{
"schemaVersion": 1,
"type": "architecture",
"title": "Tenant architecture: the sign-in and data path",
"source": "Illustrative reference architecture",
"width": 1200,
"height": 1144,
"architecture": {
"boundaries": [
{
"id": "rz",
"label": "Data center"
},
{
"id": "netz",
"label": "Application network",
"in": "rz"
},
{
"id": "daten",
"label": "Data zone",
"in": "netz"
}
],
"components": [
{
"id": "nutzer",
"label": "Teacher, parent",
"kind": "person"
},
{
"id": "browser",
"label": "Browser",
"kind": "frontend"
},
{
"id": "proxy",
"label": "Reverse proxy",
"sublabel": "TLS 1.3, WAF",
"kind": "security",
"in": "rz"
},
{
"id": "web",
"label": "Web / BFF",
"sublabel": "SvelteKit",
"in": "netz"
},
{
"id": "idp",
"label": "Sign-in",
"sublabel": "Keycloak, OIDC",
"kind": "security",
"in": "netz"
},
{
"id": "api",
"label": "Domain API",
"sublabel": "Rust",
"in": "netz"
},
{
"id": "db",
"label": "Domain data",
"sublabel": "Postgres, RLS per tenant",
"kind": "database",
"in": "daten"
},
{
"id": "audit",
"label": "Audit log",
"sublabel": "append only",
"kind": "database",
"in": "daten"
},
{
"id": "backup",
"label": "Backup",
"sublabel": "second site",
"kind": "storage"
},
{
"id": "alt",
"label": "School records",
"sublabel": "legacy system",
"kind": "external"
},
{
"id": "soc",
"label": "SIEM / SOC",
"kind": "external"
}
],
"connections": [
{
"from": "nutzer",
"to": "browser",
"label": "uses"
},
{
"from": "browser",
"to": "proxy",
"label": "calls",
"technology": "HTTPS"
},
{
"from": "proxy",
"to": "web",
"label": "forwards"
},
{
"from": "web",
"to": "idp",
"label": "signs in",
"technology": "OIDC"
},
{
"from": "web",
"to": "api",
"label": "queries",
"technology": "user context"
},
{
"from": "api",
"to": "db",
"label": "reads, writes",
"technology": "SQL/TLS"
},
{
"from": "api",
"to": "audit",
"label": "logs"
},
{
"from": "alt",
"to": "api",
"label": "master data",
"technology": "REST/JSON"
},
{
"from": "api",
"to": "soc",
"label": "events",
"technology": "Syslog",
"dash": "dashed"
},
{
"from": "db",
"to": "backup",
"label": "backs up",
"dash": "dashed"
}
],
"mainPath": [
"nutzer",
"browser",
"proxy",
"web",
"api",
"db"
],
"orientation": "portrait"
},
"mobile": {
"width": 468,
"height": 1192
},
"emphasis": {
"nodes": [
"idp"
],
"path": [
"web",
"api",
"db"
]
},
"legend": "auto"
}
