# meoluoi-del/at_internet architecture

> Architecture diagram of the GitHub repository meoluoi-del/at_internet, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/meoluoi-del/at_internet
- Repository: https://github.com/meoluoi-del/at_internet

## Overview

This repository implements a Docker-based centralized NAC/AAA system: network access requests are authenticated against LDAP, assigned role-based VLAN policy by FreeRADIUS, and recorded in MariaDB. Administrators use a Flask dashboard to manage users and policies, review accounting/audit data, and respond to brute-force activity. The dashboard also provides MFA and SSO capabilities. The principal flow and service integrations are documented in the README; dashboard module relationships are supported by the source index and excerpts, while unsampled FreeRADIUS configuration details are not inferred beyond documented behavior.

Main entry points: [`dashboard/app.py`](https://github.com/meoluoi-del/at_internet/blob/main/dashboard/app.py) (Flask admin dashboard), [`dashboard/ldap_client.py`](https://github.com/meoluoi-del/at_internet/blob/main/dashboard/ldap_client.py) (LDAP user management), [`dashboard/detector.py`](https://github.com/meoluoi-del/at_internet/blob/main/dashboard/detector.py) (Brute-force detector), [`radius/sites-available/default`](https://github.com/meoluoi-del/at_internet/blob/main/radius/sites-available/default) (FreeRADIUS AAA)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_network_access["Network Access"]
  node_radius["FreeRADIUS AAA"]
end

subgraph group_identity_policy["Identity and Policy"]
  node_ldap[("OpenLDAP directory<br/>[init-ldap.ldif]")]
  node_mariadb[("MariaDB AAA and policy data<br/>[init-policy.sql]")]
end

subgraph group_operations["Administration and Defense"]
  node_dashboard["Flask admin dashboard<br/>[app.py]"]
  node_dashboard_ui["Dashboard pages"]
  node_db_manager["Database manager<br/>[models.py]"]
  node_ldap_client["LDAP user management<br/>[ldap_client.py]"]
  node_detector["Brute-force detector<br/>[detector.py]"]
  node_config["Dashboard configuration<br/>[config.py]"]
end

subgraph group_auth_extensions["Authentication Extensions"]
  node_mfa["TOTP MFA<br/>[mfa.py]"]
  node_sso["SSO and JWT<br/>[sso.py]"]
end

node_nas(("Network device / NAS"))
node_network_user(("Network user"))
node_admin_auditor(("Admin / auditor"))
node_sso_client["Registered SSO client"]

node_nas -->|"sends AAA requests"| node_radius
node_radius -->|"authenticates identities"| node_ldap
node_radius -->|"reads group membership"| node_ldap
node_radius -->|"reads VLAN policy"| node_mariadb
node_radius -->|"records accounting"| node_mariadb
node_network_user -->|"requests network access"| node_nas
node_admin_auditor -->|"uses dashboard"| node_dashboard
node_dashboard -->|"renders pages"| node_dashboard_ui
node_dashboard -->|"manages records"| node_db_manager
node_dashboard -->|"manages users"| node_ldap_client
node_dashboard -->|"exposes alerts"| node_detector
node_dashboard -->|"verifies TOTP"| node_mfa
node_dashboard -->|"creates tokens"| node_sso
node_dashboard -->|"reads user group"| node_ldap_client
node_db_manager -->|"reads and writes"| node_mariadb
node_ldap_client -->|"reads and updates"| node_ldap
node_detector -->|"queries failed attempts"| node_mariadb
node_detector -->|"checks membership"| node_ldap_client
node_detector -->|"quarantines user"| node_ldap_client
node_detector -->|"records audit event"| node_db_manager
node_dashboard -->|"issues authorization code"| node_sso_client
node_dashboard -->|"looks up SSO group"| node_ldap_client
node_dashboard -->|"stores SSO codes"| node_db_manager
node_dashboard -->|"loads settings"| node_config
node_db_manager -->|"loads database settings"| node_config
node_ldap_client -->|"loads LDAP settings"| node_config
node_detector -->|"loads thresholds"| node_config

