nno.app - Additional resources per Stack you activate
All resource names embed your platform ID so they are uniquely identifiable and never conflict with other platforms sharing the same Cloudflare account.