Engineering
Our Technology Stack
A comprehensive overview of every tool, framework, protocol and platform that powers Sky Nexus Intelligent Operations — across 12 technology domains.
Philosophy
How we choose technology
Every tool in our stack was chosen deliberately. These are the principles that guide every evaluation.
Open Source First
We choose open-source components where they are mature and well-supported, avoiding vendor lock-in and enabling community-driven improvement.
Cloud Agnostic
Every layer is designed to run on AWS, Azure, GCP or on-premises. Customers choose where their data lives — we follow.
Continuously Evaluated
Our stack review happens quarterly. Technologies graduate in when they prove production-worthy and are retired when better alternatives emerge.
Security by Default
New technology is only adopted when it can meet our security baseline. No tool enters production without secrets management, audit logging and vulnerability scanning.
Everything as Code
Infrastructure, configuration, policies, pipelines, dashboards — every system artefact lives in version control and is reviewed before deployment.
Measured Performance
Latency budgets, error budgets and capacity targets are defined before a service ships. Observability is built in, not added later.
Modern, accessible, high-performance user interfaces
Our frontend stack is built for enterprise-grade applications that must render complex real-time data, support accessibility standards, and remain fast at scale. We favour component-driven design, static typing and a utility-first CSS approach.
10 technologies
React 19
Core UIComponent-based rendering engine for all operator dashboards, data-viz panels and configuration screens. We leverage Server Components for improved TTFB and streaming for progressive data delivery.
Next.js 15
App FrameworkFull-stack React framework providing file-based routing, server actions, ISR/SSG, and Edge Runtime support. Powers the Sky Nexus web application and public-facing site.
TypeScript 5
LanguageStrict static typing across all frontend and shared packages eliminates entire classes of runtime errors and accelerates onboarding through self-documenting contracts.
Tailwind CSS 4
StylingUtility-first CSS framework with design-token integration, dark-mode support and a JIT engine. Enables consistent theming and rapid UI composition without bespoke stylesheets.
Radix UI / shadcn
ComponentsAccessible, unstyled primitives (dialogs, menus, popovers, tabs) combined with the shadcn component registry for a production-ready, customisable component library.
D3.js & Recharts
Data VisualisationD3 handles custom, physics-based and topological visualisations (network graphs, digital twin maps). Recharts handles standard operational charts — line, area, bar, radial.
Framer Motion
AnimationDeclarative animation library used for dashboard transitions, alert animations and on-boarding flows — kept minimal to preserve performance budgets.
Tanstack Query
Data FetchingServer-state management with smart caching, background refetch and optimistic updates. Powers all live polling on operational dashboards where WebSockets are not appropriate.
Zustand
State ManagementLightweight client-state store used for UI preferences, sidebar state, command palette and cross-component shared state without the boilerplate of Redux.
Vitest & Playwright
TestingVitest for unit and component tests with coverage; Playwright for end-to-end browser tests across Chromium, Firefox and WebKit in CI.
High-throughput, polyglot microservices with typed contracts
Our backend is a polyglot microservices architecture optimised for throughput, type safety and operational clarity. Services are small, independently deployable and communicate over well-defined contracts. We choose the right language for each workload rather than forcing uniformity.
8 technologies
Go (Golang)
Primary LanguageUsed for all latency-critical services — the automation engine, event router, real-time alert dispatcher and platform API gateway. Go's goroutine model and small binary size make it ideal for high-concurrency workloads.
Python 3.12
AI/Data ServicesPowers all ML model training pipelines, data transformation workers and analytical query services. The ecosystem for scientific computing and ML is unmatched.
Node.js / Bun
Integration LayerUsed for the webhook ingestion service, connector runtime and integration adapters where ecosystem richness (npm) matters more than raw throughput.
GraphQL (Hot Chocolate)
Federated APIA federated GraphQL schema stitches together all platform domains (workflows, assets, telemetry, identity) into a single queryable graph for the frontend and partner integrations.
REST / OpenAPI 3.1
Public APIEvery platform capability is exposed via a versioned REST API described by OpenAPI 3.1 specs. Contracts are code-generated from a single source of truth, ensuring SDK and documentation accuracy.
gRPC / Protobuf
Internal RPCHigh-performance binary RPC used for service-to-service communication where latency and payload size matter — telemetry ingestion, model inference calls and real-time streaming.
