Skip to content

Overview

CookieHub is a cookie consent management platform. The system runs on AWS (ECS, RDS, CloudFront), with Cloudflare providing DNS for cookiehub.com and Pages for this docs site.

System Diagram

flowchart TB
    subgraph Users
        Customer[Customer dashboard]
        EndUser[End user browser]
    end

    subgraph Edge["Edge Layer"]
        CF[CloudFront + Lambda@Edge]
    end

    subgraph AWS_EUC1["AWS eu-central-1"]
        subgraph Public["Public ALB"]
            CoreAPI[Core API v3]
            AtraxAPI[Atrax API]
            EdgeAPI[edge-api]
        end

        subgraph Internal["Internal ALB"]
            VaultAPI[Vault API]
        end

        subgraph Data
            MariaDB[(MariaDB)]
            Postgres[(PostgreSQL)]
            CH[(ClickHouse)]
        end

        subgraph Workers
            ETL[Vault ETL]
        end

        SQS[SQS Queue]
        S3[S3 Buckets]
        Grafana[Grafana]
    end

    subgraph AWS_EUW1["AWS eu-west-1"]
        AtraxNode[Atrax Node<br/>headless browser]
    end

    Customer --> CoreAPI
    EndUser --> CF

    CF --> EdgeAPI
    CF -->|v1 consent events| SQS
    EdgeAPI -->|consent events| SQS
    EdgeAPI --> CH
    SQS --> VaultAPI

    CoreAPI --> MariaDB
    CoreAPI -->|analytics| VaultAPI
    CoreAPI -->|trigger scan| AtraxAPI

    AtraxAPI --> Postgres
    AtraxAPI --> AtraxNode
    AtraxNode -->|results| AtraxAPI
    AtraxNode --> S3

    VaultAPI --> CH
    VaultAPI --> Postgres
    ETL --> CH
    Grafana --> CH

Services

Service Purpose Tech Status
Core API Dashboard API — domains, consent settings, subscriptions Hono (TypeScript) Stage live, prod on Laravel
Vault Analytics pipeline — consent events, session data TypeScript + ClickHouse Prod
Atrax Web scanner — discovers cookies and tracking tech Node.js + headless browser Prod (api in eu-central-1, nodes in eu-west-1)
Edge Widget serving + consent event logging CloudFront + Lambda@Edge, edge-api (Hono/TypeScript) Prod (cutover to edge-api partial)
Widget Client-side consent banner JavaScript Prod

AWS Accounts

Account ID Purpose
Stage 258618559895 Development and testing
Production 759286286879 Live traffic

Both accounts have infrastructure primarily in eu-central-1, with atrax-node crawlers running in dedicated VPCs in eu-west-1 per account. Infrastructure is managed with Terraform — see Terraform docs.

Key Architectural Decisions

  • ECS on EC2 (not Fargate) — used for all containerized services
  • Internal ALB for production — vault services are not publicly accessible
  • SSM Parameter Store for secrets — no Secrets Manager, see Secrets docs
  • ClickHouse for analytics — replaced earlier Trino/Iceberg and Portainer/Swarm setups
  • Off non-AWS infrastructure — the Scaleway PHP edge servers were the last non-AWS component and have been decommissioned