docs(deployment): consolidate multi-cloud deployment guides, remove legacy per-cloud tree

docs/admin/architecture/index.mdx

@@ -0,0 +1,38 @@
+---
+id: architecture-overview
+title: AI/Run CodeMie Deployment Architecture
+sidebar_label: Architecture
+sidebar_position: 1
+pagination_prev: admin/index
+---
+
+import FeatureCard from '@site/src/components/FeatureCard';
+import FeatureGrid from '@site/src/components/FeatureGrid';
+
+# AI/Run CodeMie Deployment Architecture
+
+This section describes the AI/Run CodeMie deployment architecture, including infrastructure components, network design, and resource requirements. Two architecture variants are available depending on the target environment.
+
+## Architecture Variants
+
+<FeatureGrid>
+  <FeatureCard
+    icon="/img/icons/cloud-data.svg"
+    iconType="image"
+    title="Kubernetes"
+    description="Full production deployment on a managed Kubernetes cluster (EKS, AKS, or GKE), including network design and container resource requirements."
+    link="/admin/architecture/architecture-kubernetes"
+  />
+  <FeatureCard
+    icon="/img/icons/server.svg"
+    iconType="image"
+    title="On VM"
+    description="Lightweight single-VM deployment using Docker Compose. Ideal for proof-of-concept and demo environments."
+    link="/admin/architecture/architecture-on-vm"
+  />
+  <div style={{ visibility: 'hidden' }} />
+</FeatureGrid>
+
+## Next Steps
+
+After reviewing the architecture, proceed to [Prerequisites](../deployment/prerequisites/) to review the requirements before deployment.

docs/admin/architecture/kubernetes.mdx

@@ -0,0 +1,154 @@
+---
+id: architecture-kubernetes
+title: Kubernetes Deployment Architecture
+sidebar_label: Kubernetes
+sidebar_position: 2
+pagination_prev: admin/architecture/architecture-overview
+pagination_next: admin/architecture/architecture-on-vm
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+import ContainerResources from '../deployment/common/deployment/architecture/_container-resources.mdx';
+
+# Kubernetes Deployment Architecture
+
+This page describes the full production deployment architecture on a managed Kubernetes cluster. A cloud provider can be selected below for provider-specific details.
+
+## Application Stack Components
+
+The AI/Run CodeMie application consists of multiple integrated components organized into functional categories:
+
+![Application Stack](../deployment/common/deployment/images/application-stack-diagram.drawio.png)
+
+### Core AI/Run CodeMie Services
+
+Proprietary services that provide the main AI/Run CodeMie functionality:
+
+| Component             | Container Registry                                                  | Description                                                                           |
+| --------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
+| **CodeMie API**       | `europe-west3-docker.pkg.dev/.../codemie:x.y.z`                     | Backend service handling business logic, data processing, and API operations          |
+| **CodeMie UI**        | `europe-west3-docker.pkg.dev/.../codemie-ui:x.y.z`                  | Frontend web application providing the user interface                                 |
+| **NATS Auth Callout** | `europe-west3-docker.pkg.dev/.../codemie-nats-auth-callout:x.y.z`   | Authentication and authorization service for NATS messaging (Plugin Engine component) |
+| **MCP Connect**       | `europe-west3-docker.pkg.dev/.../codemie-mcp-connect-service:x.y.z` | Bridge enabling CodeMie to communicate with MCP servers                               |
+| **Mermaid Server**    | `europe-west3-docker.pkg.dev/.../mermaid-server:x.y.z`              | Diagram generation service for visualization in chats                                 |
+
+### Data Layer
+
+Database and search components for data persistence:
+
+| Component         | Container Registry                                    | Description                                                                        |
+| ----------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------- |
+| **Elasticsearch** | `docker.elastic.co/elasticsearch/elasticsearch:x.y.z` | Primary data store for AI/Run CodeMie (datasources, projects, conversations, etc.) |
+| **Kibana**        | `docker.elastic.co/kibana/kibana:x.y.z`               | Analytics and visualization interface for Elasticsearch data                       |
+
+### Security & Identity Management
+
+Authentication and authorization components:
+
+| Component             | Container Registry                        | Description                                                                 |
+| --------------------- | ----------------------------------------- | --------------------------------------------------------------------------- |
+| **Keycloak Operator** | `epamedp/keycloak-operator:x.y.z`         | Manages Keycloak deployment and configuration                               |
+| **Keycloak**          | `quay.io/keycloak/keycloak:x.y.z`         | Identity and access management (IAM) solution providing SSO, authentication |
+| **OAuth2 Proxy**      | `quay.io/oauth2-proxy/oauth2-proxy:x.y.z` | Authentication middleware integrating with Keycloak for secure access       |
+
+### Infrastructure Services
+