WebSockets / SSE
Real-time PushWebSocket connections power the live operations dashboard, alert feed and collaborative workflow editor. SSE is used for unidirectional streaming where full duplex is unnecessary.
Temporal.io
Workflow EngineDurable workflow orchestration for long-running business processes. Temporal guarantees at-least-once execution and full event history, making it ideal for multi-step approval, remediation and compliance workflows.
Purpose-fit data stores for every access pattern
We reject the one-database-fits-all approach. Each data domain uses the engine best matched to its access patterns, consistency requirements and query shape — from millisecond time-series to petabyte-scale analytics.
8 technologies
PostgreSQL 16
Primary RDBMSThe backbone of all transactional data — tenants, users, workflow definitions, audit logs, configuration and billing. Leveraged with JSONB for semi-structured fields and pg_partman for time-based partitioning.
TimescaleDB
Time-SeriesA PostgreSQL extension that turns time-series data into a first-class citizen. Stores all operational telemetry, metrics and KPI history with automated hypertable chunking and continuous aggregates.
InfluxDB 3
High-Frequency MetricsHandles sub-second IoT sensor streams and infrastructure metrics where TimescaleDB write throughput is insufficient. Columnar storage with flight SQL enables fast range queries.
MongoDB
Document StoreUsed for the integration connector configuration store, dynamic form schemas, and event payloads where schema flexibility is paramount. Atlas Search powers full-text search across resources.
Redis 7 (Cluster)
Cache & Pub/SubMulti-purpose: L2 cache for API responses, session store, distributed rate limiting, real-time pub/sub bus for dashboard events, and queuing with Redis Streams.
ClickHouse
Analytics EngineColumn-oriented OLAP database powering all analytical queries — historical trend reports, cross-tenant aggregations and executive dashboards. Ingests billions of events with sub-second query latency.
MinIO / S3
Object StorageOn-premises and cloud-compatible object storage for audit log archives, ML training datasets, report exports, workflow attachments and container image layers.
Elasticsearch
Search & LogsDistributed full-text and vector search across operational logs, documentation, case studies and resource metadata. Used alongside the ELK stack for structured log aggregation.
Cloud-native, sovereign-ready, and edge-capable
Sky Nexus runs natively on all three major hyperscalers and supports sovereign on-premises deployments. Infrastructure is entirely defined as code, immutable in production, and reproducible from scratch in under 30 minutes.
8 technologies
Kubernetes (EKS / AKS / GKE)
Container OrchestrationAll services are containerised and deployed to managed Kubernetes. We use cluster-api for multi-cloud fleet management, Karpenter for intelligent node autoscaling, and kyverno for policy enforcement.
Terraform & OpenTofu
Infrastructure as CodeAll cloud resources — VPCs, IAM, databases, DNS, load balancers — are defined in Terraform. OpenTofu is used where open-source licensing is required. Atlantis automates plan/apply from pull requests.
Helm & ArgoCD
GitOps DeliveryHelm charts package all application deployments. ArgoCD provides GitOps-native continuous delivery with declarative sync, health checking and rollback across all clusters.
AWS / Azure / GCP
HyperscalersAWS is the primary hyperscaler (Sydney ap-southeast-2). Azure is offered for Microsoft-aligned customers. GCP is used for BigQuery and Vertex AI integrations. All workloads are designed to be cloud-agnostic.
Cloudflare
Edge & CDNGlobal CDN, DDoS protection, WAF and Workers at the edge. Cloudflare Zero Trust secures internal application access without a traditional VPN.
Pulumi
Programmatic IaCUsed for complex, dynamic infrastructure scenarios where HCL is insufficient — multi-tenant provisioning logic, custom resource providers and environment bootstrapping scripts written in TypeScript.
Containerd & Docker
Container RuntimeDocker for local development. Containerd as the production container runtime. All images are built with ko (Go) or Buildpacks (Python/Node) and scanned with Trivy before promotion.
Crossplane
Control PlaneKubernetes-native control plane for provisioning cloud resources (databases, queues, buckets) as Kubernetes custom resources — enabling a single API surface for application and infrastructure state.
Production-grade ML from training through to real-time inference
AI is not a feature layer at Sky Nexus — it is embedded into the operational core. We run ML across the full lifecycle: data preparation, model training, evaluation, deployment, real-time inference and continuous retraining with drift detection.
