# certimate-go/certimate architecture

> Architecture diagram of the GitHub repository certimate-go/certimate, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/certimate-go/certimate
- Repository: https://github.com/certimate-go/certimate

## Overview

Certimate is a self-hosted certificate lifecycle manager. Users configure workflows through its REST-facing application, then workflows orchestrate issuance, deployment, and notification; scheduled runs support automation and renewal. The graph includes ACME DNS/HTTP challenges, certificate destinations, and local persistence as distinct concerns. README capabilities are shown at subsystem level; sampled engine and provider excerpts support the workflow execution and deployment links, while wiring for unsampled modules is intentionally kept high-level.

Main entry points: [`internal/workflow/engine/executor_bizapply.go`](https://github.com/certimate-go/certimate/blob/main/internal/workflow/engine/executor_bizapply.go) (Workflow Executors), [`internal/repository`](https://github.com/certimate-go/certimate/tree/main/internal/repository) (Repositories), [`internal/rest/handlers/workflows.go`](https://github.com/certimate-go/certimate/blob/main/internal/rest/handlers/workflows.go) (REST Handlers), [`internal/workflow/service.go`](https://github.com/certimate-go/certimate/blob/main/internal/workflow/service.go) (Workflow Service)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_app["Application API"]
  node_routes["REST Routes<br/>[routes.go]"]
  node_handlers["REST Handlers<br/>[workflows.go]"]
  node_appcore["Application<br/>[app.go]"]
end

subgraph group_workflow["Workflow Runtime"]
  node_wfservice["Workflow Service<br/>[service.go]"]
  node_dispatcher["Workflow Dispatcher<br/>[dispatcher.go]"]
  node_engine["Workflow Engine<br/>[engine.go]"]
  node_executors["Workflow Executors"]
  node_scheduler["Scheduler<br/>[scheduler.go]"]
end

subgraph group_cert["Certificate Lifecycle"]
  node_certservice["Certificate Service<br/>[service.go]"]
  node_acme["ACME Client<br/>[client.go]"]
  node_challenge["Challenge Registry<br/>[registry.go]"]
  node_deployclient["Deployment Client<br/>[client.go]"]
  node_deployregistry["Deployment Registry<br/>[registry.go]"]
end

subgraph group_integrations["External Integrations"]
  node_notifyservice["Notification Service<br/>[service.go]"]
  node_notifyregistry["Notifier Registry<br/>[registry.go]"]
  node_acmeprovider{{"ACME CA"}}
  node_dnsproviders["DNS Providers"]
  node_deploytargets["Deployment Targets"]
  node_notifytargets["Notification Channels"]
end

subgraph group_state["Persistence and Metrics"]
  node_repositories["Repositories"]
  node_pbstore[("Local Store<br/>[pbstore.go]")]
  node_statistics["Statistics Service<br/>[service.go]"]
end

node_operator(("Operator"))

node_operator -->|"submits requests"| node_routes
node_routes -->|"dispatches"| node_handlers
node_handlers -->|"manages workflows"| node_wfservice
node_appcore -->|"serves API"| node_routes
node_appcore -->|"starts jobs"| node_scheduler
node_scheduler -->|"dispatches runs"| node_dispatcher
node_wfservice -->|"queues runs"| node_dispatcher
node_dispatcher -->|"executes workflow"| node_engine
node_engine -->|"selects node executor"| node_executors
node_executors -->|"requests certificates"| node_certservice
node_certservice -->|"obtains or revokes"| node_acme
node_acme -->|"uses challenge provider"| node_challenge
node_challenge -->|"updates DNS"| node_dnsproviders
node_acme -->|"requests issuance"| node_acmeprovider
node_executors -->|"deploys certificates"| node_deployclient
node_deployclient -->|"creates deployer"| node_deployregistry
node_deployregistry -->|"dispatches deployment"| node_deploytargets
node_executors -->|"sends notifications"| node_notifyservice
node_notifyservice -->|"selects notifier"| node_notifyregistry
node_notifyregistry -->|"delivers messages"| node_notifytargets
node_wfservice -->|"reads and writes"| node_repositories
node_engine -->|"persists outputs"| node_repositories
node_repositories -->|"stores records"| node_pbstore
node_handlers -->|"queries metrics"| node_statistics
node_statistics -->|"reads statistics"| node_repositories

