Skip to content

Platform Components

Detailed Component Architecture and Interactions

Document Version: 1.0.0
Last Updated: 2026-02-10

1. Component Overview

MazeVault consists of four core components, each independently deployable:

graph LR
    subgraph Frontend["🖥️ Web Interface"]
        UI["⭐ React SPA"]
    end

    subgraph Backend["⚙️ API Server"]
        API["🌐 REST API"]
        Crypto["🔐 Encryption Engine"]
        PKI["📜 PKI Services"]
        Sync["🔄 Sync Engine"]
        Auth["🔑 Auth Provider"]
    end

    subgraph OCSP["🛡️ OCSP Responder"]
        OCSPSvc["✅ OCSP Service"]
    end

    subgraph Data["🗄️ Data Layer"]
        PG["🗃️ PostgreSQL"]
        RD["⚡ Redis"]
    end

    UI --> API
    API --> Crypto
    API --> PKI
    API --> Sync
    API --> Auth
    API --> PG
    API --> RD
    OCSPSvc --> PG

    classDef frontend fill:#EBF5FB,stroke:#2196F3,stroke-width:2px,color:#1565C0
    classDef backend fill:#E8EAF6,stroke:#3F51B5,stroke-width:2px,color:#283593
    classDef ocsp fill:#FFF8E1,stroke:#FF9800,stroke-width:2px,color:#E65100
    classDef data fill:#E8F5E9,stroke:#4CAF50,stroke-width:2px,color:#2E7D32

    class UI frontend
    class API,Crypto,PKI,Sync,Auth backend
    class OCSPSvc ocsp
    class PG,RD data

2. Web Interface

The MazeVault Web Interface is a Single Page Application providing:

  • Dashboard — Overview of secrets, certificates, sync status, and rotation schedules
  • Secrets Manager — Create, read, update, and delete secrets with version history
  • Certificate Manager — Request, approve, revoke, and manage certificates
  • PKI Administration — Certificate Authority management, CRL distribution, OCSP configuration
  • Access Control — Role-based access management, user and team administration
  • Project Management — Organize secrets and certificates into isolated projects
  • Agent Management — Register, monitor, and configure MazeVault agents

Key Features

Feature Description
Role-Based UI Interface adapts to user permissions — administrators see management controls, operators see operational views
Dark Mode Full light/dark theme support
Responsive Design Optimized for desktop and tablet form factors
Real-Time Updates WebSocket-based notifications for certificate events and sync status
Export Capabilities Export secrets and certificates in standard formats (PEM, PKCS#12, JKS)

3. API Server

The API Server is the core of the MazeVault platform, handling all business logic, encryption operations, and external integrations.

Service Categories

Core Services

Service Responsibility
Secrets Management Encrypted CRUD operations, versioning, sharing, rotation
Certificate Management CSR processing, issuance, revocation, renewal, import/export
Certificate Authority Root/Intermediate CA management, CRL generation, OCSP signing
Project Management Multi-tenant project isolation, resource organization
RBAC Role-based access control with granular permissions

PKI Services

Service Responsibility
SCEP Provider Simple Certificate Enrollment Protocol support
EST Provider Enrollment over Secure Transport support
ACME Provider Automated Certificate Management Environment support
CRL Distribution Certificate Revocation List generation and distribution

Integration Services

Service Responsibility
External CA Connectors DigiCert, Venafi, Microsoft ADCS, SSL Market, PostSignum
Cloud Key Vaults Azure Key Vault, AWS Secrets Manager
SSO Providers Azure Entra ID, GitHub, GitLab, LDAP, SAML 2.0
HSM Providers AWS CloudHSM, Azure Managed HSM, Google Cloud HSM, PKCS#11, Hardware wallets

Middleware Stack

All API requests pass through a security middleware chain:

  1. TLS Termination — Enforced at ingress/proxy level
  2. Rate Limiting — Configurable per-endpoint limits
  3. CORS Validation — Strict origin checking
  4. CSRF Protection — Double-submit cookie pattern
  5. Authentication — JWT validation, API key verification, or mTLS
  6. Authorization — RBAC permission check
  7. Audit Logging — All operations recorded with user context
  8. Request Validation — Input sanitization and schema validation

4. OCSP Responder

The OCSP Responder provides real-time certificate validation compliant with RFC 6960.

Capabilities

  • Real-time certificate status checks (Good, Revoked, Unknown)
  • Configurable response caching for performance
  • Prometheus metrics for monitoring
  • Independent scaling from the API Server
  • Kubernetes readiness and liveness probes

Endpoints

Endpoint Method Purpose
/ocsp POST OCSP request (DER-encoded)
/health GET Service health status
/ready GET Kubernetes readiness probe
/live GET Kubernetes liveness probe
/metrics GET Prometheus metrics

5. Data Layer

PostgreSQL

PostgreSQL serves as the primary persistent store for all platform data:

  • Secrets — Encrypted secret values, metadata, version history
  • Certificates — Certificate records, CA chains, revocation data
  • Access Control — Users, roles, permissions, project assignments
  • Audit Trail — Comprehensive operation logs
  • Configuration — System and project-level settings

All sensitive data is encrypted at the application level (AES-256-GCM) before database storage. Database-level SSL is enforced in production.

Redis

Redis provides high-performance caching and session management:

Use Case TTL Description
Session Cache 24h Authenticated user sessions
Secret Cache Configurable Frequently accessed secrets (encrypted)
Rate Limit Counters 1-60min Per-IP and per-user rate limiting
CSRF Tokens 30min Cross-site request forgery prevention

Resilience

MazeVault operates with a dual-mode cache: if Redis becomes unavailable, the system automatically falls back to an in-memory cache, ensuring continued operation with reduced performance.

6. Scalability Matrix

Component Min Replicas Max Replicas Scaling Method Notes
Web Interface 1 10+ HPA (CPU/Memory) Stateless, freely scalable
API Server 1 1* Vertical *Single replica due to license enforcement; contact support for multi-replica licensing
OCSP Responder 1 5+ HPA (Request rate) Stateless, read-only database access
PostgreSQL 1 3 Read replicas Primary + read replicas for reporting
Redis 1 3 Sentinel/Cluster Optional HA with Redis Sentinel