# veops/oneterm architecture

> Architecture diagram of the GitHub repository veops/oneterm, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/veops/oneterm
- Repository: https://github.com/veops/oneterm

## Overview

OneTerm is an enterprise bastion host: users authenticate, discover authorized assets, connect through a controlled jump point, and have privileged activity audited. The tree and README establish the broader access-control, session-recording, and PAM capabilities; the sampled code most directly confirms storage configuration and file/replay storage behavior. Some subsystem wiring is therefore shown only where the repository structure or documentation supports it.

Main entry points: [`backend/internal/service/session.go`](https://github.com/veops/oneterm/blob/main/backend/internal/service/session.go) (Domain services), [`backend/internal/api/controller/connect.go`](https://github.com/veops/oneterm/blob/main/backend/internal/api/controller/connect.go) (API controllers), [`backend/internal/api/router/router.go`](https://github.com/veops/oneterm/blob/main/backend/internal/api/router/router.go) (HTTP API), [`backend/internal/service/storage.go`](https://github.com/veops/oneterm/blob/main/backend/internal/service/storage.go) (File and replay storage)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["User entry"]
  node_ui["OneTerm UI<br/>[App.vue]"]
  node_uiapi["UI API clients<br/>[connect.js]"]
  node_http["HTTP API<br/>[router.go]"]
  node_controllers["API controllers<br/>[connect.go]"]
end

subgraph group_access["Access governance"]
  node_auth["Authentication<br/>[auth.go]"]
  node_acl["Access policy<br/>[acl.go]"]
  node_assets["Asset inventory<br/>[asset.go]"]
  node_authorization["Authorization rules<br/>[authorization.go]"]
  node_services["Domain services<br/>[session.go]"]
end

subgraph group_connect["Remote access"]
  node_connector["Protocol connectors<br/>[handlers.go]"]
  node_sshsrv["SSH jump server<br/>[sshsrv.go]"]
end

subgraph group_audit["Audit and storage"]
  node_session["Session lifecycle<br/>[session.go]"]
  node_auditlog["History and audit<br/>[history.go]"]
  node_storage["File and replay storage<br/>[storage.go]"]
  node_storagecfg["Storage metadata<br/>[storage.go]"]
  node_providers["Storage providers<br/>[local.go]"]
end

subgraph group_pam["Privileged operations"]
  node_pam["PAM workflows<br/>[pam_request.go]"]
end

node_user(("Operator"))
node_cmdb["Veops CMDB"]
node_database[("Application database<br/>[database.go]")]
node_target["Managed systems"]
node_itsm["ITSM service"]

node_user -->|"uses"| node_ui
node_ui -->|"requests"| node_uiapi
node_uiapi -->|"calls API"| node_http
node_http -->|"authenticates"| node_auth
node_http -->|"dispatches"| node_controllers
node_controllers -->|"checks access"| node_acl
node_controllers -->|"invokes"| node_services
node_services -->|"reads and writes"| node_database
node_services -->|"manages assets"| node_assets
node_assets -.->|"imports assets"| node_cmdb
node_services -->|"evaluates rules"| node_authorization
node_controllers -->|"starts connection"| node_connector
node_connector -->|"connects by protocol"| node_target
node_user -->|"opens SSH access"| node_sshsrv
node_sshsrv -->|"handles sessions"| node_connector
node_services -->|"manages sessions"| node_session
node_services -->|"records activity"| node_auditlog
node_session -->|"saves replay"| node_storage
node_storage -->|"reads metadata"| node_storagecfg
node_storage -->|"stores files"| node_providers
node_pam -->|"persists workflow"| node_database
node_pam -.->|"requests approval"| node_itsm