+Essential Kubernetes infrastructure components:
+
+| Component                    | Container Registry                                                  | Description                                         |
+| ---------------------------- | ------------------------------------------------------------------- | --------------------------------------------------- |
+| **Nginx Ingress Controller** | `registry.k8s.io/ingress-nginx/controller:x.y.z`                    | Routes external traffic to internal services        |
+| **Storage Class**            | Cloud-provider CSI driver (EBS, Azure Disk, or GCP Persistent Disk) | Provides persistent volumes for stateful components |
+
+### Messaging & Integration
+
+Message broker for Plugin Engine:
+
+| Component | Container Registry | Description                                                       |
+| --------- | ------------------ | ----------------------------------------------------------------- |
+| **NATS**  | `nats:x.y.z`       | High-performance messaging system for Plugin Engine communication |
+
+### Observability
+
+Logging and monitoring components:
+
+| Component      | Container Registry                        | Description                                            |
+| -------------- | ----------------------------------------- | ------------------------------------------------------ |
+| **Fluent Bit** | `cr.fluentbit.io/fluent/fluent-bit:x.y.z` | Lightweight log collector enabling agent observability |
+
+### Optional Components
+
+Components that can be omitted based on configuration:
+
+| Component     | Container Registry | Description                                                                                     |
+| ------------- | ------------------ | ----------------------------------------------------------------------------------------------- |
+| **LLM Proxy** | –                  | Optional proxy for load balancing and high availability of AI model requests and usage insights |
+
+### Deployment Dependencies
+
+Components must be deployed in the following order due to dependencies:
+
+1. **Infrastructure** → Ingress Controller, Storage Class
+2. **Operators** → Keycloak Operator
+3. **Data Layer** → Elasticsearch
+4. **Security** → Keycloak (with database credentials), OAuth2 Proxy
+5. **Messaging** → NATS
+6. **Core Services** → CodeMie API, UI, MCP Connect, NATS Auth
+7. **Observability** → Fluent Bit, Kibana
+8. **Optional** → LLM Proxy (if needed)
+
+## Cloud Infrastructure
+
+A cloud provider can be selected below for provider-specific infrastructure details.
+
+<Tabs groupId="cloud-provider">
+<TabItem value="aws" label="AWS">
+
+AI/Run CodeMie is deployed on Amazon Elastic Kubernetes Service (EKS) with supporting AWS services for networking, storage, and identity management.
+
+**High-Level Architecture Diagram**
+
+The diagram below illustrates the complete AI/Run CodeMie infrastructure deployment on AWS:
+
+![AWS Architecture Diagram](./images/architecture-diagram-aws.drawio.png)
+
+</TabItem>
+<TabItem value="azure" label="Azure">
+
+AI/Run CodeMie is deployed on Azure Kubernetes Service (AKS) with supporting Azure services for networking, storage, and identity management.
+
+**High-Level Architecture Diagram**
+
+The diagram below illustrates the complete AI/Run CodeMie infrastructure deployment on Azure:
+
+![Azure Architecture Diagram](./images/architecture-diagram-azure.drawio.png)
+
+</TabItem>
+<TabItem value="gcp" label="GCP">
+
+AI/Run CodeMie is deployed on Google Kubernetes Engine (GKE) with supporting GCP services for networking, storage, and identity management.
+
+**Deployment Options**
+
+There are two deployment options available depending on your organization's access requirements:
+
+- **Public cluster option** - Access to AI/Run CodeMie from predefined networks or IP addresses (VPN, corporate networks, etc.) using public DNS resolution from user workstations
+- **Private cluster option** - Access to AI/Run CodeMie via Bastion host using private DNS resolution for enhanced security
+
+**High-Level Architecture Diagram**
+
+The diagram below illustrates the complete AI/Run CodeMie infrastructure deployment on GCP:
+
+![GCP Architecture Diagram](./images/architecture-diagram-gcp.drawio.png)
+
+</TabItem>
+</Tabs>
+
+:::tip Architecture Customization
+The architecture can be customized based on your organization's security policies, compliance requirements, and operational preferences. Consult with your deployment team to discuss specific requirements.
+:::
+
+## Kubernetes Resource Requirements
+
+<ContainerResources />

docs/admin/architecture/on-vm.mdx

@@ -0,0 +1,193 @@
+---
+id: architecture-on-vm
+title: On-VM Deployment Architecture
+sidebar_label: On VM
+sidebar_position: 3
+pagination_prev: admin/architecture/architecture-kubernetes
+pagination_next: admin/deployment/prerequisites/prerequisites-overview
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# On-VM Deployment Architecture
+
+CodeMie On VM deploys the full AI/Run CodeMie platform on a **single virtual machine** using Docker Compose. It provides the same core functionality as the full Kubernetes deployment but with minimal infrastructure overhead, and is designed for proof-of-concept and demo environments rather than production workloads.
