Skip to content

Commit 95f746d

Browse files
Shayan-GhaniShayan-Ghani
authored
Merge pull request #39 from Shayan-Ghani/diagram
feat : diagram as code boundary and vault workflow
2 parents f0d5530 + 3b8f496 commit 95f746d

File tree

5 files changed

+144
-25
lines changed

5 files changed

+144
-25
lines changed

‎.github/workflows/wiki.yml‎

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
11
# Simple workflow for deploying static content to GitHub Pages
2-
name: Deploy static content to Pages
2+
name: Deploy Wiki to Pages
33

44
on:
55
# Runs on pushes targeting the default branch
66
push:
7-
branches: ["main"]
7+
branches:
8+
- main
9+
paths:
10+
- 'wiki/**'
11+
812

913
# Allows you to run this workflow manually from the Actions tab
1014
workflow_dispatch:
@@ -22,7 +26,32 @@ concurrency:
2226
cancel-in-progress: false
2327

2428
jobs:
25-
# Single deploy job since we're just deploying
29+
generate_diagrams:
30+
runs-on: ubuntu-latest
31+
defaults:
32+
run:
33+
working-directory: "artifacts/diagrams/"
34+
steps:
35+
- name: Checkout
36+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
37+
38+
- name: setup python
39+
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5
40+
with:
41+
python-version: '3.10'
42+
cache: 'pip'
43+
44+
- name: install diagram as code library
45+
run: |
46+
pip install -U pip
47+
pip install diagrams
48+
49+
- name: generate diagrams
50+
run: |
51+
python vault.py
52+
python boundary.py
53+
mv *.png ${{github.workspace}}/artifacts/wiki/
54+
2655
deploy-wiki:
2756
environment:
2857
name: github-pages

‎artifacts/diagrams/boundary.py‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
from diagrams import Diagram, Cluster, Edge, Node
2+
from diagrams.onprem.compute import Server
3+
from diagrams.onprem.auth import Boundary
4+
from diagrams.onprem.security import Vault
5+
from diagrams.onprem.database import PostgreSQL
6+
from diagrams.oci.governance import Audit, Logging
7+
8+
9+
graph_attr = {
10+
"fontname": "Roboto",
11+
"fontsize": "24"
12+
}
13+
14+
with Diagram("Boundary server Workflow", show=False, direction="LR", graph_attr=graph_attr, filename="boundary"):
15+
boundary_controller = Boundary("Boundary Controller")
16+
boundary_worker = Boundary("Boundary Worker")
17+
vault = Vault("Vault Transit Engine")
18+
19+
with Cluster("Listeners"):
20+
api_listener = Server("API Listener")
21+
cluster_listener = Server("Cluster Listener")
22+
proxy_listener = Server("Proxy Listener")
23+
Node(label="", width="2", height="0", style="invisible")
24+
25+
26+
with Cluster("Audit Event Sinks"):
27+
audit_file_sink = Audit("Controller")
28+
auth_sink = Audit("Auth Observation")
29+
session_sink = Audit("Session Authorization")
30+
Node(label="", width="2", height="0", style="invisible")
31+
stderr_sink = Logging("Stderr Sink")
32+
33+
with Cluster("KMS Keys"):
34+
recovery_key = Boundary("recovery")
35+
worker_auth = Boundary("worker-ath")
36+
root_key = Boundary("root")
37+
38+
postgres= PostgreSQL("Postgresql")
39+
40+
# Controller connections
41+
boundary_controller >> Edge(label="TCP connection") >> cluster_listener
42+
boundary_controller >> Edge(label="Audit File Events") >> auth_sink
43+
boundary_controller >> Edge(label="All-events") >> stderr_sink
44+
45+
# Worker connections
46+
boundary_worker >> Edge(label="Connected to Controller") >> boundary_controller
47+
48+
# KMS connections
49+
worker_auth >> Edge() >> vault
50+
recovery_key >> Edge() >> vault
51+
root_key >> Edge() >> vault
52+
root_key << Edge(attrs="penwidth: 2.0") << boundary_controller
53+
54+
# DB connections
55+
postgres << Edge(label="DB Connection") << boundary_controller

