# fleptor/cipher architecture

> Architecture diagram of the GitHub repository fleptor/cipher, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/fleptor/cipher
- Repository: https://github.com/fleptor/cipher

## Overview

CIPHER is a network-security router with an eBPF packet-filtering agent and a cloud control plane. The router inspects traffic, reports telemetry, and receives policy or device-state commands over a WebSocket; the server exposes user, network, and device management APIs and can request AI threat analysis. The README is only a project description, so capabilities and connections here are grounded in sampled source and the source index; unsampled implementation details are not expanded.

Main entry points: [`Server/src/handlers.rs`](https://github.com/fleptor/cipher/blob/main/Server/src/handlers.rs) (Network and device handlers), [`Server/src/main.rs`](https://github.com/fleptor/cipher/blob/main/Server/src/main.rs) (HTTP and WebSocket server), [`ROUTER/daemon/src/main.rs`](https://github.com/fleptor/cipher/blob/main/ROUTER/daemon/src/main.rs) (Router daemon), [`ROUTER/ebpf/src/kernel_space.c`](https://github.com/fleptor/cipher/blob/main/ROUTER/ebpf/src/kernel_space.c) (eBPF packet filter)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_packet["Packet inspection"]
  node_kernel["eBPF packet filter<br/>[kernel_space.c]"]
  node_shared["Packet data definitions<br/>[shared_defs.h]"]
end

subgraph group_agent["Router agent"]
  node_router_agent["Router daemon<br/>[main.rs]"]
  node_router_protocol["Router message schema"]
  node_router_store[("Telemetry fallback store<br/>[main.rs]")]
end

subgraph group_control["Cloud control plane"]
  node_api["HTTP and WebSocket server<br/>[main.rs]"]
  node_handlers["Network and device handlers<br/>[handlers.rs]"]
  node_auth["Authentication<br/>[auth.rs]"]
  node_models["Domain models<br/>[models.rs]"]
  node_server_store[("Control-plane database<br/>[main.rs]")]
  node_wire_schema["Shared message schema"]
end

subgraph group_intel["Threat intelligence"]
  node_anomaly["Statistical anomaly detection<br/>[ai.rs]"]
  node_llm["LLM supervisor<br/>[ai.rs]"]
end

node_operator(("Network operator"))
node_device(("Managed devices"))
node_osint["OSINT feeds"]
node_anthropic["Anthropic API"]

node_device -->|"sends traffic"| node_kernel
node_kernel -->|"uses structures"| node_shared
node_router_agent -->|"loads eBPF"| node_kernel
node_router_agent -->|"encodes telemetry"| node_router_protocol
node_router_agent -->|"stores failed reports"| node_router_store
node_router_agent -->|"connects by WebSocket"| node_api
node_api -->|"routes requests"| node_handlers
node_api -->|"initializes database"| node_server_store
node_api -->|"initializes secrets"| node_auth
node_handlers -->|"checks credentials"| node_auth
node_handlers -->|"uses domain types"| node_models
node_handlers -->|"reads and updates"| node_server_store
node_handlers -->|"builds responses"| node_wire_schema
node_handlers -->|"requests verdict"| node_llm
node_llm -->|"requests analysis"| node_anthropic
node_api -->|"refreshes threat intel"| node_anomaly
node_anomaly -->|"fetches threat feeds"| node_osint
node_operator -.->|"uses management API"| node_api
node_router_agent -.->|"shares message format"| node_wire_schema