+
+## Application Architecture
+
+All CodeMie services run as Docker containers on the VM, orchestrated by Docker Compose. This layer is identical regardless of the underlying cloud provider.
+
+![Docker Compose Services](../deployment/common/deployment/images/docker-compose-diagram.drawio.png)
+
+### Services by Profile
+
+**Shared services** (both profiles):
+
+| Service       | Image                       | Purpose                                           |
+| ------------- | --------------------------- | ------------------------------------------------- |
+| postgres      | pgvector/pgvector:pg17      | Primary database for application data             |
+| elasticsearch | elasticsearch:8.x           | Document storage and search for Data Sources      |
+| kibana        | kibana:8.x                  | Log visualization and analytics for Elasticsearch |
+| mcp-connect   | codemie-mcp-connect-service | Connector for MCP servers                         |
+| nginx         | nginx:1.31-alpine           | Reverse proxy, TLS termination                    |
+
+**OSS profile:**
+
+| Service        | Purpose                                       |
+| -------------- | --------------------------------------------- |
+| codemie-oss    | API server with built-in local authentication |
+| codemie-ui-oss | Web frontend                                  |
+
+**Enterprise profile:**
+
+| Service           | Purpose                                        |
+| ----------------- | ---------------------------------------------- |
+| codemie           | API server                                     |
+| codemie-ui        | Web frontend                                   |
+| keycloak          | Identity provider (SSO, OIDC)                  |
+| oauth2-proxy      | Authentication proxy in front of nginx         |
+| litellm           | LLM proxy for model routing and key management |
+| nats              | Messaging for plugin engine                    |
+| nats-auth-callout | NATS authentication service                    |
+| mermaid-server    | Diagram rendering                              |
+
+## Infrastructure Overview
+
+<Tabs groupId="cloud-provider">
+<TabItem value="aws" label="AWS">
+
+CodeMie On VM runs on a single EC2 instance with supporting AWS services. Terraform provisions the following resources depending on the network mode:
+
+<Tabs>
+  <TabItem value="ip" label="IP Mode (default)" default>
+    Direct access to the EC2 instance via Elastic IP:
+
+    ![IP Mode Diagram](./images/on-vm-architecture-diagram-aws-ip-mode.drawio.png)
+
+  </TabItem>
+  <TabItem value="domain" label="Domain Mode (ALB + ACM)">
+    When `TF_VAR_platform_domain_name` is configured, an ALB with trusted TLS certificate is created:
+
+    ![Domain Mode Diagram](./images/on-vm-architecture-diagram-aws-domain-mode.drawio.png)
+
+  </TabItem>
+  <TabItem value="private" label="Private IP Mode">
+    When `TF_VAR_private_ip_only=true`, EC2 is placed in a private subnet with NAT Gateway for outbound traffic. Access is via VPN, AWS Workspaces, or some other available VM:
+
+    ![Private Mode Diagram](./images/on-vm-architecture-diagram-aws-private-mode.drawio.png)
+
+  </TabItem>
+</Tabs>
+
+**AWS Resources**
+
+| Resource                 | Purpose                                                               |
+| ------------------------ | --------------------------------------------------------------------- |
+| **VPC**                  | Isolated network with public subnets (+ private if `private_ip_only`) |
+| **EC2 Instance**         | Single instance running Docker Compose (Ubuntu, r5.xlarge default)    |
+| **Elastic IP**           | Static public IP for the EC2 instance                                 |
+| **S3 Bucket**            | Persistent storage for user data (repos, files)                       |
+| **KMS Key**              | Encryption key for S3 data at rest                                    |
+| **ALB**                  | Application Load Balancer with TLS (if domain configured)             |
+| **ACM Certificate**      | Trusted TLS certificate for the domain (if domain configured)         |
+| **Route 53 Record**      | DNS A record pointing to ALB (if domain configured)                   |
+| **SSM Parameter**        | Stores EC2 SSH private key securely                                   |
+| **Security Groups**      | Controls inbound traffic to ALB and EC2                               |
+| **IAM Instance Profile** | Grants EC2 access to Bedrock, S3, KMS, SSM                            |
+
+**Network Modes**
+
+| Mode                    | Configuration                               | Access                            |
+| ----------------------- | ------------------------------------------- | --------------------------------- |
