How adreaskar/securedrop works
SecureDrop provides authenticated file transfer with quarantine, antivirus scanning, status tracking, and approved-file delivery. The documented main flow runs from the web app through the API into MinIO and PostgreSQL, then through an event-driven scanner and workflow automation before recipients can download approved files. The README documents RabbitMQ and Node-RED in that scan workflow; their wiring and source are not present in the supplied tree, so those relationships are shown only as documented integrations.
Main entry points: src/index.js Scanner service · src/index.js API server · App.tsx SecureDrop UI · files.js File routes
Components 20
Web app
- SecureDrop UI
webapp/src/App.tsx - Auth session
webapp/src/hooks/useAuth.tsx - File views
webapp/src/components/FileUpload.tsx - Sent files
webapp/src/pages/Dashboard.tsx - Received files
webapp/src/pages/Inbox.tsx
Identity
- Keycloak
Transfer API
- API server
api/src/index.js - File routes
api/src/routes/files.js - JWT verification
api/src/middleware/auth.js - Object storage service
api/src/services/minio.js - MinIO buckets
- Transfer records
api/src/services/database.js - PostgreSQL
Scanning workflow
- Scanner service
stateless-scanner/src/index.js - RabbitMQ
- ClamAV
- Bucket workflow
- ThingsBoard telemetry
Other components
- Sender
- Recipient
Connections 26
- Sender → SecureDrop UI: uses
- SecureDrop UI → Auth session: initializes
- Auth session → Keycloak: authenticates
- SecureDrop UI → API server: calls file API
- API server → File routes: dispatches
- File routes → JWT verification: verifies JWT
- JWT verification → Keycloak: gets signing keys
- File routes → Object storage service: stores and streams
- Object storage service → MinIO buckets: reads and writes
- File routes → Transfer records: manages transfers
- Transfer records → PostgreSQL: reads and writes
- File routes → RabbitMQ: storage event
- RabbitMQ → Scanner service: dispatches event
- Scanner service → Object storage service: reads object
- Scanner service → ClamAV: scans stream
- Scanner service → MinIO buckets: moves object
- Scanner service → API server: posts scan status
- Scanner service → Bucket workflow: status workflow
- Scanner service → ThingsBoard telemetry: telemetry
- SecureDrop UI → Sent files: renders
- SecureDrop UI → Received files: renders
- Sent files → API server: polls sent files
- Received files → API server: polls received files
- Recipient → SecureDrop UI: uses
- Received files → API server: requests download
- API server → Recipient: streams approved file