10 technologies
PyTorch 2
Model TrainingPrimary deep learning framework for anomaly detection, predictive maintenance, natural language understanding and time-series forecasting models. Used with FSDP for distributed training.
Scikit-learn
Classical MLHandles classification, regression and clustering workloads where interpretability and training speed outweigh the benefit of deep learning — particularly in compliance risk scoring and fraud indicators.
Hugging Face Transformers
NLP & LLMsTransformer models for document understanding, log summarisation and natural language workflow creation. Both hosted models and on-premises fine-tuned variants are supported.
MLflow
Experiment TrackingTracks every training run: parameters, metrics, artefacts and model versions. The model registry gates promotion from staging to production with mandatory evaluation thresholds.
Ray
Distributed ComputingDistributed execution framework for large-scale hyperparameter search, batch inference across millions of events, and data preprocessing pipelines that exceed single-node memory.
ONNX Runtime
Inference EngineModels are exported to ONNX for hardware-accelerated inference at the edge and on CPU/GPU in production. ONNX Runtime delivers up to 4× latency improvement over Python-based serving.
Kubeflow Pipelines
ML OrchestrationKubernetes-native ML pipeline orchestration for reproducible, parameterised training and evaluation workflows. Integrated with ArgoCD for GitOps-driven pipeline promotion.
LangChain & LlamaIndex
LLM OrchestrationOrchestration frameworks for retrieval-augmented generation (RAG), agentic workflows and document Q&A within the platform's AI Decision Support module.
Evidently AI
Model MonitoringContinuous monitoring of deployed models for data drift, concept drift and performance degradation. Triggers automatic retraining pipelines when models fall below quality thresholds.
Feast
Feature StoreCentralised feature store ensuring consistent feature engineering between training and inference. Prevents training/serving skew — one of the most common sources of ML production failures.
Security embedded at every layer, not bolted on
Sky Nexus is built on a zero-trust security model. Every request is authenticated, every action is authorised, every change is audited. Our security posture aligns with APRA CPS 234, ISO 27001, the Australian Essential Eight and SOC 2 Type II.
9 technologies
HashiCorp Vault
Secrets ManagementDynamic secrets, PKI certificate issuance, database credential rotation and encryption-as-a-service. No static credentials exist in our codebase or CI/CD pipelines.
Keycloak
Identity ProviderEnterprise identity broker supporting SAML 2.0, OpenID Connect, LDAP/AD federation, MFA enforcement and fine-grained session management. Supports customer-hosted and SaaS deployments.
OPA / Casbin
AuthorisationOpen Policy Agent enforces attribute-based access control (ABAC) policies across all API calls. Casbin manages role-based access control (RBAC) within tenant boundaries.
Falco
Runtime SecurityKernel-level container runtime security — detects privilege escalation, unexpected network connections, file system writes to sensitive paths, and suspicious process behaviour in real time.
Trivy & Grype
Vulnerability ScanningContainer image scanning (OS packages, application dependencies, IaC misconfigurations) integrated into CI/CD. All critical/high CVEs block promotion to production.
Cilium & eBPF
Network SecurityeBPF-powered network policy enforcement, transparent mutual TLS between pods, deep packet inspection and network flow logging without a service mesh proxy overhead.
cert-manager
PKI AutomationAutomates TLS certificate issuance and renewal from Let's Encrypt, internal CAs and Vault PKI. Zero manual certificate management across all clusters.
SIEM (Elastic / Splunk)
Threat DetectionSecurity information and event management for correlation, threat detection and alerting across all platform logs, Kubernetes audit events and cloud provider activity logs.
Wiz / Prisma Cloud
Cloud Security PostureContinuous cloud security posture management (CSPM) scanning for misconfigurations, exposed resources, identity risks and compliance drift across all cloud accounts.
Ship safely, frequently and with full confidence
Our engineering culture is built around continuous delivery. Every commit triggers automated quality gates — tests, security scans, dependency audits and performance checks — before any change reaches production. We deploy dozens of times per day.
7 technologies
GitHub Actions
CI PlatformAll build, test, lint, scan and container image pipelines run on GitHub Actions with reusable workflow templates across all repositories. Self-hosted runners handle GPU-intensive ML builds.
ArgoCD
GitOps CDDeclarative continuous delivery with automatic sync from Git, multi-cluster support, progressive delivery and SSO integration. Every production change is a pull request merge.