+| **Public IP** (default) | `TF_VAR_private_ip_only=false`              | EC2 gets EIP, direct HTTPS access |
+| **Domain + ALB**        | `TF_VAR_platform_domain_name="example.com"` | ALB with ACM cert, Route 53 DNS   |
+| **Private IP**          | `TF_VAR_private_ip_only=true`               | No public IP, access via VPN only |
+
+</TabItem>
+<TabItem value="azure" label="Azure">
+
+![Azure On VM Infrastructure Architecture](./images/on-vm-architecture-diagram-azure.drawio.png)
+
+CodeMie On VM runs on a single Azure VM with supporting Azure services. Terraform provisions the following resources:
+
+**Azure Resources**
+
+| Resource                       | Purpose                                                              |
+| ------------------------------ | -------------------------------------------------------------------- |
+| **Azure VM (Standard_E4s_v5)** | Single VM running Docker Compose (4 vCPU, 32 GB RAM)                 |
+| **Virtual Network / Subnet**   | Isolated network for the VM                                          |
+| **Network Security Group**     | Controls inbound/outbound traffic to the VM                          |
+| **Azure Storage Account**      | Persistent storage for user data (repos, files)                      |
+| **Azure Key Vault**            | Encryption key management for storage data                           |
+| **Private DNS Zone**           | Custom domain resolution (when `TF_VAR_platform_domain_name` is set) |
+| **Azure Bastion**              | Secure SSH access to the VM without exposing a public IP             |
+
+**Network Modes**
+
+| Mode                     | Configuration                                   | Access                                    |
+| ------------------------ | ----------------------------------------------- | ----------------------------------------- |
+| **Private IP** (default) | `TF_VAR_platform_domain_name` empty             | VM private IP, access via VPN or Bastion  |
+| **Domain**               | `TF_VAR_platform_domain_name="private.lab.com"` | Creates private DNS zone, access via name |
+
+</TabItem>
+<TabItem value="gcp" label="GCP">
+
+![GCP On VM Infrastructure Architecture](./images/on-vm-architecture-diagram-gcp.drawio.png)
+
+CodeMie On VM runs on a single GCE VM with supporting GCP services. Terraform provisions the following resources:
+
+**GCP Resources**
+
+| Resource                       | Purpose                                                              |
+| ------------------------------ | -------------------------------------------------------------------- |
+| **GCE VM (n2-highmem-4)**      | Single VM running Docker Compose (4 vCPU, 32 GB RAM)                 |
+| **VPC / Subnet**               | Isolated network for the VM                                          |
+| **Firewall Rules**             | Controls inbound/outbound traffic to the VM                          |
+| **GCS Bucket**                 | Persistent storage for user data (repos, files)                      |
+| **Cloud KMS Key**              | Encryption key management for storage data                           |
+| **Cloud DNS Private Zone**     | Custom domain resolution (when `TF_VAR_platform_domain_name` is set) |
+| **IAP (Identity-Aware Proxy)** | Secure SSH access to the VM without exposing a public IP             |
+| **Secret Manager**             | Stores the SSH private key for VM access                             |
+
+**Network Modes**
+
+| Mode                     | Configuration                                    | Access                                          |
+| ------------------------ | ------------------------------------------------ | ----------------------------------------------- |
+| **Private IP** (default) | `TF_VAR_platform_domain_name` empty              | VM private IP, access via VPN or IAP            |
+| **Domain**               | `TF_VAR_platform_domain_name="codemie.internal"` | Creates Cloud DNS private zone, access via name |
+
+</TabItem>
+</Tabs>
+
+## On-VM Resource Requirements
+
+<Tabs groupId="cloud-provider">
+<TabItem value="aws" label="AWS">
+
+| Resource | Minimum | Recommended   |
+| -------- | ------- | ------------- |
+| vCPU     | 4       | 4 (r5.xlarge) |
+| RAM      | 16 GB   | 32 GB         |
+| Disk     | 50 GB   | 100 GB (gp3)  |
+
+</TabItem>
+<TabItem value="azure" label="Azure">
+
+| Resource | Minimum | Recommended         |
+| -------- | ------- | ------------------- |
+| vCPU     | 4       | 4 (Standard_E4s_v5) |
+| RAM      | 16 GB   | 32 GB               |
+| Disk     | 50 GB   | 100 GB              |
+
+</TabItem>
+<TabItem value="gcp" label="GCP">
+
+| Resource | Minimum | Recommended      |
+| -------- | ------- | ---------------- |
+| vCPU     | 4       | 4 (n2-highmem-4) |
+| RAM      | 16 GB   | 32 GB            |
+| Disk     | 50 GB   | 100 GB           |
+
+</TabItem>
+</Tabs>