Gallery
40 reference diagrams.
Each one is a spec in the repository, rendered here by the same CLI you install. Open one for its YAML and every output format; orrery init <name> copies it as a starting point. Every picture starts in the stage skin, an animated scene in one tint; switch to classic for each vendor's own style.
AI coding agent on the Model Context Protocol
an AI coding agent on the Model Context Protocol: the MCP host runs one MCP client per server, stdio to a local filesystem server, Streamable HTTP with OAuth to remote GitHub and Postgres servers, Claude choosing each tool, and OTLP traces to Grafana Cloud.
Data lake on AWS
Firehose and DMS land data in raw, curated and analytics zones refined by Glue jobs, with the catalog and Lake Formation beside the zones and Athena, Redshift and Quick Sight at the bottom.
Event-driven order processing on AWS
an EventBridge bus fans orders out to a Step Functions workflow, an SQS billing queue and an SNS topic, with numbered `step:` edges on the main path.
Retrieval augmented generation on AWS
an ingestion lane (S3, Lambda) and a query lane (Cognito, API Gateway, a Bedrock AgentCore agent) meet at shared services: a Titan Text Embeddings V2 model that embeds both the chunks and the question, a Bedrock text model, and an OpenSearch Serverless vector index.
Hybrid multi-Region landing zone on AWS
an AWS landing zone with AWS Organizations OUs for security, infrastructure and workloads, IAM Identity Center federated to a corporate IdP, central logging and threat detection, Network Firewall inspection, and a data center on Direct Connect with VPN backup reaching two Regions through peered Transit Gateways.
Hybrid network on AWS
a corporate data center reaches VPCs in three AWS accounts in us-east-1 through a Transit Gateway, over Direct Connect with a Site-to-Site VPN backup.
Serverless web API on AWS
CloudFront (a global service, so drawn outside the Region) serves a single-page app from S3 and sends `/api/*` to an API Gateway REST API, Lambda and DynamoDB, with a Cognito user pool authorizer; the function also writes to a receipts bucket.
Three-tier web application on AWS
the same diagram with `theme: dark`.
Three-tier web application on AWS
a VPC across two Availability Zones with public, web and data subnets, NAT gateways, an ALB, and one Auto Scaling group drawn across both zones with `around:`; zone B writes to the primary database in zone A.
AKS application platform on Azure
Application Gateway in front of an AKS cluster with system and user node pools, Container Registry, workload identity (the pods exchange their token with Microsoft Entra ID, then read Key Vault), and Log Analytics.
Hub-spoke network on Azure
a hub-spoke network on Azure: on-premises reaches the hub's ExpressRoute and VPN gateways and Azure Firewall, which forwards over the peerings to the spokes, with Bastion in the hub, AKS in one spoke and VMs with a private endpoint to Azure SQL in the other, Private DNS and Log Analytics.
Retrieval augmented generation on Azure
Azure OpenAI chat grounded in an Azure AI Search index, behind Application Gateway and private endpoints, with an indexer filling the index from Blob Storage.
Web app on Azure
Front Door to App Service outside the VNet, with only its integration interface in the app subnet, reaching Azure SQL and Key Vault through private endpoints and Private DNS zones, with Azure's filled arrowheads.
Container diagram for an online store
a C4 container view built from shapes: two people, a `c4:boundary` system, its containers and database, and grey external systems.
Open-source data platform
an open-source lakehouse: Debezium and Airbyte feed Kafka, Flink lands Iceberg tables on Ceph with a Hive Metastore catalog, dbt models them on Trino for Superset, on an Airflow schedule.
Order approval flowchart
an ISO 5807 flowchart (`kind: flowchart`) of order approval. Order details come in through a data parallelogram and a predefined credit check decides; a failed check asks for prepayment (a manual operation) and waits up to 48 hours (a delay), an order over the limit needs a manager's sign-off, and approved orders end with a printed invoice (a document).
GKE application platform on Google Cloud
a GKE platform in Google Cloud's frames (cloud, project, region, cluster): Cloud Build pushes each image to Artifact Registry and releases it through Cloud Deploy to two namespaces, next to Memorystore, Secret Manager and Cloud SQL, with Cloud Logging and Cloud Monitoring.
Streaming analytics on Google Cloud
Pub/Sub and Dataflow stream events into BigQuery and Cloud Storage and score them with a Vertex AI model, with Looker dashboards on BigQuery.
MLOps on Google Cloud with Agent Platform
MLOps on Gemini Enterprise Agent Platform (formerly Vertex AI): Cloud Build ships the pipeline, Pub/Sub and Cloud Run functions start it, Dataflow and Managed Training feed Model Registry and an online endpoint, and drift alerts retrain.