click node_routes "https://github.com/certimate-go/certimate/blob/main/internal/rest/routes/routes.go"
click node_handlers "https://github.com/certimate-go/certimate/blob/main/internal/rest/handlers/workflows.go"
click node_appcore "https://github.com/certimate-go/certimate/blob/main/internal/app/app.go"
click node_wfservice "https://github.com/certimate-go/certimate/blob/main/internal/workflow/service.go"
click node_dispatcher "https://github.com/certimate-go/certimate/blob/main/internal/workflow/dispatcher/dispatcher.go"
click node_engine "https://github.com/certimate-go/certimate/blob/main/internal/workflow/engine/engine.go"
click node_executors "https://github.com/certimate-go/certimate/blob/main/internal/workflow/engine/executor_bizapply.go"
click node_scheduler "https://github.com/certimate-go/certimate/blob/main/internal/scheduler/scheduler.go"
click node_certservice "https://github.com/certimate-go/certimate/blob/main/internal/certificate/service.go"
click node_acme "https://github.com/certimate-go/certimate/blob/main/internal/certacme/client.go"
click node_challenge "https://github.com/certimate-go/certimate/blob/main/internal/certacme/certifiers/registry.go"
click node_deployclient "https://github.com/certimate-go/certimate/blob/main/internal/certmgmt/client.go"
click node_deployregistry "https://github.com/certimate-go/certimate/blob/main/internal/certmgmt/deployers/registry.go"
click node_notifyservice "https://github.com/certimate-go/certimate/blob/main/internal/notify/service.go"
click node_notifyregistry "https://github.com/certimate-go/certimate/blob/main/internal/notify/notifiers/registry.go"
click node_dnsproviders "https://github.com/certimate-go/certimate/tree/main/pkg/core/certifier/challengers/dns01"
click node_deploytargets "https://github.com/certimate-go/certimate/tree/main/pkg/core/deployer/providers"
click node_notifytargets "https://github.com/certimate-go/certimate/tree/main/internal/notify/notifiers"
click node_repositories "https://github.com/certimate-go/certimate/tree/main/internal/repository"
click node_pbstore "https://github.com/certimate-go/certimate/blob/main/internal/settings/pbstore.go"
click node_statistics "https://github.com/certimate-go/certimate/blob/main/internal/statistics/service.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_routes,node_handlers,node_appcore toneBlue
class node_wfservice,node_dispatcher,node_engine,node_executors,node_scheduler toneAmber
class node_certservice,node_acme,node_challenge,node_deployclient,node_deployregistry toneMint
class node_notifyservice,node_notifyregistry,node_acmeprovider,node_dnsproviders,node_deploytargets,node_notifytargets toneRose
class node_repositories,node_pbstore,node_statistics,node_operator toneIndigo
```

## Components

### Application API

- [REST Routes](https://github.com/certimate-go/certimate/blob/main/internal/rest/routes/routes.go): `internal/rest/routes/routes.go`
- [REST Handlers](https://github.com/certimate-go/certimate/blob/main/internal/rest/handlers/workflows.go): `internal/rest/handlers/workflows.go`
- [Application](https://github.com/certimate-go/certimate/blob/main/internal/app/app.go): `internal/app/app.go`

### Workflow Runtime

- [Workflow Service](https://github.com/certimate-go/certimate/blob/main/internal/workflow/service.go): `internal/workflow/service.go`
- [Workflow Dispatcher](https://github.com/certimate-go/certimate/blob/main/internal/workflow/dispatcher/dispatcher.go): `internal/workflow/dispatcher/dispatcher.go`
- [Workflow Engine](https://github.com/certimate-go/certimate/blob/main/internal/workflow/engine/engine.go): `internal/workflow/engine/engine.go`