‎artifacts/diagrams/vault.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
from diagrams import Diagram, Cluster, Edge, Node
2+
from diagrams.onprem.security import Vault
3+
from diagrams.generic.storage import Storage
4+
from diagrams.onprem.client import Users
5+
6+
with Diagram("\nVault Server Workflow", show=False, direction="RL", graph_attr={"fontname" : "arial", "fontsize": "28" }, filename="vault"):
7+
cluster_attr= {
8+
"margin" : "20",
9+
"fontsize": "16",
10+
"fontname" : "arial"}
11+
12+
with Cluster("Vault Setup", graph_attr=cluster_attr):
13+
vault_listener = Vault("TCP Listener")
14+
storage_raft = Storage("\nRaft Storage")
15+
vault_ui = Vault("UI")
16+
17+
with Cluster("User Management", graph_attr=cluster_attr):
18+
userpass_lockout = Users("\nUserpass Lockout")
19+
users = Users("\nUsers")
20+
21+
# Vault connections
22+
vault_listener - Edge(label="0.0.0.0:8200\nTLS Disabled") >> [storage_raft, vault_ui]
23+
vault_listener >> Edge(label="Max Entry Size\n1MB") >> storage_raft
24+
25+
# User Management connections
26+
users >> Edge(label="Lockout Threshold: 3\nLockout Duration: 10m") >> userpass_lockout
27+
28+
# External connections
29+
api_addr = Vault("API Address\nhttp://localhost:8200")
30+
cluster_addr = Vault("Cluster Address\nhttp://127.0.0.1:8201")
31+
32+
vault_listener >> Edge(label="API and Cluster Addresses") >> [api_addr, cluster_addr]

‎artifacts/wiki/index.html‎

Lines changed: 7 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -87,30 +87,15 @@ <h2 id="about-hashicorp-vault-and-boundary" class="section-header">About Hashico
8787
<h2 id="workflows" class="section-header">Workflows</h2>
8888
<h3 id="vault" class="section-header">Vault</h3>
8989
<p>Vault workflow involves setting up authentication methods, secret engines, and policies. The key
90-
components include:</p>
91-
<ul>
92-
<li><span class="bold">Auth Methods</span>: How users and applications authenticate to Vault.</li>
93-
<li><span class="bold">Secret Engines</span>: Where secrets are stored, such as key-value pairs,
94-
database credentials, or
95-
encryption keys.</li>
96-
<li><span class="bold">Policies</span>: Rules that define what actions an authenticated user or
97-
service can perform within
98-
Vault.</li>
99-
</ul>
100-
90+
components of Vault server setup include:</p>
91+
<img src="./vault.png" alt="vault diagram">
92+
10193
<h3 id="boundary" class="section-header">Boundary</h3>
102-
<p>Boundary workflow involves managing sessions, targets, and credentials. The key components include:
94+
<p>Boundary workflow involves managing sessions, targets, and credentials. The key
95+
components of Boundary server setup include:
10396
</p>
104-
<ul>
105-
<li><span class="bold">Sessions</span>: Establish secure, just-in-time access to resources.</li>
106-
<li><span class="bold">Targets</span>: The infrastructure resources that users need access to, such
107-
as servers or
108-
databases.
109-
</li>
110-
<li><span class="bold">Credential Stores</span>: Where dynamic or static credentials are retrieved
111-
for access to targets.
112-
</li>
113-
</ul>
97+
<img src="./boundary.png" alt="vault diagram">
98+
11499
</div>
115100

116101

‎artifacts/wiki/style.css‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,24 @@ a:hover {
204204
margin-bottom: var(--margin-small);
205205
}
206206

207+
/* workflows */
208+
.workflows {
209+
display: flex;
210+
flex-direction: column;
211+
max-width: 100%;
212+
margin: 0 auto;
213+
padding: 20px;
214+
}
215+
.workflows img {
216+
width: 100%;
217+
max-width: 700px;
218+
height: auto;
219+
margin-bottom: 20px;
220+
object-fit: contain;
221+
border-radius: 8px;
222+
box-shadow: 0 4px 8px rgba(0, 0, 0, 0.1);
223+
align-self: center;
224+
}
207225

208226

209227

0 commit comments

Comments
 (0)