DenozordecandCursor
ebadf70e2b
API, UI, Linux/MikroTik agents, IP lists, политики, stats, CI и интеграция с auth-portal/EvoBGP. Co-authored-by: Cursor <cursoragent@cursor.com>
1.3 KiB
1.3 KiB
Архитектура EvoFirewall
Централизованный control plane для firewall-агентов (Linux nft/ipset, MikroTik address-list).
Компоненты
| Компонент | Путь | Роль |
|---|---|---|
| Web SPA | apps/web |
ReUI Frame, TanStack Router/Query |
| API | apps/api |
Fastify 5, JWT + agent tokens |
| DB | packages/db |
Drizzle + SQLite WAL |
| Shared | packages/shared |
Zod-контракты, RBAC helpers |
| UI | packages/ui |
shadcn primitives @evofw/ui |
| Agents | apps/api/src/agent-scripts |
install.sh, sync, MikroTik RSC |
Потоки
- Enroll —
POST /v1/agent/enroll+X-EvoFW-Seed→ pending agent - Approve — UI/API → status approved
- Policy —
GET /v1/agent/policy→ deny/allow CIDRs + mode + hash - Apply — agent пишет kernel rules,
POST /v1/agent/apply-report+ stats sample - Lists refresh — cron каждые 5 мин (json_url / domains / evobgp_community)
Политика
blacklist— default accept, apply deny setwhitelist— default drop, apply allow set (+ lo/established на Linux)- Overrides и clone-from бампят
policy_generation
Auth
- Portal SSO app id
fw, permissionsfw:* - Agent bearer token (sha256 hash в БД)