From e1cef708302faaf22c2588a3e41262e09eb56c22 Mon Sep 17 00:00:00 2001 From: sam Date: Sun, 2 Jun 2024 12:54:06 -0700 Subject: [PATCH] + system design mock --- assets/Design.svg | 21 +++++++++++ chapters/04-Architecture.typ | 1 + chapters/architecture/System-Design.typ | 49 +++++++++++++++++++++++++ documentation.typ | 6 +-- rvault_description.txt | 4 +- 5 files changed, 76 insertions(+), 5 deletions(-) create mode 100644 assets/Design.svg create mode 100644 chapters/architecture/System-Design.typ diff --git a/assets/Design.svg b/assets/Design.svg new file mode 100644 index 0000000..463bc32 --- /dev/null +++ b/assets/Design.svg @@ -0,0 +1,21 @@ + + + + + + + + AuthSysIdentityAxum Webserverrvault ContainerRouterMiddlewareStorageCompatibility Layer (out of scope)KvRocksSledCurrently only supports SQLiteSQLiteEngines are bundled in theEngines folder.KV-EngineEnginesSSHTOTPArbitraryHashicorpVaultClientsTests FromGo Client \ No newline at end of file diff --git a/chapters/04-Architecture.typ b/chapters/04-Architecture.typ index 55186be..7e784f1 100644 --- a/chapters/04-Architecture.typ +++ b/chapters/04-Architecture.typ @@ -1,4 +1,5 @@ = Architecture +#include "./architecture/System-Design.typ" #include "./architecture/Dynamic-Routing.typ" diff --git a/chapters/architecture/System-Design.typ b/chapters/architecture/System-Design.typ new file mode 100644 index 0000000..b2ca3c8 --- /dev/null +++ b/chapters/architecture/System-Design.typ @@ -0,0 +1,49 @@ +== System Design + + +Engines: + +Der Engines Ordner enthält Subfolder +für die jeweilige Engine unterteilt +in Logik, Structs unt Tests + + +Storage: + +Momentan beschränken wir uns auf SQLite +über SQLX ohne ORM + +#figure( + image("../../assets/Design.svg", width: 80%), + caption: [ + The acting components of rvault. + ], +) + + + +=== Problem Description + +// + The API to implement e.g. has the concept of mount points (similar to how filesystems can be mounted on UNIX-like systems). +// Mount points can contain multiple slashes. +// For example `/v1/some/mount/point/data/some/path/secret` may consist of a mount point `some/mount/point` and further, following routes of the mapped secret engine. //TODO +// In this example, `/data` is related to the Key-Value engine and `/some/path/secret` specifies a path within the secret engine instance mounted at the mount point. +// This implies a significant problem: +// How to determinate what part of the URL displays a mount point, where it is not certan, what the postfix of the URL will be (this problem follows). + +// + Another problem is that based on the mount point, the request must be processed by the applicable secret engine. +// Based on context, stored on the DBMS, the request must be passed to the secret engine along with the determinated mount point. + +=== Solution + +// Secret Engines have their dedicated router. +// The main router has an instance of these routers along with the database pool wrapped within a struct in its state. +// The router instances have a reference to the database pool, which is internally wrapped by an Atomic Reference Counter (`Arc`). + +// Upon a requst, the remaining path is obtained (via `/+mount_path`). +// Then, the path is looked up at the database, also requsting the engine type. +// If not found, the last last slash character and the following string is removed and looked up again. This is repeated, until the path either is found or has a length of zero, rejecting the request as "404 Not Found". + +// If found, the router is called with the request and mount path is given to the router as an "Extension". +// The `call` #link("https://docs.rs/tower/0.4.13/tower/trait.Service.html#tymethod.call")[(link)] +// function which Axum routers inherit from the Tower crate, allows to hand the request over to engine's router. diff --git a/documentation.typ b/documentation.typ index 60090c0..a01176d 100644 --- a/documentation.typ +++ b/documentation.typ @@ -3,15 +3,15 @@ #show: arkheion.with( title: [Secret Management with rvault], authors: ( - (name: "Samuel", email: "user@domain.com", affiliation: "HPE", orcid: "0000-0000-0000-0000"), + (name: "Samuel", email: "inf22036@lehre.dhbw-stuttgart.de", affiliation: "HPE"), (name: "Philip Herz", email: "inf22175@lehre.dhbw-stuttgart.de", affiliation: "HPE"), - (name: "Laurenz Noffke", email: "laurenz.noffke+but-id-replace-it-with-matrikel@hpe.com", affiliation: [HPE]), + (name: "(Laurenz Noffke)", email: "", affiliation: "HPE"), ), // Insert your abstract after the colon, wrapped in brackets. // Example: `abstract: [This is my abstract...]` // abstract: [lorem(55)], // keywords: ("First keyword", "Second keyword", "etc."), - date: "2024-04-10", + date: "2024-06-02", ) #include "./chapters/01-Project-Requirements.typ" diff --git a/rvault_description.txt b/rvault_description.txt index ee5bcb9..6ae040b 100644 --- a/rvault_description.txt +++ b/rvault_description.txt @@ -1,9 +1,9 @@ Secret Management with rvault Groupmembers: -Samuel Possemeyer +Samuel Possemeyer - inf22036@lehre.dhbw-stuttgart.de - 2950593 Philip Herz - inf22715@lehre.dhbw-stuttgart.de -Laurenz Noffke +(Laurenz Noffke) Description: The goal is to rewrite a part of the Hashicorp vault in Rust.