Argo Rollouts
Progressive DeliveryCanary and blue/green deployments with automated analysis gates. New versions receive a percentage of traffic while metrics are evaluated — rolled back automatically on degradation.
SonarQube
Code QualityStatic analysis for code quality, security hotspots, code smell and test coverage gates. Pull requests are blocked from merging when quality gates fail.
Renovate
Dependency UpdatesAutomated dependency version management across all repositories. Renovate opens PRs for new versions, runs the full test suite and auto-merges patch updates on success.
SBOM (Syft)
Supply ChainSoftware Bill of Materials generated for every container image. SBOMs are signed with Cosign and published to our transparency log, enabling compliance with supply chain security mandates.
Earthly
Build SystemReproducible, containerised build system that ensures 'works on my machine' becomes 'works everywhere'. Earthfiles replace complex Makefile chains across polyglot repositories.
Reliable, ordered, high-throughput event infrastructure
Sky Nexus is an event-driven platform at its core. Every workflow trigger, telemetry reading, user action and system state change is an event. Our messaging infrastructure guarantees delivery, ordering and durability — even across network partitions.
6 technologies
Apache Kafka
Event BackboneThe central nervous system of the platform. All domain events are published to Kafka topics with at-least-once delivery guarantees. Managed via Strimzi on Kubernetes for zero-ops operation.
NATS JetStream
Low-Latency MessagingMicrosecond-latency messaging for real-time operational signals and edge-to-cloud communication. NATS at the edge (leaf nodes) enables autonomous operation when connectivity is degraded.
RabbitMQ
Task QueuingUsed for background job dispatch, retry queues, dead-letter handling and fan-out notification delivery where Kafka's log semantics are heavier than required.
MQTT v5
IoT ProtocolLightweight publish/subscribe protocol for IoT device connectivity. EMQX broker handles millions of concurrent device connections with QoS 0/1/2 delivery guarantees.
Apache Flink
Stream ProcessingStateful stream processing for complex event patterns — sliding window aggregations, joins across event streams, anomaly detection in real time and topology-aware event routing.
Debezium
Change Data CaptureDatabase CDC captures every row-level change from PostgreSQL and MongoDB as Kafka events, enabling event sourcing, audit log streaming and real-time cache invalidation.
Full-stack visibility from kernel to business KPI
We follow the three pillars of observability — metrics, logs and traces — and extend them with profiling, real-user monitoring and synthetic checks. Every service is instrumented from day one; observability is never added after the fact.
8 technologies
OpenTelemetry
Instrumentation StandardAll services emit traces, metrics and logs in the OpenTelemetry format. A single, vendor-neutral instrumentation layer means we can swap backends without touching application code.
Prometheus & VictoriaMetrics
MetricsPrometheus scrapes all service and infrastructure metrics. VictoriaMetrics provides long-term, cost-efficient storage with superior query performance at petabyte scale.
Grafana
Dashboards & AlertingUnified observability UI with dashboards for infrastructure, services, SLOs and business KPIs. Grafana Alerting manages all alert rules with multi-channel notification routing.
Jaeger / Tempo
Distributed TracingEnd-to-end distributed tracing across all microservices. Tempo stores traces in object storage at low cost; Jaeger is used where native UI and adaptive sampling are required.
Loki
Log AggregationHorizontally scalable log aggregation without indexing. Promtail/Vector ship logs from all pods and nodes; LogQL enables fast ad-hoc log querying directly from Grafana.
Pyroscope
Continuous ProfilingAlways-on CPU, memory and goroutine profiling for all Go services. Flame graphs integrated into Grafana dashboards enable root-cause analysis without profiling on demand.
Uptime Kuma & Synthetic
Availability MonitoringExternal synthetic checks confirm customer-facing endpoints are reachable from multiple global probe locations. Feeds directly into public and private status pages.
PagerDuty / Opsgenie
Incident ManagementAlert routing, on-call scheduling, escalation policies and post-incident review workflows. Deep integration with Slack, Jira and the Sky Nexus platform itself.
Connect anything — legacy or modern, cloud or on-premises
Organisations rarely start with a greenfield estate. Sky Nexus is built to integrate with what already exists — from modern SaaS APIs to 30-year-old mainframe systems — using a rich library of connectors, protocol adapters and transformation engines.
