# c8m6/cci-ui architecture

> Architecture diagram of the GitHub repository c8m6/cci-ui, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/c8m6/cci-ui
- Repository: https://github.com/c8m6/cci-ui

## Overview

CCI-UI is a Rails web application for managing X.509 certificates across permission areas. Users search Consul and legacy filesystem inventories, preview and confirm imports, manage certificate versions and status, inspect chains, and export certificates or authorized keys. A separate request workflow creates CSRs and publishes matching issued certificates; CA inventory, Puppet distribution, audit, access control, and operations are supporting capabilities. The README documents these product relationships; sampled source confirms Consul client behavior and encrypted key handling, but most Rails service implementations were not sampled, so finer call ownership is not asserted.

Main entry points: [`app/controllers/certificates_controller.rb`](https://github.com/c8m6/cci-ui/blob/main/app/controllers/certificates_controller.rb) (Certificate workflows), [`app/controllers/certificate_requests_controller.rb`](https://github.com/c8m6/cci-ui/blob/main/app/controllers/certificate_requests_controller.rb) (Request workflow), [`app/services/consul_store.rb`](https://github.com/c8m6/cci-ui/blob/main/app/services/consul_store.rb) (Consul certificate store), [`app/services/certificate_search.rb`](https://github.com/c8m6/cci-ui/blob/main/app/services/certificate_search.rb) (Certificate search)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_catalog["Certificate catalog"]
  node_certificates["Certificate workflows"]
  node_search["Certificate search"]
  node_import["Certificate import"]
  node_export["Certificate export"]
  node_catalog_index["Catalog indexing<br/>[catalog_indexer.rb]"]
  node_consul_store[("Consul certificate store<br/>[consul_store.rb]")]
  node_legacy_store["Legacy file inventory<br/>[legacy_store.rb]"]
  node_vault["Encrypted key vault<br/>[vault.rb]"]
end

subgraph group_requests["Certificate requests"]
  node_requests_controller["Request workflow"]
  node_csr_generation["CSR generation<br/>[csr_generation.rb]"]
  node_csr_publication["Issued certificate publication<br/>[csr_publication.rb]"]
  node_request_store[("Request records")]
end

subgraph group_infrastructure["Infrastructure integrations"]
  node_ca_inventory["CA inventory"]
  node_puppet_reader["Puppet certificate client<br/>[cci_client.rb]"]
  node_consul_transport["Consul KV transport"]
  node_puppetdb["PuppetDB associations"]
end

subgraph group_access["Access and audit"]
  node_audit[("Audit records<br/>[audit_event.rb]")]
  node_oidc["OIDC authorization"]
end

subgraph group_operations["Operations"]
  node_health["Health and readiness"]
  node_logging["Structured logging<br/>[operational_log.rb]"]
end

node_user(("Certificate user"))
node_keycloak(("Keycloak identity"))
node_puppetdb_service(("PuppetDB service"))
node_consul[("Consul service")]
node_filesystem[("Certificate files")]

node_user -->|"manages"| node_certificates
node_certificates -->|"searches"| node_search
node_certificates -->|"imports"| node_import
node_certificates -->|"exports"| node_export
node_search -->|"searches"| node_consul_store
node_search -->|"searches"| node_legacy_store
node_catalog_index -->|"indexes"| node_consul_store
node_import -->|"stores versions"| node_consul_store
node_import -->|"reads files"| node_legacy_store
node_export -->|"decrypts keys"| node_vault
node_user -->|"requests certificates"| node_requests_controller
node_requests_controller -->|"creates CSR"| node_csr_generation
node_requests_controller -->|"retains requests"| node_request_store
node_requests_controller -->|"publishes matching cert"| node_csr_publication
node_csr_publication -->|"publishes"| node_consul_store
node_ca_inventory -.->|"reads inventory"| node_consul
node_puppet_reader -->|"uses transport"| node_consul_transport
node_consul_transport -->|"reads and writes"| node_consul
node_puppetdb -->|"queries hosts"| node_puppetdb_service
node_oidc -->|"authenticates"| node_keycloak
node_user -->|"actions recorded"| node_audit
node_export -->|"records exports"| node_audit
node_health -.->|"checks service"| node_consul
node_health -.->|"checks service"| node_puppetdb_service
node_logging -->|"logs transactions"| node_consul_transport