click node_ui "https://github.com/veops/oneterm/blob/main/oneterm-ui/src/App.vue"
click node_uiapi "https://github.com/veops/oneterm/blob/main/oneterm-ui/src/modules/oneterm/api/connect.js"
click node_http "https://github.com/veops/oneterm/blob/main/backend/internal/api/router/router.go"
click node_auth "https://github.com/veops/oneterm/blob/main/backend/internal/api/middleware/auth.go"
click node_acl "https://github.com/veops/oneterm/blob/main/backend/internal/acl/acl.go"
click node_assets "https://github.com/veops/oneterm/blob/main/backend/internal/service/asset.go"
click node_authorization "https://github.com/veops/oneterm/blob/main/backend/internal/service/authorization.go"
click node_controllers "https://github.com/veops/oneterm/blob/main/backend/internal/api/controller/connect.go"
click node_services "https://github.com/veops/oneterm/blob/main/backend/internal/service/session.go"
click node_database "https://github.com/veops/oneterm/blob/main/backend/pkg/db/database.go"
click node_connector "https://github.com/veops/oneterm/blob/main/backend/internal/connector/handlers.go"
click node_sshsrv "https://github.com/veops/oneterm/blob/main/backend/internal/sshsrv/sshsrv.go"
click node_session "https://github.com/veops/oneterm/blob/main/backend/internal/session/session.go"
click node_auditlog "https://github.com/veops/oneterm/blob/main/backend/internal/service/history.go"
click node_storage "https://github.com/veops/oneterm/blob/main/backend/internal/service/storage.go"
click node_storagecfg "https://github.com/veops/oneterm/blob/main/backend/internal/repository/storage.go"
click node_providers "https://github.com/veops/oneterm/blob/main/backend/pkg/storage/providers/local.go"
click node_pam "https://github.com/veops/oneterm/blob/main/backend/internal/service/pam_request.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ui,node_uiapi,node_http,node_controllers toneBlue
class node_auth,node_acl,node_assets,node_authorization,node_services,node_database toneAmber
class node_connector,node_sshsrv toneMint
class node_session,node_auditlog,node_storage,node_storagecfg,node_providers toneRose
class node_pam,node_user,node_cmdb,node_target,node_itsm toneIndigo
```

## Components

### User entry

- [OneTerm UI](https://github.com/veops/oneterm/blob/main/oneterm-ui/src/App.vue): `oneterm-ui/src/App.vue`
- [UI API clients](https://github.com/veops/oneterm/blob/main/oneterm-ui/src/modules/oneterm/api/connect.js): `oneterm-ui/src/modules/oneterm/api/connect.js`
- [HTTP API](https://github.com/veops/oneterm/blob/main/backend/internal/api/router/router.go): `backend/internal/api/router/router.go`
- [API controllers](https://github.com/veops/oneterm/blob/main/backend/internal/api/controller/connect.go): `backend/internal/api/controller/connect.go`

### Access governance

- [Authentication](https://github.com/veops/oneterm/blob/main/backend/internal/api/middleware/auth.go): `backend/internal/api/middleware/auth.go`
- [Access policy](https://github.com/veops/oneterm/blob/main/backend/internal/acl/acl.go): `backend/internal/acl/acl.go`
- [Asset inventory](https://github.com/veops/oneterm/blob/main/backend/internal/service/asset.go): `backend/internal/service/asset.go`
- [Authorization rules](https://github.com/veops/oneterm/blob/main/backend/internal/service/authorization.go): `backend/internal/service/authorization.go`
- [Domain services](https://github.com/veops/oneterm/blob/main/backend/internal/service/session.go): `backend/internal/service/session.go`

### Remote access

- [Protocol connectors](https://github.com/veops/oneterm/blob/main/backend/internal/connector/handlers.go): `backend/internal/connector/handlers.go`
- [SSH jump server](https://github.com/veops/oneterm/blob/main/backend/internal/sshsrv/sshsrv.go): `backend/internal/sshsrv/sshsrv.go`

### Audit and storage

- [Session lifecycle](https://github.com/veops/oneterm/blob/main/backend/internal/session/session.go): `backend/internal/session/session.go`
- [History and audit](https://github.com/veops/oneterm/blob/main/backend/internal/service/history.go): `backend/internal/service/history.go`
- [File and replay storage](https://github.com/veops/oneterm/blob/main/backend/internal/service/storage.go): `backend/internal/service/storage.go`
- [Storage metadata](https://github.com/veops/oneterm/blob/main/backend/internal/repository/storage.go): `backend/internal/repository/storage.go`
- [Storage providers](https://github.com/veops/oneterm/blob/main/backend/pkg/storage/providers/local.go): `backend/pkg/storage/providers/local.go`

### Privileged operations

- [PAM workflows](https://github.com/veops/oneterm/blob/main/backend/internal/service/pam_request.go): `backend/internal/service/pam_request.go`

### Other components

- **Operator**
- **Veops CMDB**
- [Application database](https://github.com/veops/oneterm/blob/main/backend/pkg/db/database.go): `backend/pkg/db/database.go`
- **Managed systems**
- **ITSM service**

## Connections

- Operator → OneTerm UI: uses
- OneTerm UI → UI API clients: requests
- UI API clients → HTTP API: calls API
- HTTP API → Authentication: authenticates
- HTTP API → API controllers: dispatches
- API controllers → Access policy: checks access
- API controllers → Domain services: invokes
- Domain services → Application database: reads and writes
- Domain services → Asset inventory: manages assets
- Asset inventory → Veops CMDB: imports assets
- Domain services → Authorization rules: evaluates rules
- API controllers → Protocol connectors: starts connection
- Protocol connectors → Managed systems: connects by protocol
- Operator → SSH jump server: opens SSH access
- SSH jump server → Protocol connectors: handles sessions
- Domain services → Session lifecycle: manages sessions
- Domain services → History and audit: records activity
- Session lifecycle → File and replay storage: saves replay
- File and replay storage → Storage metadata: reads metadata
- File and replay storage → Storage providers: stores files
- PAM workflows → Application database: persists workflow
- PAM workflows → ITSM service: requests approval