# rehonor/zero-trust-postgres-vault architecture

> Architecture diagram of the GitHub repository rehonor/zero-trust-postgres-vault, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/rehonor/zero-trust-postgres-vault
- Repository: https://github.com/rehonor/zero-trust-postgres-vault

## Overview

This repository is an educational zero-trust PostgreSQL lab. The main workflow authenticates the demo client to Vault with AppRole, obtains short-lived database credentials, then connects to PostgreSQL over verified TLS. Separate branches provide a read-only monitoring dashboard and on-demand log alerts; a runnable insecure baseline supports before/after comparison. The README documents these system-level links; sampled source confirms client, dashboard, and alert behavior, but not every deployment detail.

Main entry points: [`postgres/init.sql`](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/postgres/init.sql) (PostgreSQL), [`dashboard/app.py`](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/dashboard/app.py) (Read-only dashboard), [`vault/vault-setup.sh`](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/vault/vault-setup.sh) (Vault), [`app/app.py`](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/app/app.py) (Demo client)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_identity["Identity and credentials"]
  node_demo_client["Demo client<br/>[app.py]"]
  node_vault["Vault<br/>[vault-setup.sh]"]
  node_vault_policies["Identity policies"]
end

subgraph group_database["Database security"]
  node_postgres[("PostgreSQL<br/>[init.sql]")]
  node_tls_ca["TLS certificates<br/>[gen-certs.sh]"]
  node_monitor_schema["Monitor schema<br/>[monitor.sql]"]
end

subgraph group_observability["Monitoring and dashboard"]
  node_pg_logs["PostgreSQL audit logs"]
  node_dashboard["Read-only dashboard<br/>[app.py]"]
  node_alert_report["Alert report<br/>[monitor.py]"]
end

subgraph group_comparison["Baseline comparison"]
  node_baseline["Insecure baseline<br/>[run.sh]"]
end

node_developer(("Demo operator"))
node_viewer(("Dashboard viewer"))
node_baseline_operator(("Baseline operator"))

node_developer -->|"runs commands"| node_demo_client
node_demo_client -->|"authenticates; requests credentials"| node_vault
node_vault -->|"creates and revokes users"| node_postgres
node_demo_client -->|"queries over TLS"| node_postgres
node_vault_policies -->|"limits identities"| node_vault
node_tls_ca -->|"signs certificate"| node_postgres
node_viewer -->|"views panels"| node_dashboard
node_dashboard -->|"authenticates; requests credentials"| node_vault
node_dashboard -->|"runs restricted queries"| node_postgres
node_monitor_schema -.->|"restricts monitoring access"| node_postgres
node_postgres -->|"writes audit logs"| node_pg_logs
node_pg_logs -->|"read-only mount"| node_dashboard
node_pg_logs -->|"feeds log analysis"| node_alert_report
node_baseline_operator -->|"runs comparison"| node_baseline

click node_demo_client "https://github.com/rehonor/zero-trust-postgres-vault/blob/main/app/app.py"
click node_vault "https://github.com/rehonor/zero-trust-postgres-vault/blob/main/vault/vault-setup.sh"
click node_vault_policies "https://github.com/rehonor/zero-trust-postgres-vault/tree/main/vault/policies"
click node_postgres "https://github.com/rehonor/zero-trust-postgres-vault/blob/main/postgres/init.sql"
click node_tls_ca "https://github.com/rehonor/zero-trust-postgres-vault/blob/main/scripts/gen-certs.sh"
click node_monitor_schema "https://github.com/rehonor/zero-trust-postgres-vault/blob/main/postgres/monitor.sql"
click node_pg_logs "https://github.com/rehonor/zero-trust-postgres-vault/tree/main/postgres"
click node_dashboard "https://github.com/rehonor/zero-trust-postgres-vault/blob/main/dashboard/app.py"
click node_alert_report "https://github.com/rehonor/zero-trust-postgres-vault/blob/main/scripts/monitor.py"
click node_baseline "https://github.com/rehonor/zero-trust-postgres-vault/blob/main/baseline/run.sh"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_demo_client,node_vault,node_vault_policies,node_viewer toneBlue
class node_postgres,node_tls_ca,node_monitor_schema toneAmber
class node_pg_logs,node_dashboard,node_alert_report toneMint
class node_baseline toneRose
class node_developer,node_baseline_operator toneIndigo
```

## Components

### Identity and credentials

- [Demo client](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/app/app.py): `app/app.py`
- [Vault](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/vault/vault-setup.sh): `vault/vault-setup.sh`
- [Identity policies](https://github.com/rehonor/zero-trust-postgres-vault/tree/main/vault/policies): `vault/policies`

### Database security

- [PostgreSQL](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/postgres/init.sql): `postgres/init.sql`
- [TLS certificates](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/scripts/gen-certs.sh): `scripts/gen-certs.sh`
- [Monitor schema](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/postgres/monitor.sql): `postgres/monitor.sql`

### Monitoring and dashboard

- [PostgreSQL audit logs](https://github.com/rehonor/zero-trust-postgres-vault/tree/main/postgres): `postgres`
- [Read-only dashboard](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/dashboard/app.py): `dashboard/app.py`
- [Alert report](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/scripts/monitor.py): `scripts/monitor.py`

### Baseline comparison

- [Insecure baseline](https://github.com/rehonor/zero-trust-postgres-vault/blob/main/baseline/run.sh): `baseline/run.sh`

### Other components

- **Demo operator**
- **Dashboard viewer**
- **Baseline operator**

## Connections

- Demo operator → Demo client: runs commands (evidence: `README.md`)
- Demo client → Vault: authenticates; requests credentials (evidence: `README.md`)
- Vault → PostgreSQL: creates and revokes users (evidence: `README.md`)
- Demo client → PostgreSQL: queries over TLS (evidence: `README.md`)
- Identity policies → Vault: limits identities (evidence: `README.md`)
- TLS certificates → PostgreSQL: signs certificate (evidence: `README.md`)
- Dashboard viewer → Read-only dashboard: views panels (evidence: `README.md`)
- Read-only dashboard → Vault: authenticates; requests credentials (evidence: `README.md`)
- Read-only dashboard → PostgreSQL: runs restricted queries (evidence: `README.md`)
- Monitor schema → PostgreSQL: restricts monitoring access
- PostgreSQL → PostgreSQL audit logs: writes audit logs (evidence: `README.md`)
- PostgreSQL audit logs → Read-only dashboard: read-only mount (evidence: `README.md`)
- PostgreSQL audit logs → Alert report: feeds log analysis (evidence: `README.md`)
- Baseline operator → Insecure baseline: runs comparison (evidence: `README.md`)