donghyeon.kang/document-haness
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat: 가상화 문서들 추가

Browse Source
This commit is contained in:
DongHyeonka
2026-09-10 08:54:05 +09:00
parent e9f6a93327
commit 43e1aadef0
695 changed files with 153404 additions and 12754 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/keycloak/final/assets/ap4-edge-trust-architecture/ap4-edge-trust-architecture.alt.md
+9 -9
View File
@@ -10,15 +10,15 @@
## Elements and evidence
- **Boundary: External browser** (system): AP4_SESSION을 애플리케이션의 공개 entry point로 보내는 외부 client 경계. Evidence: L914–L919, L980–L999.
- **Boundary: AP4 deployment path** (system): Host-published Nginx와 host 비공개 oauth2-proxy 및 Spring app이 연결되는 deployment 경계. Evidence: L914–L914, L1093–L1093.
- **Browser** (actor): Opaque AP4_SESSION을 자동 첨부해 공개 edge endpoint를 호출한다. Evidence: L980–L999.
- **Nginx edge** (service): Internal auth subrequest를 만들고 검증 결과를 allowlisted upstream header로 다시 조립하는 공개 gateway. Evidence: L914–L928, L1009–L1028.
- **Spring upstream** (service): 정제된 user header와 Nginx-owned internal token을 함께 검증하는 /edge/me upstream. Evidence: L1017–L1037, L1065–L1078.
- **oauth2-proxy** (service): Confidential edge-proxy client이자 AP4_SESSION의 유효성을 판단하는 host 비공개 auth service. Evidence: L940–L990, L1009–L1014.
- **Boundary: External browser** (system): AP4_SESSION을 애플리케이션의 공개 entry point로 보내는 외부 client 경계. Evidence: L952–L957, L1018–L1039.
- **Boundary: AP4 deployment path** (system): Host-published Nginx와 host 비공개 oauth2-proxy 및 Spring app이 연결되는 deployment 경계. Evidence: L952–L952, L1133–L1133.
- **Browser** (actor): Opaque AP4_SESSION을 자동 첨부해 공개 edge endpoint를 호출한다. Evidence: L1018–L1039.
- **Nginx edge** (service): Internal auth subrequest를 만들고 검증 결과를 allowlisted upstream header로 다시 조립하는 공개 gateway. Evidence: L952–L966, L1049–L1068.
- **Spring upstream** (service): 정제된 user header와 Nginx-owned internal token을 함께 검증하는 /edge/me upstream. Evidence: L1057–L1077, L1105–L1118.
- **oauth2-proxy** (service): Confidential edge-proxy client이자 AP4_SESSION의 유효성을 판단하는 host 비공개 auth service. Evidence: L978–L1028, L1049–L1054.
## Relationships
- **Browser → Nginx edge:** GET /api/edge · AP4_SESSION. Evidence: L994–L999.
- **Nginx edge → oauth2-proxy:** internal /oauth2/auth subrequest. Evidence: L922–L928, L1009–L1009.
- **Nginx edge → Spring upstream:** allowlisted identity + internal token. Evidence: L1017–L1026, L1065–L1078.
- **Browser → Nginx edge:** AP4_SESSION. Evidence: L1034–L1039.
- **Nginx edge → oauth2-proxy:** auth subrequest. Evidence: L960–L966, L1049–L1049.
- **Nginx edge → Spring upstream:** identity. Evidence: L1057–L1066, L1105–L1118.