OPS Ecosystem — MQA Governance Portal

Executive Summary

In brief: EU-hosted portal on Render with PostgreSQL and Cloudflare R2 storage.

Why it matters: GDPR alignment and clear NGO ownership of domains and billing.

Cost: ~€90–120/month production hosting; R2 usage low.

Status: Live; DNS migration to MQA org pending.

Decision needed: Approve DNS migration to MQA Cloudflare org

Services & Costs — full vendor & pricing overview · Executive Overview — decision-maker summaries

Status: August 2026 · Type: SMG (MQA Group client project)

Architecture Overview

                    ┌─────────────────────────────────┐
                    │  Cloudflare (DNS + R2)          │
                    │  mqa.group                      │
                    │  ⚠️ Migration → MQA org pending │
                    └──────────┬──────────────────────┘
                               │
         portal.mqa.group      │      api.mqa.group
              ┌────────────────┴────────────────┐
              ▼                                 ▼
    ┌──────────────────┐              ┌──────────────────┐
    │ mqa-frontend     │   HTTPS      │ mqa-backend      │
    │ Render (Node)    │─────────────▶│ Render (Docker)  │
    │ Frankfurt        │              │ Frankfurt        │
    └──────────────────┘              └────────┬─────────┘
                                               │
                                               ▼
                                    ┌──────────────────┐
                                    │ mqa-postgres     │
                                    │ Render Pro PG18  │
                                    │ Frankfurt        │
                                    └──────────────────┘

Platform Accounts (Target State)

Platform	Org Account	Status	Owner
GitHub	MQA-Group	✅ Private repo	MQA Dev
Render	MQA Group Team	✅ Production live, project “MQA Governance Portal”	MQA Dev
Cloudflare	MQA Organisation	⚠️ R2 ✅ · DNS zone still private	DNS migration pending
Azure AD	MQA Tenant	✅ OAuth Microsoft 365	MQA IT
Resend / Email	MQA	✅	MQA Dev

Production Domains

Role	URL
Frontend	https://portal.mqa.group
Backend API	https://api.mqa.group/api
Legacy frontend	https://governance.mqa.group (legacy CORS)

Render Project Structure

Project	Environments	Services
MQA Governance Portal (prj-d9ofcgjncjis73bu7960)	Production, Staging	4 web services (2× prod, 2× staging)

Postgres instances (mqa-postgres, mqa-postgres-staging) currently sit outside the project — Render API does not allow moving them later; assign manually in the dashboard if needed.

Staging (live)

Role	URL
Frontend	https://staging.portal.mqa.group
Backend	https://staging.api.mqa.group/api

Blueprint: render-staging.yaml — see STAGING-SETUP

CI/CD

Step	Tool
Source	GitHub MQA-Group/MQA-Governance-Portal
CI	GitHub Actions (.github/workflows/ci.yml)
CD	Render auto-deploy on push to main

Data Flows

• Auth: Microsoft OAuth → JWT (Bearer, frontend sessionStorage)
• Media Hub: Browser → presigned URL → Cloudflare R2 (EU)
• Legacy uploads: /uploads/* on backend disk (auth-protected; migrate to R2 recommended)
• Email: Resend / Microsoft Graph (server-side)

Single Points of Failure (Aug 2026)

Risk	Status	Notes
Cloudflare on personal account	Partially resolved	R2 mqa-media → MQA org ✅ · DNS zone mqa.group still on private account ⚠️ → CLOUDFLARE-MIGRATION
No staging	Resolved ✅	develop → staging services live · staging.portal / staging.api DNS live → STAGING-STATUS
No external monitoring/alerting	Open	Render notifications only · Better Stack / Sentry still TODO → MONITORING
Uploads on ephemeral Render FS	Partially resolved	Media Hub → R2 ✅ · legacy /uploads/* on backend disk still present

See OPS-ROADMAP for remaining items.