- [Workflow Executors](https://github.com/certimate-go/certimate/blob/main/internal/workflow/engine/executor_bizapply.go): `internal/workflow/engine/executor_bizapply.go`
- [Scheduler](https://github.com/certimate-go/certimate/blob/main/internal/scheduler/scheduler.go): `internal/scheduler/scheduler.go`

### Certificate Lifecycle

- [Certificate Service](https://github.com/certimate-go/certimate/blob/main/internal/certificate/service.go): `internal/certificate/service.go`
- [ACME Client](https://github.com/certimate-go/certimate/blob/main/internal/certacme/client.go): `internal/certacme/client.go`
- [Challenge Registry](https://github.com/certimate-go/certimate/blob/main/internal/certacme/certifiers/registry.go): `internal/certacme/certifiers/registry.go`
- [Deployment Client](https://github.com/certimate-go/certimate/blob/main/internal/certmgmt/client.go): `internal/certmgmt/client.go`
- [Deployment Registry](https://github.com/certimate-go/certimate/blob/main/internal/certmgmt/deployers/registry.go): `internal/certmgmt/deployers/registry.go`

### External Integrations

- [Notification Service](https://github.com/certimate-go/certimate/blob/main/internal/notify/service.go): `internal/notify/service.go`
- [Notifier Registry](https://github.com/certimate-go/certimate/blob/main/internal/notify/notifiers/registry.go): `internal/notify/notifiers/registry.go`
- **ACME CA**
- [DNS Providers](https://github.com/certimate-go/certimate/tree/main/pkg/core/certifier/challengers/dns01): `pkg/core/certifier/challengers/dns01`
- [Deployment Targets](https://github.com/certimate-go/certimate/tree/main/pkg/core/deployer/providers): `pkg/core/deployer/providers`
- [Notification Channels](https://github.com/certimate-go/certimate/tree/main/internal/notify/notifiers): `internal/notify/notifiers`

### Persistence and Metrics

- [Repositories](https://github.com/certimate-go/certimate/tree/main/internal/repository): `internal/repository`
- [Local Store](https://github.com/certimate-go/certimate/blob/main/internal/settings/pbstore.go): `internal/settings/pbstore.go`
- [Statistics Service](https://github.com/certimate-go/certimate/blob/main/internal/statistics/service.go): `internal/statistics/service.go`

### Other components

- **Operator**

## Connections

- Operator → REST Routes: submits requests
- REST Routes → REST Handlers: dispatches
- REST Handlers → Workflow Service: manages workflows
- Application → REST Routes: serves API
- Application → Scheduler: starts jobs
- Scheduler → Workflow Dispatcher: dispatches runs
- Workflow Service → Workflow Dispatcher: queues runs
- Workflow Dispatcher → Workflow Engine: executes workflow
- Workflow Engine → Workflow Executors: selects node executor
- Workflow Executors → Certificate Service: requests certificates
- Certificate Service → ACME Client: obtains or revokes
- ACME Client → Challenge Registry: uses challenge provider
- Challenge Registry → DNS Providers: updates DNS
- ACME Client → ACME CA: requests issuance
- Workflow Executors → Deployment Client: deploys certificates
- Deployment Client → Deployment Registry: creates deployer
- Deployment Registry → Deployment Targets: dispatches deployment
- Workflow Executors → Notification Service: sends notifications
- Notification Service → Notifier Registry: selects notifier
- Notifier Registry → Notification Channels: delivers messages
- Workflow Service → Repositories: reads and writes
- Workflow Engine → Repositories: persists outputs
- Repositories → Local Store: stores records
- REST Handlers → Statistics Service: queries metrics
- Statistics Service → Repositories: reads statistics