thesabear/public
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fix architecture-overview.md dependency graph rendering

Browse Source 
Switch to LR layout, restore all 12 observability-reporting edges
(cut them by mistake, they belong in a dependency graph), drop the
repeated 'reports to' label text that was breaking legibility and
let line style (solid=dependency, dotted=async reporting) carry that
distinction instead. Also shortened edge labels on the trust-boundary
diagram to avoid the same clipping issue.
This commit is contained in:
thesabear committed 2026-08-22 12:40:50 +03:00
1 parent febbf2e44c
commit 5a96e92dc6
1 file changed
+26 -24
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture-overview.md
+26 -24
View File
@@ -6,8 +6,8 @@
## Dependency graph
```mermaid
flowchart TD
Internet(["Internet"]) --> Edge["Edge Firewall<br/>NAT · public reverse proxy · NTP · DHCP"]
flowchart LR
Internet(["Internet"]) --> Edge["Edge Firewall"]
Edge --> LAN["LAN"]
LAN --> DNS["Internal DNS"]
@@ -15,44 +15,46 @@ flowchart TD
DNS --> Vault
Vault --> Apps["App Host<br/>~40 stacks"]
Vault --> Automation["Automation Host"]
LAN --> FileServer["File Server"]
DNS --> FileServer
Vault --> Automation["Automation Host"]
LAN --> Automation
Apps --> InternalProxy["Internal reverse-proxy zone"]
Apps --> InternalProxy["Internal Proxy Zone"]
Apps --> SSO["SSO"]
Automation --> GitHost["Git Hosting"]
Automation --> Gitea["Git hosting<br/>internal + public mirror"]
Vault --> EdgeProxy["User-facing reverse proxy<br/>mTLS"]
Vault --> EdgeProxy["User-Facing Proxy<br/>mTLS"]
DNS --> EdgeProxy
Apps -.proxied by.-> EdgeProxy
SSO -.auth gate via.-> EdgeProxy
Apps -.proxied.-> EdgeProxy
SSO -.auth.-> EdgeProxy
Apps -.reports to.-> Monitoring["Monitoring"]
Automation -.reports to.-> Monitoring
FileServer -.reports to.-> Monitoring
EdgeProxy -.reports to.-> Monitoring
Vault -.reports to.-> Monitoring
DNS -.reports to.-> Monitoring
Apps -.-> Monitoring["Monitoring"]
Automation -.-> Monitoring
FileServer -.-> Monitoring
Vault -.-> Monitoring
DNS -.-> Monitoring
EdgeProxy -.-> Monitoring
Apps -.reports to.-> Wazuh["Security Monitoring"]
Automation -.reports to.-> Wazuh
FileServer -.reports to.-> Wazuh
EdgeProxy -.reports to.-> Wazuh
Vault -.reports to.-> Wazuh
DNS -.reports to.-> Wazuh
Apps -.-> SecMon["Security Monitoring"]
Automation -.-> SecMon
FileServer -.-> SecMon
Vault -.-> SecMon
DNS -.-> SecMon
EdgeProxy -.-> SecMon
```
> [!TIP]
> Solid arrows are real dependencies — the target has to be reachable and healthy for the source to function. Dotted arrows into Monitoring and Security Monitoring are the one exception: every host reports telemetry to both, but per the Observability Independence Law below, that reporting is asynchronous and non-blocking — nothing here actually depends on Monitoring or Security Monitoring being up. The line style carries that distinction instead of repeating "reports to" twelve times. Full detail on what's actually collected: [`docs/observability.md`](observability.md) and [`docs/security-monitoring.md`](security-monitoring.md).
## Four trust boundaries, not two
```mermaid
flowchart LR
WAN["WAN"] -->|public application boundary| EdgeFW["Edge Firewall / public proxy"]
WAN["WAN"] -->|public| EdgeFW["Edge Firewall<br/>public proxy"]
Browser["LAN browsers"] -->|mTLS + SSO| UserProxy["User-facing proxy"]
Service["App-to-app"] -->|IP-allowlist + SSO| InternalProxy["Internal proxy"]
Infra["LAN infra-to-infra"] -->|explicit per-flow rules| HostFW["Host firewall rules"]
Service["App-to-app"] -->|allowlist + SSO| InternalProxy["Internal proxy"]
Infra["LAN infra-to-infra"] -->|per-flow rule| HostFW["Host firewall"]
```
Backend services trust proxy headers, not raw client IP, on every path.