click node_radius "https://github.com/meoluoi-del/at_internet/blob/main/radius/sites-available/default"
click node_ldap "https://github.com/meoluoi-del/at_internet/blob/main/ldap/init-ldap.ldif"
click node_mariadb "https://github.com/meoluoi-del/at_internet/blob/main/sql/init-policy.sql"
click node_dashboard "https://github.com/meoluoi-del/at_internet/blob/main/dashboard/app.py"
click node_dashboard_ui "https://github.com/meoluoi-del/at_internet/tree/main/dashboard/templates"
click node_db_manager "https://github.com/meoluoi-del/at_internet/blob/main/dashboard/models.py"
click node_ldap_client "https://github.com/meoluoi-del/at_internet/blob/main/dashboard/ldap_client.py"
click node_detector "https://github.com/meoluoi-del/at_internet/blob/main/dashboard/detector.py"
click node_config "https://github.com/meoluoi-del/at_internet/blob/main/dashboard/config.py"
click node_mfa "https://github.com/meoluoi-del/at_internet/blob/main/dashboard/mfa.py"
click node_sso "https://github.com/meoluoi-del/at_internet/blob/main/dashboard/sso.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_radius,node_network_user,node_sso_client toneBlue
class node_ldap,node_mariadb toneAmber
class node_dashboard,node_dashboard_ui,node_db_manager,node_ldap_client,node_detector,node_config toneMint
class node_mfa,node_sso toneRose
class node_nas,node_admin_auditor toneIndigo
```

## Components

### Network Access

- [FreeRADIUS AAA](https://github.com/meoluoi-del/at_internet/blob/main/radius/sites-available/default): `radius/sites-available/default`

### Identity and Policy

- [OpenLDAP directory](https://github.com/meoluoi-del/at_internet/blob/main/ldap/init-ldap.ldif): `ldap/init-ldap.ldif`
- [MariaDB AAA and policy data](https://github.com/meoluoi-del/at_internet/blob/main/sql/init-policy.sql): `sql/init-policy.sql`

### Administration and Defense

- [Flask admin dashboard](https://github.com/meoluoi-del/at_internet/blob/main/dashboard/app.py): `dashboard/app.py`
- [Dashboard pages](https://github.com/meoluoi-del/at_internet/tree/main/dashboard/templates): `dashboard/templates`
- [Database manager](https://github.com/meoluoi-del/at_internet/blob/main/dashboard/models.py): `dashboard/models.py`
- [LDAP user management](https://github.com/meoluoi-del/at_internet/blob/main/dashboard/ldap_client.py): `dashboard/ldap_client.py`
- [Brute-force detector](https://github.com/meoluoi-del/at_internet/blob/main/dashboard/detector.py): `dashboard/detector.py`
- [Dashboard configuration](https://github.com/meoluoi-del/at_internet/blob/main/dashboard/config.py): `dashboard/config.py`

### Authentication Extensions

- [TOTP MFA](https://github.com/meoluoi-del/at_internet/blob/main/dashboard/mfa.py): `dashboard/mfa.py`
- [SSO and JWT](https://github.com/meoluoi-del/at_internet/blob/main/dashboard/sso.py): `dashboard/sso.py`

### Other components

- **Network device / NAS**
- **Network user**
- **Admin / auditor**
- **Registered SSO client**

## Connections

- Network device / NAS → FreeRADIUS AAA: sends AAA requests (evidence: `README.md`)
- FreeRADIUS AAA → OpenLDAP directory: authenticates identities (evidence: `README.md`)
- FreeRADIUS AAA → OpenLDAP directory: reads group membership (evidence: `README.md`)
- FreeRADIUS AAA → MariaDB AAA and policy data: reads VLAN policy (evidence: `README.md`)
- FreeRADIUS AAA → MariaDB AAA and policy data: records accounting (evidence: `README.md`)
- Network user → Network device / NAS: requests network access (evidence: `README.md`)
- Admin / auditor → Flask admin dashboard: uses dashboard (evidence: `README.md`)
- Flask admin dashboard → Dashboard pages: renders pages (evidence: `dashboard/app.py`)
- Flask admin dashboard → Database manager: manages records (evidence: `dashboard/app.py`)
- Flask admin dashboard → LDAP user management: manages users (evidence: `dashboard/app.py`)
- Flask admin dashboard → Brute-force detector: exposes alerts (evidence: `dashboard/app.py`)
- Flask admin dashboard → TOTP MFA: verifies TOTP (evidence: `dashboard/app.py`)
- Flask admin dashboard → SSO and JWT: creates tokens (evidence: `dashboard/app.py`)
- Flask admin dashboard → LDAP user management: reads user group (evidence: `dashboard/app.py`)
- Database manager → MariaDB AAA and policy data: reads and writes (evidence: `dashboard/models.py`)
- LDAP user management → OpenLDAP directory: reads and updates (evidence: `dashboard/ldap_client.py`)
- Brute-force detector → MariaDB AAA and policy data: queries failed attempts (evidence: `dashboard/detector.py`)
- Brute-force detector → LDAP user management: checks membership (evidence: `dashboard/detector.py`)
- Brute-force detector → LDAP user management: quarantines user (evidence: `dashboard/detector.py`)
- Brute-force detector → Database manager: records audit event (evidence: `dashboard/detector.py`)
- Flask admin dashboard → Registered SSO client: issues authorization code (evidence: `dashboard/app.py`)
- Flask admin dashboard → LDAP user management: looks up SSO group (evidence: `dashboard/app.py`)
- Flask admin dashboard → Database manager: stores SSO codes (evidence: `dashboard/app.py`)
- Flask admin dashboard → Dashboard configuration: loads settings (evidence: `dashboard/app.py`)
- Database manager → Dashboard configuration: loads database settings (evidence: `dashboard/models.py`)
- LDAP user management → Dashboard configuration: loads LDAP settings (evidence: `dashboard/ldap_client.py`)
- Brute-force detector → Dashboard configuration: loads thresholds (evidence: `dashboard/detector.py`)