Skip to main content

System Architecture

Arsitektur Microservices​

Centralize Management System menggunakan arsitektur microservices dengan Docker Compose untuk mengelola log, security alerts, dan audit trail secara terpusat.

Container Architecture​

┌─────────────────────────────────────────────────────────────────────────┐
│                    Docker Network: monitoring                            │
│                                                                          │
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐              │
│  │  Keycloak    │    │  CLM Backend │    │   Fluentd    │              │
│  │  (Auth)      │───▶│  (Go API)    │───▶│  (Log Ship)  │              │
│  │  :8080       │    │  :8081       │    │  :24224      │              │
│  └──────────────┘    └──────────────┘    └──────────────┘              │
│                            │                     ▲                       │
│                            ▼                     │                       │
│                    ┌──────────────┐    ┌──────────────┐    ┌──────────┐│
│                    │ audit-log-*  │    │ Fluent Bit   │    │OpenSearch││
│                    │ (OpenSearch) │    │ (Collector)  │    │ (Storage)││
│                    └──────────────┘    │  :2020       │    │  :9200   ││
│                                        └──────────────┘    └──────────┘│
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐              │
│  │ Wazuh Agent  │───▶│Wazuh Manager │───▶│  alerts.json │              │
│  │ (per server) │    │  :1514/:55000│    │  (volume)    │              │
│  └──────────────┘    └──────────────┘    └──────────────┘              │
└─────────────────────────────────────────────────────────────────────────┘

Backend Go Architecture​

Backend menggunakan Go 1.23 dengan standard library net/http:

backend/
├── cmd/api/main.go          # Entry point
├── internal/
│   ├── config/config.go     # Environment-based configuration
│   ├── server/
│   │   └── server.go        # Route definitions, middleware
│   ├── handlers/            # HTTP handlers (11 modules)
│   │   ├── alerts.go
│   │   ├── dashboard.go
│   │   ├── logaudit.go
│   │   ├── monitoring.go
│   │   ├── monitors.go
│   │   ├── telegram.go
│   │   ├── infra.go
│   │   ├── servicemap.go
│   │   ├── k8s.go
│   │   ├── camel.go
│   │   └── healthcheck.go
│   ├── keycloak/            # Keycloak JWT verification
│   ├── opensearch/          # OpenSearch client
│   ├── database/            # PostgreSQL client
│   └── prometheus/          # Prometheus client
├── migrations/              # SQL migrations
├── docs/                    # Swagger docs
└── Makefile                 # Build commands

Frontend Architecture​

Frontend menggunakan React 19 + TypeScript + Vite:

frontend/src/
├── api/                     # API client modules
│   ├── auth.ts
│   ├── logs.ts
│   ├── http.ts              # Core fetch wrapper
│   ├── service.ts
│   └── rbac.ts
├── components/
│   ├── ui/                  # shadcn/ui primitives (46 components)
│   ├── sidebar.tsx
│   ├── header.tsx
│   └── charts/
├── data/                    # Static data (roles, compliance)
├── hooks/                   # Custom React hooks
├── lib/
│   ├── app-context.tsx      # Auth state, tenant management
│   ├── utils.ts
│   └── types.ts
├── routes/                  # Page components (12 pages)
├── router.tsx               # React Router v7 config
├── app.tsx                  # Root app component
├── main.tsx                 # React root mount
├── i18n.ts                  # Internationalization
└── styles.css               # Tailwind CSS styles

Core Banking Architecture​

Core Banking menggunakan Java 17 + Spring Boot 3.2:

core-banking/src/main/java/
├── com/banking/
│   ├── controller/          # REST controllers
│   ├── service/             # Business logic
│   ├── repository/          # JPA repositories
│   ├── entity/              # JPA entities
│   ├── dto/                 # Data transfer objects
│   ├── security/            # JWT, Spring Security config
│   └── websocket/           # STOMP WebSocket handlers

Technology Details​

Backend Stack​

ComponentTechnologyVersion
LanguageGo1.23
HTTP Routernet/http (stdlib)-
API Docsswaggo-
AuthKeycloak JWT-
DatabasePostgreSQL (lib/pq)16
SearchOpenSearch3.7
MetricsPrometheus client-

Frontend Stack​

ComponentTechnologyVersion
FrameworkReact19.2
LanguageTypeScript5.8
Build ToolVite6.4
CSSTailwind CSS4.2
UI Libraryshadcn/ui (Radix)-
StateTanStack Query5.83
RouterReact Router7.6
FormsReact Hook Form + Zod-
ChartsRecharts2.15
i18ni18next25.2