click node_certificates "https://github.com/c8m6/cci-ui/blob/main/app/controllers/certificates_controller.rb"
click node_search "https://github.com/c8m6/cci-ui/blob/main/app/services/certificate_search.rb"
click node_import "https://github.com/c8m6/cci-ui/blob/main/app/services/certificate_import.rb"
click node_export "https://github.com/c8m6/cci-ui/blob/main/app/services/certificate_export.rb"
click node_catalog_index "https://github.com/c8m6/cci-ui/blob/main/app/services/catalog_indexer.rb"
click node_consul_store "https://github.com/c8m6/cci-ui/blob/main/app/services/consul_store.rb"
click node_legacy_store "https://github.com/c8m6/cci-ui/blob/main/app/services/legacy_store.rb"
click node_vault "https://github.com/c8m6/cci-ui/blob/main/lib/certificates/vault.rb"
click node_requests_controller "https://github.com/c8m6/cci-ui/blob/main/app/controllers/certificate_requests_controller.rb"
click node_csr_generation "https://github.com/c8m6/cci-ui/blob/main/app/services/csr_generation.rb"
click node_csr_publication "https://github.com/c8m6/cci-ui/blob/main/app/services/csr_publication.rb"
click node_request_store "https://github.com/c8m6/cci-ui/blob/main/app/models/certificate_request.rb"
click node_ca_inventory "https://github.com/c8m6/cci-ui/blob/main/app/services/ca_inventory_refresh.rb"
click node_puppet_reader "https://github.com/c8m6/cci-ui/blob/main/integrations/puppet/cci/lib/cci_client.rb"
click node_consul_transport "https://github.com/c8m6/cci-ui/blob/main/lib/consul_connection.rb"
click node_puppetdb "https://github.com/c8m6/cci-ui/blob/main/app/services/puppetdb_inventory.rb"
click node_audit "https://github.com/c8m6/cci-ui/blob/main/app/models/audit_event.rb"
click node_oidc "https://github.com/c8m6/cci-ui/blob/main/app/services/oidc_authorization.rb"
click node_health "https://github.com/c8m6/cci-ui/blob/main/app/services/application_health.rb"
click node_logging "https://github.com/c8m6/cci-ui/blob/main/lib/operational_log.rb"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_certificates,node_search,node_import,node_export,node_catalog_index,node_consul_store,node_legacy_store,node_vault,node_user toneBlue
class node_requests_controller,node_csr_generation,node_csr_publication,node_request_store,node_consul,node_filesystem toneAmber
class node_ca_inventory,node_puppet_reader,node_consul_transport,node_puppetdb toneMint
class node_audit,node_oidc toneRose
class node_health,node_logging,node_keycloak,node_puppetdb_service toneIndigo
```

## Components

### Certificate catalog

- [Certificate workflows](https://github.com/c8m6/cci-ui/blob/main/app/controllers/certificates_controller.rb): `app/controllers/certificates_controller.rb`
- [Certificate search](https://github.com/c8m6/cci-ui/blob/main/app/services/certificate_search.rb): `app/services/certificate_search.rb`
- [Certificate import](https://github.com/c8m6/cci-ui/blob/main/app/services/certificate_import.rb): `app/services/certificate_import.rb`
- [Certificate export](https://github.com/c8m6/cci-ui/blob/main/app/services/certificate_export.rb): `app/services/certificate_export.rb`
- [Catalog indexing](https://github.com/c8m6/cci-ui/blob/main/app/services/catalog_indexer.rb): `app/services/catalog_indexer.rb`
- [Consul certificate store](https://github.com/c8m6/cci-ui/blob/main/app/services/consul_store.rb): `app/services/consul_store.rb`
- [Legacy file inventory](https://github.com/c8m6/cci-ui/blob/main/app/services/legacy_store.rb): `app/services/legacy_store.rb`
- [Encrypted key vault](https://github.com/c8m6/cci-ui/blob/main/lib/certificates/vault.rb): `lib/certificates/vault.rb`

### Certificate requests

- [Request workflow](https://github.com/c8m6/cci-ui/blob/main/app/controllers/certificate_requests_controller.rb): `app/controllers/certificate_requests_controller.rb`