Web application on Google Cloud
Google Cloud product cards (`look: card`), a global load balancer in front of Cloud Run with Cloud CDN and Cloud Armor attached to its backend, and Cloud Run reaching Cloud SQL, Secret Manager and Memorystore (in a VPC network, over Direct VPC egress).
CI/CD from GitHub Actions to AWS
a merge to main runs GitHub Actions, which assumes an IAM role with its OIDC token, then pushes to ECR and deploys to ECS with CloudFormation.
GitOps delivery with Argo CD
GitOps with Argo CD: a pull request runs GitHub Actions, which pushes the image to ghcr.io and bumps its tag in the config repository; Argo CD syncs the staging cluster automatically and production on a manual sync, with Prometheus and Grafana monitoring production.
Web application on Red Hat OpenShift on IBM Cloud
IBM Cloud Internet Services in front of a static site in Cloud Object Storage and a three-zone Red Hat OpenShift cluster, with App ID and services reached through Virtual Private Endpoints.
SaaS onboarding journey
a customer journey map (`kind: journey`): five stages from Discover to Renew as columns, lanes for customer actions, touchpoints, pain points and opportunities as rows, the customer's path as arrows, and an emotion curve from each step's score that dips at the data import and peaks at the first shared report.
Kubernetes web workload
the official Kubernetes icons inside a namespace: Ingress, Service, Deployment, ReplicaSet, Pods, HorizontalPodAutoscaler, ConfigMap, Secret and a PersistentVolumeClaim bound to a PersistentVolume.
Order desk
a business flowchart from a customer's order to a delivered parcel and a paid invoice. The order desk, the credit check and the packing bench are the team's own SVG icons (`local:`), drawn to the IC01 to IC10 rules and passed by `orrery icons check`; the other steps use the business `generic:` names.
Product launch
a product launch as a two-sided mind map (`kind: mindmap`): five workstreams split between the halves with fifteen ideas, curved branches thick out of the root and one color per workstream.
ML platform on AWS
SageMaker AI Processing into Feature Store, a Step Functions training pipeline, Model Registry, batch and real-time serving, and a drift alarm that starts retraining.
Modern SaaS web stack
a SaaS web stack drawn as cards: Next.js on Vercel serving the UI, Cloudflare in front of the Node.js API, Neon and Upstash for data, Stripe, Resend and Clerk as third-party services, Sentry and PostHog for observability.
Multi-cloud with a shared identity provider
AWS, Google Cloud and Azure in their own vendor frames (the Azure subscription inside its Microsoft Entra tenant), federated to one Okta tenant and joined at a colocation router by Direct Connect, Partner Interconnect and ExpressRoute, each reaching its workload through a gateway or router in a VPC or VNet.
Observability stack with OpenTelemetry
OpenTelemetry SDKs export to a Collector that fans out to Prometheus, Loki and Tempo, with Grafana querying them and Alertmanager routing to Slack and paging PagerDuty.
Order to cash
order to cash in BPMN 2.0 (`kind: process`): a Customer pool and a Supplier pool with Sales, Warehouse and Finance lanes, run top to bottom. A message start event, user, send, receive and service tasks, an exclusive gateway with Yes and No branches, a parallel split and join, and four message flows between the pools.
Retrieval-augmented generation with open components
RAG with open components: an ingestion lane chunks and embeds documents into Qdrant, and a React, FastAPI and LangChain query lane answers with a local Ollama model or a hosted one, traced in Langfuse.
Web app on AWS
the `orrery init` default, a load-balanced container service with its database and cache in a VPC and a bucket in the Region, inside one AWS Cloud group.
Order lifecycle
an order's lifecycle as a UML state machine (`kind: state`): initial and final states, Created through Delivered with Cancelled and Refunded, transitions written event [guard] / action, and a self-transition looped on the corner of Created.
Incident response
a cross-functional flowchart of incident response in three standalone lanes (On-call engineer, Incident lead, Communications), with terminators, decisions and a mitigation loop.
Chat system design
shape nodes for a whiteboard look (cylinders for stores, a queue for the Kafka topic) around WebSocket gateways, chat, presence and push services, media storage and a CDN.
URL shortener system design
vendor-neutral `generic:` icons and product logos, from CDN, load balancer and API servers to Redis, PostgreSQL and a Kafka, Flink and ClickHouse click pipeline.
Video streaming system design
uploads go to object storage through a pre-signed URL, a queue feeds transcoding workers that write HLS and DASH renditions, and viewers stream segments from the CDN while view events flow through Kafka to recommendations.
Product organization
a product organization as an org chart (`kind: tree`): the chief product officer, three directors and their eight teams as cards with generic icons, each parent centered over its reports on a shared connector bar.