Network Topology

Docker Network

Semua services berkomunikasi melalui Docker bridge network monitoring.

┌─────────────────────────────────────────────────────────────────┐
│              Docker Network: monitoring                          │
│                                                                  │
│  All services communicate via internal network                   │
│  External ports exposed:                                         │
│  - 8085: Frontend (Nginx)                                       │
│  - 8081: CLM Backend (API)                                      │
│  - 8080: Keycloak (Auth)                                        │
│  - 9200: OpenSearch (REST API)                                  │
│  - 5601: OpenSearch Dashboards                                  │
│  - 1514: Wazuh Agent (syslog)                                   │
│  - 1515: Wazuh Agent enrollment                                 │
│  - 55000: Wazuh API                                             │
│  - 9090: Prometheus                                             │
│  - 3001: Grafana                                                │
│  - 5672: RabbitMQ AMQP                                          │
│  - 15672: RabbitMQ Management                                   │
│  - 9000/9001: MinIO                                             │
│  - 8084: Kestra                                                 │
│  - 4317/4318: OTel Collector                                    │
└─────────────────────────────────────────────────────────────────┘

Port Mapping

Application Services

Service	Internal Port	External Port	Protocol	Description
Frontend	80	8085	HTTP	Nginx serving static files
Backend	8081	8081	HTTP	Go API server
Keycloak	8080	8080	HTTP	Authentication server

Data Storage

Service	Internal Port	External Port	Protocol	Description
OpenSearch	9200	9200	HTTPS	REST API
OpenSearch	9600	9600	HTTP	Performance analyzer
OpenSearch Dashboards	5601	5601	HTTP	Visualization UI
PostgreSQL	5432	5432	TCP	RBAC database
MinIO API	9000	9000	HTTP	S3 API
MinIO Console	9001	9001	HTTP	Web console

Log Pipeline

Service	Internal Port	External Port	Protocol	Description
Fluent Bit	2020	-	HTTP	Input port
Fluentd	24224	24224	TCP/UDP	Forward input
Fluentd	9880	9880	HTTP	Monitoring
Logstash	5044	5044	TCP	Beats input
Logstash	9600	9601	HTTP	Node stats

Security Monitoring

Service	Internal Port	External Port	Protocol	Description
Wazuh Manager	1514	1514	TCP/UDP	Agent connection
Wazuh Manager	1515	1515	TCP	Agent enrollment
Wazuh Manager	55000	55000	HTTPS	API

Monitoring

Service	Internal Port	External Port	Protocol	Description
Prometheus	9090	9090	HTTP	Metrics API
Grafana	3000	3001	HTTP	Dashboard UI
cAdvisor	8080	8082	HTTP	Container metrics
Node Exporter	9100	9100	HTTP	Host metrics
OTel Collector	4317	4317	gRPC	OTLP gRPC
OTel Collector	4318	4318	HTTP	OTLP HTTP
OTel Collector	8888	8888	HTTP	zPages
OTel Collector	8889	8889	HTTP	Prometheus scrape

Message Bus

Service	Internal Port	External Port	Protocol	Description
RabbitMQ	5672	5672	TCP	AMQP
RabbitMQ	15672	15672	HTTP	Management UI

Workflow

Service	Internal Port	External Port	Protocol	Description
Kestra	8080	8084	HTTP	Workflow UI
Camel	8181	8181	HTTP	Actuator health
Camel	8888	8890	HTTP	Debug port

Inter-Service Communication

Backend → Keycloak

Backend :8081 ──HTTP──▶ Keycloak :8080
  - Password grant for login
  - JWT token validation
  - User creation
  - Role assignment

Backend → OpenSearch

Backend :8081 ──HTTPS──▶ OpenSearch :9200
  - Log search & pagination
  - Log histogram
  - Field distinct values
  - Audit log indexing
  - Alert queries
  - Dashboard metrics

Backend → PostgreSQL

Backend :8081 ──TCP──▶ PostgreSQL :5432
  - RBAC queries
  - Tenant management
  - User management
  - Permission checks

Fluent Bit → Fluentd

Fluent Bit ──TCP:24224──▶ Fluentd :24224
  - Log forwarding
  - Tag-based routing

Fluentd → OpenSearch

Fluentd ──HTTPS:9200──▶ OpenSearch :9200
  - Log indexing
  - Bulk operations
  - Index rotation

Wazuh Agent → Wazuh Manager

Wazuh Agent ──TCP:1514──▶ Wazuh Manager :1514
  - Log forwarding
  - Agent registration
  - Command execution

Wazuh Manager → OpenSearch

Wazuh Manager ──HTTPS:9200──▶ OpenSearch :9200
  - Alert indexing
  - Alert correlation

Backend → RabbitMQ

Backend ──AMQP:5672──▶ RabbitMQ :5672
  - Event publishing
  - Alert notifications

RabbitMQ → Consumer

RabbitMQ :5672 ──AMQP──▶ Consumer
  - Message consumption
  - Event processing

Consumer → OpenSearch

Consumer ──HTTPS:9200──▶ OpenSearch :9200
  - Processed event indexing

DNS Resolution

Docker Compose menggunakan service names sebagai hostname:

Hostname	Resolves To
backend	CLM Backend container
opensearch	OpenSearch container
keycloak	Keycloak container
fluentd	Fluentd container
fluent-bit	Fluent Bit container
wazuh-manager	Wazuh Manager container
postgres	PostgreSQL container
rabbitmq	RabbitMQ container
minio	MinIO container
grafana	Grafana container
prometheus	Prometheus container
kestra	Kestra container
camel	Apache Camel container
otel-collector	OTel Collector container
consumer	Consumer service container

Security Considerations

Network Isolation

• Semua services berada di Docker bridge network monitoring
• Hanya ports yang diperlukan yang di-expose ke host
• Internal communication menggunakan Docker DNS

TLS

• OpenSearch menggunakan HTTPS (self-signed untuk PoC)
• Keycloak menggunakan HTTP (start-dev mode)
• Backend menggunakan HTTP (reverse proxy untuk production)

Authentication

• Keycloak untuk user authentication
• JWT tokens untuk API access
• API keys untuk service-to-service communication

Next Steps

• Security - Implementasi keamanan
• Docker Compose - Konfigurasi services
• Troubleshooting - Debugging jaringan