diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/design/overview.md | 21 |
1 files changed, 14 insertions, 7 deletions
diff --git a/docs/design/overview.md b/docs/design/overview.md index 2d257c7..9818aa1 100644 --- a/docs/design/overview.md +++ b/docs/design/overview.md @@ -113,13 +113,19 @@ Databases All user data is stored using BigCouch, a decentralized and high-availability version of CouchDB. -There are three "main" databases: +The databases are used by the different services and sometimes work as communication channels between the services. -* users -- stores basic information about each user, such as their username, a SRP password verifier, and any email aliases or forwards. -* tickets -- database of help desk tickets. -* client_certificates -- a pool of short-lived client x.509 certificates that are distributed to authenticated clients when their client certificate has expired. +These are the databases we currently use: -Additionally, each user may have multiple databases for storing client-encrypted data, such as email messages. +* customers -- payment information for the webapp +* identities -- alias information, written by the webapp, read by leap_mx and nickserver +* keycache -- used by the nickserver +* sessions -- web session persistance for the webapp +* shared -- used by soledad +* tickets -- help tickets issued in the webapp +* tokens -- created by the webapp on login, used by soledad to authenticate +* users -- user records used by the webapp including the authentication data +* user-...id... -- client-encrypted data for the user with the given id accessed from the client via soledad Like many NoSQL databases, BigCouch is inspired by [Amazon's Dynamo paper](http://www.allthingsdistributed.com/files/amazon-dynamo-sosp2007.pdf) and works by sharding each database among many servers using a circular ring hash. The number of shards might be greater than the number of servers, in which case each server would have multiple shards of the same database. Each server in the BigCouch cluster appears to contain the entire database, but actually it will just proxy the request to the actual database that has the content (if it does not have the document itself). @@ -151,6 +157,7 @@ The Web App communicates with: * CouchDB is used for all data storage. * Web browsers of users accessing the user interface in order to edit their settings or fill out help tickets. Additionally, admins may delete users. * LEAP Clients access the web app's REST API in order to register new users, authenticate existing ones, and renew client certificates. +* tokens are stored upon successful authentication to allow the client to authenticate against other services Nickserver ------------------------------ @@ -185,7 +192,7 @@ A LEAP service provider might also run servers with the following services: * git -- private git repository hosting. * Domain Name Server -- Authoritative name server for the provider's domain. -* CA Daemon -- headless daemon that generates x.509 certificates and puts them in the distributed database. +* Tapicero -- headless daemon that watches couch changes for new users and creates their databases Client-side Components ====================================== @@ -382,4 +389,4 @@ Workflow: * webapp retrieves client cert from a pool of pre-generated certificates. * cert pool is filled as needed by background CA deamon. * client connects to openvpn gateway, picked from among those listed in service definition file, authenticating with client certificate. -* by default, when user starts computer the next time, client autoconnects.
\ No newline at end of file +* by default, when user starts computer the next time, client autoconnects. |