- [CSR generation](https://github.com/c8m6/cci-ui/blob/main/app/services/csr_generation.rb): `app/services/csr_generation.rb`
- [Issued certificate publication](https://github.com/c8m6/cci-ui/blob/main/app/services/csr_publication.rb): `app/services/csr_publication.rb`
- [Request records](https://github.com/c8m6/cci-ui/blob/main/app/models/certificate_request.rb): `app/models/certificate_request.rb`

### Infrastructure integrations

- [CA inventory](https://github.com/c8m6/cci-ui/blob/main/app/services/ca_inventory_refresh.rb): `app/services/ca_inventory_refresh.rb`
- [Puppet certificate client](https://github.com/c8m6/cci-ui/blob/main/integrations/puppet/cci/lib/cci_client.rb): `integrations/puppet/cci/lib/cci_client.rb`
- [Consul KV transport](https://github.com/c8m6/cci-ui/blob/main/lib/consul_connection.rb): `lib/consul_connection.rb`
- [PuppetDB associations](https://github.com/c8m6/cci-ui/blob/main/app/services/puppetdb_inventory.rb): `app/services/puppetdb_inventory.rb`

### Access and audit

- [Audit records](https://github.com/c8m6/cci-ui/blob/main/app/models/audit_event.rb): `app/models/audit_event.rb`
- [OIDC authorization](https://github.com/c8m6/cci-ui/blob/main/app/services/oidc_authorization.rb): `app/services/oidc_authorization.rb`

### Operations

- [Health and readiness](https://github.com/c8m6/cci-ui/blob/main/app/services/application_health.rb): `app/services/application_health.rb`
- [Structured logging](https://github.com/c8m6/cci-ui/blob/main/lib/operational_log.rb): `lib/operational_log.rb`

### Other components

- **Certificate user**
- **Keycloak identity**
- **PuppetDB service**
- **Consul service**
- **Certificate files**

## Connections

- Certificate user → Certificate workflows: manages (evidence: `README.md`)
- Certificate workflows → Certificate search: searches (evidence: `README.md`)
- Certificate workflows → Certificate import: imports (evidence: `README.md`)
- Certificate workflows → Certificate export: exports (evidence: `README.md`)
- Certificate search → Consul certificate store: searches (evidence: `README.md`)
- Certificate search → Legacy file inventory: searches (evidence: `README.md`)
- Catalog indexing → Consul certificate store: indexes (evidence: `README.md`)
- Certificate import → Consul certificate store: stores versions (evidence: `README.md`)
- Certificate import → Legacy file inventory: reads files (evidence: `README.md`)
- Certificate export → Encrypted key vault: decrypts keys (evidence: `README.md`)
- Certificate user → Request workflow: requests certificates (evidence: `README.md`)
- Request workflow → CSR generation: creates CSR (evidence: `README.md`)
- Request workflow → Request records: retains requests (evidence: `README.md`)
- Request workflow → Issued certificate publication: publishes matching cert (evidence: `README.md`)
- Issued certificate publication → Consul certificate store: publishes (evidence: `README.md`)
- CA inventory → Consul service: reads inventory
- Puppet certificate client → Consul KV transport: uses transport (evidence: `integrations/puppet/cci/lib/cci_client.rb`)
- Consul KV transport → Consul service: reads and writes (evidence: `lib/consul_connection.rb`)
- PuppetDB associations → PuppetDB service: queries hosts (evidence: `README.md`)
- OIDC authorization → Keycloak identity: authenticates (evidence: `README.md`)
- Certificate user → Audit records: actions recorded (evidence: `README.md`)
- Certificate export → Audit records: records exports (evidence: `README.md`)
- Health and readiness → Consul service: checks service
- Health and readiness → PuppetDB service: checks service
- Structured logging → Consul KV transport: logs transactions (evidence: `lib/consul_connection.rb`)