6 technologies
Apache Camel
Integration Engine280+ out-of-the-box connectors (SAP, Salesforce, ServiceNow, Oracle, mainframe, file-based) with enterprise integration patterns (EIP) including routing, splitting, aggregation and transformation.
Kong Gateway
API GatewayHigh-performance API gateway handling authentication, rate limiting, request transformation, caching and logging for all platform APIs. Declarative configuration via KongIngress CRDs.
n8n (self-hosted)
No-Code IntegrationVisual workflow builder for non-technical operators to create integration flows between third-party tools without writing code. Runs in an isolated, auditable container per tenant.
MuleSoft Anypoint
Enterprise ESBAvailable as an integration option for organisations already invested in MuleSoft. Sky Nexus publishes a native MuleSoft connector that exposes all platform APIs within Anypoint flows.
Airbyte
Data PipelineOpen-source ELT platform for bulk data movement from 300+ sources (databases, SaaS, files) into the Sky Nexus analytics layer. Dbt transforms raw ingested data into analytics-ready models.
dbt (Data Build Tool)
Data TransformationSQL-based transformation layer that models raw ingested data into analytics-ready tables. Version-controlled, tested and documented transformation logic with data lineage tracking.
Intelligence at the edge — connected, resilient and autonomous
Sky Nexus extends the platform to the physical world through a lightweight edge runtime that runs on hardware from Raspberry Pi to industrial PLCs. Edge nodes process data locally, sync when connected, and operate autonomously during outages.
6 technologies
K3s (Lightweight Kubernetes)
Edge OrchestrationProduction-grade Kubernetes in 40MB. Runs on edge hardware as low as 512MB RAM, enabling the same Kubernetes tooling and GitOps workflows at the edge as in the cloud.
Eclipse Mosquitto / EMQX
MQTT BrokerMQTT brokers for device-to-platform connectivity. EMQX clusters handle millions of device connections in the cloud; Mosquitto runs as the local edge broker for offline-capable deployments.
Node-RED
Edge LogicFlow-based visual programming for sensor data transformation, protocol bridging (Modbus, OPC-UA, BACnet → MQTT) and local automation logic on edge devices.
OPC-UA & Modbus
Industrial ProtocolsNative support for industrial automation protocols. OPC-UA connects to modern PLCs and SCADA systems; Modbus bridges legacy industrial equipment into the digital operations layer.
Azure IoT Edge / AWS Greengrass
Managed EdgeFor organisations already on Azure or AWS, Sky Nexus deploys as IoT Edge modules or Greengrass components, providing a native cloud-managed edge runtime with built-in OTA update support.
WebAssembly (Wasm)
Edge FunctionsLightweight, sandboxed Wasm modules run ML inference and data filtering at the edge without a container runtime. Enables sub-10ms inference on resource-constrained devices.
Secure, observable and resilient service-to-service communication
With dozens of microservices communicating across cluster boundaries, networking becomes a first-class concern. We use a service mesh to enforce mTLS, manage traffic, and gain per-request observability without burdening application developers.
6 technologies
Istio
Service MeshFull-featured service mesh providing mTLS between all pods, traffic management (retries, circuit breaking, timeouts), fine-grained telemetry and progressive delivery integration.
Cilium
eBPF NetworkingeBPF-based CNI plugin replacing iptables for kernel-level network policy enforcement, load balancing and deep observability. Enables Hubble for network flow visibility across all services.
CoreDNS
Service DiscoveryKubernetes-native DNS with custom plugins for dynamic service discovery, multi-cluster DNS routing and external name resolution with split-horizon support.
Envoy Proxy
L7 ProxyHigh-performance L7 proxy underpinning Istio sidecars, the API gateway and custom traffic shaping needs. Envoy's xDS API enables dynamic, real-time configuration without restarts.
Tailscale / WireGuard
Zero-Trust VPNMesh VPN for secure connectivity between cloud clusters, edge nodes and developer machines. WireGuard's cryptographic properties provide better security with lower latency than IPSec.
ExternalDNS
DNS AutomationAutomatically manages DNS records in Route53, Cloudflare and Azure DNS based on Kubernetes Ingress and Service resources. Eliminates manual DNS management across environments.
12
Technology domains
80+
Tools & frameworks
100%
Infrastructure as code
Zero
Static credentials in production
Want to see it in action?
Our platform architecture is designed to adapt to your existing stack, not replace it. Book a technical deep-dive with our engineering team.