Core Banking Stack​

ComponentTechnologyVersion
LanguageJava17
FrameworkSpring Boot3.2.5
SecuritySpring Security + JWT-
ORMSpring Data JPA/Hibernate-
DatabasePostgreSQL16
CacheRedis-
Real-timeWebSocket (STOMP)-

Database Schema​

PostgreSQL (RBAC)​

-- Tenants
CREATE TABLE tenants (
    id SERIAL PRIMARY KEY,
    name VARCHAR(255),
    slug VARCHAR(100) UNIQUE
);

-- Applications
CREATE TABLE applications (
    id SERIAL PRIMARY KEY,
    name VARCHAR(255),
    slug VARCHAR(100) UNIQUE,
    description TEXT,
    status VARCHAR(50) DEFAULT 'active'
);

-- Users
CREATE TABLE users (
    id SERIAL PRIMARY KEY,
    kc_id VARCHAR(255),
    username VARCHAR(100) UNIQUE,
    email VARCHAR(255)
);

-- Roles & Permissions
CREATE TABLE roles (
    id SERIAL PRIMARY KEY,
    name VARCHAR(100),
    description TEXT
);

CREATE TABLE permissions (
    id SERIAL PRIMARY KEY,
    resource VARCHAR(100),
    action VARCHAR(100)
);

-- User-Tenant-Role mapping
CREATE TABLE user_tenant_roles (
    user_id INT REFERENCES users(id),
    tenant_id INT REFERENCES tenants(id),
    role_id INT REFERENCES roles(id),
    PRIMARY KEY (user_id, tenant_id, role_id)
);

-- Tenant Aliases (OpenSearch index patterns)
CREATE TABLE tenant_aliases (
    id SERIAL PRIMARY KEY,
    tenant_slug VARCHAR(100),
    alias_name VARCHAR(255),
    index_pattern VARCHAR(255),
    filter_json TEXT
);

OpenSearch Index Templates​

logs-* (Application Logs)​

FieldTypeDescription
@timestampdateTimestamp
messagetextLog message
levelkeywordLog level (info, warn, error)
source_typekeywordSource type
app_slugkeywordApplication slug
tenant_idkeywordTenant identifier

wazuh-alerts-* (Security Alerts)​

FieldTypeDescription
@timestampdateTimestamp alert
alert_idkeywordID unik alert
rule_idkeywordRule ID dari Wazuh
rule_descriptiontextDeskripsi rule
rule_levelintegerRisk level (1-15)
alert_statuskeywordactive/resolved
agent_idkeywordAgent ID
agent_namekeywordHostname agent
full_logtextFull log message

audit-log-* (Audit Trail)​

FieldTypeDescription
@timestampdateTimestamp event
actorkeywordUser yang melakukan aksi
actionkeywordJenis aksi
targetkeywordTarget aksi
resultkeywordsuccess/failed
ipkeywordIP address actor
detailsobjectDetail tambahan

dashboard-services​

FieldTypeDescription
source.system_namekeywordNama sistem
source.servicekeywordNama service
source.statuskeywordStatus (Operational/Down)
source.uptime_percentfloatUptime percentage
source.request_countlongJumlah request
source.avg_latency_msfloatAverage latency
source.error_rate_percentfloatError rate
source.log_countlongJumlah log

Resource Limits​

ServiceMemoryCPUNotes
Backend384m0.25Go API server
Frontend256m0.25Nginx serving static
OpenSearch2g1.00Main search engine
OpenSearch Dashboards512m0.50Visualization UI
Fluentd512m0.25Log forwarding
Fluent Bit128m0.25Log collector
Wazuh Manager256m0.25Security monitoring
Keycloak1g1.00Authentication
Logstash1g0.50DB sync
RabbitMQ256m0.25Message bus
MinIO256m0.25Object storage
Kestra512m0.25Workflow
Grafana256m0.25Metrics viz
Prometheus512m0.50Metrics store
Consumer128m0.25RabbitMQ consumer
PostgreSQL256m0.25RBAC database
Camel256m0.25Integration

Health Checks​

ServiceHealth CheckInterval
OpenSearch/_cluster/health30s
Wazuh Managerpgrep wazuh-analysisd30s
RabbitMQrabbitmq-diagnostics check_port_connectivity30s
Logstashcurl http://localhost:9600/_node/stats30s
Prometheuswget http://localhost:9090/-/healthy30s
Grafanawget http://localhost:3000/api/health30s
MinIOcurl http://localhost:9000/minio/health/live30s
Kestracurl http://localhost:8080/30s
Backendcurl http://localhost:8081/healthz-
Consumerwget http://localhost:8082/healthz30s

Next Steps​