Multi-tenant line-of-business application
Eleven components of a multi-tenant school application in three nested boundaries: a data center, the application network and a data zone. The main path from the user to the domain data is drawn straight and thicker, connections say what they do and over which protocol, and the description names the most connected component and what nothing leads into. Illustrative reference architecture, with a phone variant.
Multi-tenant line-of-business application
examples/tenant-architecture.json{
"schemaVersion": 1,
"type": "architecture",
"title": "Multi-tenant line-of-business application",
"source": "Illustrative reference architecture",
"width": 1200,
"height": 1100,
"architecture": {
"boundaries": [
{
"id": "rz",
"label": "Data center"
},
{
"id": "netz",
"label": "Application network",
"in": "rz"
},
{
"id": "daten",
"label": "Data zone",
"in": "netz"
}
],
"components": [
{
"id": "nutzer",
"label": "Teacher, parent",
"kind": "person"
},
{
"id": "browser",
"label": "Browser",
"kind": "frontend"
},
{
"id": "proxy",
"label": "Reverse proxy",
"sublabel": "TLS 1.3, WAF",
"kind": "security",
"in": "rz"
},
{
"id": "web",
"label": "Web / BFF",
"sublabel": "SvelteKit",
"in": "netz"
},
{
"id": "idp",
"label": "Sign-in",
"sublabel": "Keycloak, OIDC",
"kind": "security",
"in": "netz"
},
{
"id": "api",
"label": "Domain API",
"sublabel": "Rust",
"in": "netz"
},
{
"id": "db",
"label": "Domain data",
"sublabel": "Postgres, RLS per tenant",
"kind": "database",
"in": "daten"
},
{
"id": "audit",
"label": "Audit log",
"sublabel": "append only",
"kind": "database",
"in": "daten"
},
{
"id": "backup",
"label": "Backup",
"sublabel": "second site",
"kind": "storage"
},
{
"id": "alt",
"label": "School records",
"sublabel": "legacy system",
"kind": "external"
},
{
"id": "soc",
"label": "SIEM / SOC",
"kind": "external"
}
],
"connections": [
{
"from": "nutzer",
"to": "browser",
"label": "uses"
},
{
"from": "browser",
"to": "proxy",
"label": "calls",
"technology": "HTTPS"
},
{
"from": "proxy",
"to": "web",
"label": "forwards"
},
{
"from": "web",
"to": "idp",
"label": "signs in",
"technology": "OIDC"
},
{
"from": "web",
"to": "api",
"label": "queries",
"technology": "user context"
},
{
"from": "api",
"to": "db",
"label": "reads, writes",
"technology": "SQL/TLS"
},
{
"from": "api",
"to": "audit",
"label": "logs"
},
{
"from": "alt",
"to": "api",
"label": "master data",
"technology": "REST/JSON"
},
{
"from": "api",
"to": "soc",
"label": "events",
"technology": "Syslog",
"dash": "dashed"
},
{
"from": "db",
"to": "backup",
"label": "backs up",
"dash": "dashed"
}
],
"mainPath": [
"nutzer",
"browser",
"proxy",
"web",
"api",
"db"
],
"orientation": "portrait"
},
"mobile": {
"width": 464,
"height": 1180
}
}Focus
Source: Illustrative reference architecture
Show chart data
| Component | Kind | Boundary | Connects to |
|---|---|---|---|
| Teacher, parent | person | Browser (uses) | |
| Browser | frontend | Reverse proxy (calls, via HTTPS) | |
| School records | external system | Domain API (master data, via REST/JSON) | |
| Reverse proxy | security | Data center | Web / BFF (forwards) |
| Web / BFF | service | Data center › Application network | Sign-in (signs in, via OIDC), Domain API (queries, via user context) |
| Sign-in | security | Data center › Application network | |
| Domain API | service | Data center › Application network | Domain data (reads, writes, via SQL/TLS), Audit log (logs), SIEM / SOC (events, via Syslog) |
| Domain data | database | Data center › Application network › Data zone | Backup (backs up) |
| Audit log | database | Data center › Application network › Data zone | |
| Backup | storage | ||
| SIEM / SOC | external system |