How veops/oneterm works
OneTerm is an enterprise bastion host: users authenticate, discover authorized assets, connect through a controlled jump point, and have privileged activity audited. The tree and README establish the broader access-control, session-recording, and PAM capabilities; the sampled code most directly confirms storage configuration and file/replay storage behavior. Some subsystem wiring is therefore shown only where the repository structure or documentation supports it.
Main entry points: session.go Domain services · connect.go API controllers · router.go HTTP API · storage.go File and replay storage
Components 22
User entry
- OneTerm UI
oneterm-ui/src/App.vue - UI API clients
oneterm-ui/src/modules/oneterm/api/connect.js - HTTP API
backend/internal/api/router/router.go - API controllers
backend/internal/api/controller/connect.go
Access governance
- Authentication
backend/internal/api/middleware/auth.go - Access policy
backend/internal/acl/acl.go - Asset inventory
backend/internal/service/asset.go - Authorization rules
backend/internal/service/authorization.go - Domain services
backend/internal/service/session.go
Remote access
- Protocol connectors
backend/internal/connector/handlers.go - SSH jump server
backend/internal/sshsrv/sshsrv.go
Audit and storage
- Session lifecycle
backend/internal/session/session.go - History and audit
backend/internal/service/history.go - File and replay storage
backend/internal/service/storage.go - Storage metadata
backend/internal/repository/storage.go - Storage providers
backend/pkg/storage/providers/local.go
Privileged operations
- PAM workflows
backend/internal/service/pam_request.go
Other components
- Operator
- Veops CMDB
- Application database
backend/pkg/db/database.go - Managed systems
- ITSM service
Connections 22
- Operator → OneTerm UI: uses
- OneTerm UI → UI API clients: requests
- UI API clients → HTTP API: calls API
- HTTP API → Authentication: authenticates
- HTTP API → API controllers: dispatches
- API controllers → Access policy: checks access
- API controllers → Domain services: invokes
- Domain services → Application database: reads and writes
- Domain services → Asset inventory: manages assets
- Asset inventory → Veops CMDB: imports assets
- Domain services → Authorization rules: evaluates rules
- API controllers → Protocol connectors: starts connection
- Protocol connectors → Managed systems: connects by protocol
- Operator → SSH jump server: opens SSH access
- SSH jump server → Protocol connectors: handles sessions
- Domain services → Session lifecycle: manages sessions
- Domain services → History and audit: records activity
- Session lifecycle → File and replay storage: saves replay
- File and replay storage → Storage metadata: reads metadata
- File and replay storage → Storage providers: stores files
- PAM workflows → Application database: persists workflow
- PAM workflows → ITSM service: requests approval