## 4 Cloud Server  
Recalling the PROMET&O architecture shown in Figure 1, the cloud server hosts two layers of the system, i.e., data processing and data visualization layers. The cloud server consists of a set of containerized applications managed by Docker [51]. Such a tool allows developers to deploy their applications consistently and portably across various environments and to replicate them with minimal changes for different clients or scenarios.  
The applications in the _data processing layer_, shown in Figure 7, collect data from the multi-sensor devices via a messaging client that stores them in the database in real time. These data are then further processed by a scheduler that, at regular intervals, computes several derived measures to help reduce the computation time for future real-time analysis.  
The _data visualization layer_, shown in Figure 8, relies on a web application that provides the graphical front-end through which end-users can navigate and explore the data. Most of the user interface is implemented in the application itself except for the rendering of the graphs that are embedded from a dashboarding software, Grafana [35], largely used for time-series representation.  
The _data visualization layer_ also benefits from an _API gateway_, implemented with Nginx [52], which is positioned in front of all the applications and that acts as a single entry point for the backend services. It provides centralized handling of all the communications with end-users and delivers security, policy enforcement, routing, and service visibility. Consequently, it streamlines the development and management of internal applications that can offload non-functional requirements to a central entity.  
For instance, authentication is fully managed by the gateway through the OpenID Connect protocol. This protocol enables the gateway to retrieve user information from an identity and access manager (IAM), such as Keycloak [36]. The gateway intercepts all unauthenticated requests and redirects clients to the IAM's login page. Upon successful authentication, the gateway transmits user information, encapsulated within the HTTP headers, to the upstream service. By means of the gateway, which also works as a reverse proxy, all applications are exposed through the same web domain, e.g., promotee.polito.it,  
Figure 6: In (**a**), the magnitude (on the top) and phase (on the bottom) of the time-continuous (solid) and time-discrete (dashed line) transfer function associated with the A-weighted filter. In (**b**), the magnitude of the spectra of broadband 100 Hz–10 kHz noise acquired by the multi-sensor before and after applying the A-weighted filter.  
so that they can easily share information through HTTP cookies. Various paths are allocated to distinct applications within the system architecture: the primary root (/) is dedicated to the web application, wherein \"/dashboard/\" denotes the chart services. URLs commencing with \"/chart/\" are directed to Grafana, for plot embedding. Lastly, the path \"/auth\" redirects to the identity and access management (IAM) system. Thus, there is no direct communication between the user browser and the data processing layer.