Reference

Architecture

The estate as drawn, and the two integration contracts that hold it together. The drawing follows draw.io conventions — boxes on a grid, orthogonal connectors, moving dashes for traffic — and the editable source is below it.

Only the public edge faces the internet, and it does three things: terminate TLS, proxy, answer external DNS. Provisioning lives in a deployment automation enclave — DHCP, DNS, iPXE and TFTP never leave it; what crosses out is a customised image over HTTPS. Download the draw.io source.

Contract 01

Browser sign-in

The catalog sends the browser to Edy-Auth with the cookie name it is registered under, a state value and a return address. Edy-Auth runs the realm's factor chain, then redirects back with a single-use result id. The catalog never sees the password.

GET /api/v1/auth?cookie-name=…&state=…&RedirectTo=…

Contract 02

Result redemption

The catalog redeems that id server-to-server, exactly once — a replay fails — and receives the identity. Roles are then read through the admin API under a service account that exists only for that lookup.

GET /api/v1/authresult/{id} → identity · roles via /api/v1/admin/users/{guid}/roles/effective