FastRAG — Containers (C4 level 2) Diagram

Frontends

Both proxies read FASTRAG_API_URL and a server-only FASTRAG_QUERY_TOKEN and reject paths outside an allowlist (404)
website allows uploads/deletes; the console proxies only GET/POST and also fetches /v1/strategies server-side, bypassing its proxy
The website keeps the last 10 query traces in sessionStorage for the /query trace page

Index writers

Offline scripts build a kb_<version> collection, register it in Postgres and flip the kb_current alias (or defer with --no-activate)
The RQ worker does the same for admin rebuilds, but only in the compose stack — hosted deployments have no worker
Session uploads are written by the API into the live collection with session_upload=true

Config at startup

calibration.json comes from the file or FASTRAG_CALIBRATION_JSON; the corpus centroid from the file or the active manifest row
Readiness fails on a fingerprint, content_version or centroid-dimension mismatch