Architecture Overview
High-Level Architecture
Centralize Management System dibangun dengan arsitektur microservices yang diorkestrasi menggunakan Docker Compose. Sistem ini terdiri dari 20+ services yang saling berkomunikasi melalui Docker internal network.
┌─────────────────────────────────────────────────────────────────────┐
│ CLM Docker Stack │
│ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ Keycloak │──▶│ Backend │──▶│ Fluentd │──▶│OpenSearch│ │
│ │ (Auth) │ │ (Go) │ │(Log Ship)│ │(Storage) │ │
│ │ :8080 │ │ :8081 │ │ :24224 │ │ :9200 │ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
│ │ ▲ │ │
│ ▼ │ ▼ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │audit-log │ │Fluent Bit│ │OpenSearch│ │
│ │(OpenSearch)│ │(Collector)│ │Dashboards│ │
│ └──────────┘ │ :2020 │ │ :5601 │ │
│ └──────────┘ └──────────┘ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │Wazuh │──▶│Wazuh │──▶│alerts.json│ │
│ │Agent │ │Manager │ │(volume) │ │
│ └──────────┘ │:1514 │ └──────────┘ │
│ └──────────┘ │
└─────────────────────────────────────────────────────────────────────┘
Service Components
Core Services
| Service | Image | Function |
|---|---|---|
| CLM Backend | Custom Go API | API server, business logic, RBAC |
| Frontend | React + Vite | Web UI dashboard |
| Keycloak | keycloak:26.0.7 | Authentication & SSO |
Data Layer
| Service | Image | Function |
|---|---|---|
| OpenSearch | opensearch:3.7.0 | Log storage & search engine |
| OpenSearch Dashboards | opensearch-dashboards:3.7.0 | Visualization UI |
| PostgreSQL | postgres:16 | RBAC metadata, audit trail |
| Redis | redis | Caching |
Log Pipeline
| Service | Image | Function |
|---|---|---|
| Fluent Bit | fluent-bit:4.2.5 | Log collector (Docker & system logs) |
| Fluentd | fluentd:v1.17-1 | Log forwarding pipeline |
| Logstash | logstash (custom) | PostgreSQL → OpenSearch sync |
| Apache Camel | camel (custom) | Integration routing |
Security Monitoring
| Service | Image | Function |
|---|---|---|
| Wazuh Manager | wazuh-manager:4.14.5 | Security monitoring server |
| Wazuh Agent | wazuh-agent | Per-server security agent |
Monitoring & Observability
| Service | Image | Function |
|---|---|---|
| Prometheus | prom/prometheus | Metrics collection & storage |
| Grafana | grafana/grafana | Metrics visualization |
| OTel Collector | otel-collector-contrib:0.155.0 | Telemetry collection |
| cAdvisor | cadvisor | Container metrics |
| Node Exporter | node-exporter | Host metrics |
Supporting Services
| Service | Image | Function |
|---|---|---|
| RabbitMQ | rabbitmq:3-management | Message bus |
| MinIO | minio/minio | S3-compatible object storage (Data Lake) |
| Kestra | kestra:v0.21.1 | Workflow orchestrator |
| Consumer | Custom Go | RabbitMQ message consumer |
| Core Banking | Java Spring Boot | ISO-compliant transaction demo |
Network Architecture
Semua services berkomunikasi melalui Docker bridge network monitoring. External ports yang di-expose:
| Port | Service | Protocol |
|---|---|---|
| 8085 | Frontend (Nginx) | HTTP |
| 8081 | Backend API | HTTP |
| 8080 | Keycloak | HTTP |
| 9200 | OpenSearch REST API | HTTPS |
| 5601 | OpenSearch Dashboards | HTTP |
| 1514 | Wazuh Agent (syslog) | TCP/UDP |
| 1515 | Wazuh Agent enrollment | TCP |
| 55000 | Wazuh API | HTTPS |
| 9090 | Prometheus | HTTP |
| 3001 | Grafana | HTTP |
| 5672 | RabbitMQ AMQP | TCP |
| 15672 | RabbitMQ Management | HTTP |
| 9000/9001 | MinIO | HTTP |
| 8084 | Kestra | HTTP |
| 4317/4318 | OTel Collector | gRPC/HTTP |
Data Sources
Docker Containers ──▶ Fluent Bit ──▶ Fluentd ──▶ OpenSearch (logs-YYYY.MM.DD)
Servers/Endpoints ──▶ Wazuh Agent ──▶ Wazuh Manager ──▶ Fluentd ──▶ OpenSearch
CLM Backend ──▶ OpenSearch (audit-log-YYYY.MM.DD)
Prometheus ──▶ Grafana (visualization)
Multi-Tenant Architecture
Sistem mendukung multi-tenant melalui:
- OpenSearch Aliases dengan term filter
tenant_id - PostgreSQL untuk RBAC metadata per tenant
- JWT claims yang membawa
tenant_id
Next Steps
- System Architecture - Detail teknis
- Data Flow - Alur data secara detail
- Network Topology - Topologi jaringan