click node_kernel "https://github.com/fleptor/cipher/blob/main/ROUTER/ebpf/src/kernel_space.c"
click node_shared "https://github.com/fleptor/cipher/blob/main/ROUTER/ebpf/src/shared_defs.h"
click node_router_agent "https://github.com/fleptor/cipher/blob/main/ROUTER/daemon/src/main.rs"
click node_router_protocol "https://github.com/fleptor/cipher/blob/main/ROUTER/daemon/src/router_generated.rs"
click node_router_store "https://github.com/fleptor/cipher/blob/main/ROUTER/daemon/src/main.rs"
click node_api "https://github.com/fleptor/cipher/blob/main/Server/src/main.rs"
click node_handlers "https://github.com/fleptor/cipher/blob/main/Server/src/handlers.rs"
click node_auth "https://github.com/fleptor/cipher/blob/main/Server/src/auth.rs"
click node_models "https://github.com/fleptor/cipher/blob/main/Server/src/models.rs"
click node_server_store "https://github.com/fleptor/cipher/blob/main/Server/src/main.rs"
click node_wire_schema "https://github.com/fleptor/cipher/blob/main/Server/src/router_generated.rs"
click node_anomaly "https://github.com/fleptor/cipher/blob/main/Server/src/ai.rs"
click node_llm "https://github.com/fleptor/cipher/blob/main/Server/src/ai.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_kernel,node_shared toneBlue
class node_router_agent,node_router_protocol,node_router_store toneAmber
class node_api,node_handlers,node_auth,node_models,node_server_store,node_wire_schema,node_anthropic toneMint
class node_anomaly,node_llm toneRose
class node_operator,node_device,node_osint toneIndigo
```

## Components

### Packet inspection

- [eBPF packet filter](https://github.com/fleptor/cipher/blob/main/ROUTER/ebpf/src/kernel_space.c): `ROUTER/ebpf/src/kernel_space.c`
- [Packet data definitions](https://github.com/fleptor/cipher/blob/main/ROUTER/ebpf/src/shared_defs.h): `ROUTER/ebpf/src/shared_defs.h`

### Router agent

- [Router daemon](https://github.com/fleptor/cipher/blob/main/ROUTER/daemon/src/main.rs): `ROUTER/daemon/src/main.rs`
- [Router message schema](https://github.com/fleptor/cipher/blob/main/ROUTER/daemon/src/router_generated.rs): `ROUTER/daemon/src/router_generated.rs`
- [Telemetry fallback store](https://github.com/fleptor/cipher/blob/main/ROUTER/daemon/src/main.rs): `ROUTER/daemon/src/main.rs`

### Cloud control plane

- [HTTP and WebSocket server](https://github.com/fleptor/cipher/blob/main/Server/src/main.rs): `Server/src/main.rs`
- [Network and device handlers](https://github.com/fleptor/cipher/blob/main/Server/src/handlers.rs): `Server/src/handlers.rs`
- [Authentication](https://github.com/fleptor/cipher/blob/main/Server/src/auth.rs): `Server/src/auth.rs`
- [Domain models](https://github.com/fleptor/cipher/blob/main/Server/src/models.rs): `Server/src/models.rs`
- [Control-plane database](https://github.com/fleptor/cipher/blob/main/Server/src/main.rs): `Server/src/main.rs`
- [Shared message schema](https://github.com/fleptor/cipher/blob/main/Server/src/router_generated.rs): `Server/src/router_generated.rs`

### Threat intelligence

- [Statistical anomaly detection](https://github.com/fleptor/cipher/blob/main/Server/src/ai.rs): `Server/src/ai.rs`
- [LLM supervisor](https://github.com/fleptor/cipher/blob/main/Server/src/ai.rs): `Server/src/ai.rs`

### Other components

- **Network operator**
- **Managed devices**
- **OSINT feeds**
- **Anthropic API**

## Connections

- Managed devices → eBPF packet filter: sends traffic (evidence: `ROUTER/ebpf/src/kernel_space.c`)
- eBPF packet filter → Packet data definitions: uses structures (evidence: `ROUTER/ebpf/src/kernel_space.c`)
- Router daemon → eBPF packet filter: loads eBPF (evidence: `ROUTER/daemon/src/main.rs`)
- Router daemon → Router message schema: encodes telemetry (evidence: `ROUTER/daemon/src/main.rs`)
- Router daemon → Telemetry fallback store: stores failed reports (evidence: `ROUTER/daemon/src/main.rs`)
- Router daemon → HTTP and WebSocket server: connects by WebSocket (evidence: `ROUTER/daemon/src/main.rs`)
- HTTP and WebSocket server → Network and device handlers: routes requests (evidence: `Server/src/main.rs`)
- HTTP and WebSocket server → Control-plane database: initializes database (evidence: `Server/src/main.rs`)
- HTTP and WebSocket server → Authentication: initializes secrets (evidence: `Server/src/main.rs`)
- Network and device handlers → Authentication: checks credentials (evidence: `Server/src/handlers.rs`)
- Network and device handlers → Domain models: uses domain types (evidence: `Server/src/handlers.rs`)
- Network and device handlers → Control-plane database: reads and updates (evidence: `Server/src/handlers.rs`)
- Network and device handlers → Shared message schema: builds responses (evidence: `Server/src/handlers.rs`)
- Network and device handlers → LLM supervisor: requests verdict (evidence: `Server/src/handlers.rs`)
- LLM supervisor → Anthropic API: requests analysis (evidence: `Server/src/ai.rs`)
- HTTP and WebSocket server → Statistical anomaly detection: refreshes threat intel (evidence: `Server/src/main.rs`)
- Statistical anomaly detection → OSINT feeds: fetches threat feeds (evidence: `Server/src/ai.rs`)
- Network operator → HTTP and WebSocket server: uses management API
- Router daemon → Shared message schema: shares message format