add jenkins architecture diagram

service/jenkins.md

@@ -47,7 +47,21 @@ run.
 
 ## Design
 
-TODO: overview and diagram
+Jenkins is mostly used to build websites but also run tests for
+certain software project. Configuration and data used for websites and
+test are stored in Git and, if published, generally pushed to the
+[static site mirror system](howto/static-component).
+
+This section aims at explaining how Jenkins works. The following
+diagram should provide a graphical overview of the various components
+in play. Note that the static site mirror system is somewhat elided
+here, see the [architecture diagram there](howto/static-component#design) for a view from that
+other end.
+
+![Jenkins CI architecture diagram](static-component/architecture.png)
+
+What follows should explain the above in narrative form, with more
+details.
 
 ### Jobs configuration
 

service/jenkins/architecture.dot

+digraph jenkins {
+        label="Jenkins CI architecture, torproject.org, Februrary 2021"
+
+        subgraph "clusterhosts" {
+                label="hosts"
+                labelloc=bottom
+
+                static [ label="static site mirror system"]
+                git [ shape=record label="<gitolite> gitolite | <http> https://" ]
+                puppet
+                build [label="build-$ARCH-$NN" ]
+                deb [label="Debian package\narchive"]
+                git:gitolite -> jenkins [label="HTTP trigger"]
+                jenkins -> git:http [label="pulls config"]
+                build -> jenkins [label="pulls\njobs"]
+                build -> git:http [headlabel="pulls\nrepos"]
+                build -> static [taillabel="pushes\nartefacts"]
+                jenkins -> LDAP [label=auth]
+                build -> IRC [label="IRC notification\n(over email)"]
+                build -> deb [label="pushes packages\"]
+        }
+        subgraph clusterusers {
+                label=users
+                labelloc=bottom
+                TPA
+                webdevs
+                public
+        }
+        TPA -> puppet -> { static, build, git, jenkins }
+        TPA -> git:gitolite
+        webdevs -> git:gitolite
+        public -> static
+}