39 lines
779 B
Plaintext
39 lines
779 B
Plaintext
flowchart LR
|
|
ATT[External Attacker]
|
|
|
|
subgraph Z0[Untrusted Network]
|
|
U[User/Admin Browsers]
|
|
AG[Agents]
|
|
end
|
|
|
|
subgraph Z1[Edge Trust Boundary]
|
|
T[Traefik]
|
|
end
|
|
|
|
subgraph Z2[Keywarden Trusted Zone]
|
|
N[Nginx]
|
|
APP[Keywarden App]
|
|
DB[(PostgreSQL)]
|
|
R[(Redis/Valkey)]
|
|
CA[(CA Private Keys)]
|
|
end
|
|
|
|
subgraph Z3[Managed Host Zone]
|
|
SSH[sshd + local accounts]
|
|
end
|
|
|
|
U -->|HTTPS| T -->|HTTPS| N --> APP
|
|
AG -->|HTTPS/mTLS path| T
|
|
AG --> SSH
|
|
APP --> DB
|
|
APP --> R
|
|
APP --> CA
|
|
|
|
ATT -.credential theft / token misuse.-> T
|
|
ATT -.injection / auth bypass attempts.-> APP
|
|
ATT -.MITM if proxy TLS/mTLS misconfigured.-> N
|
|
ATT -.host compromise impact.-> SSH
|
|
|
|
Note1[Key Risk: CA private keys are central high-value assets]
|
|
CA --- Note1
|