Skip to content

Domain Structure

The Cloud Backend is organized using Domain-Driven Design. All business logic lives in Backend/internal/domain/, split into ~35 bounded context packages.

Package map

flowchart TD
    subgraph Core
        auth[auth] --> tenant[tenant]
        tenant --> rbac[rbac]
        rbac --> audit[audit]
        audit --> settings[settings]
    end

    subgraph CMDB
        assets[assets] --> sites[sites]
        sites --> zones[zones]
        zones --> vendors[vendors]
        vendors --> edge_pkg[edge]
    end

    subgraph ITSM
        incidents[incidents] --> problems[problems]
        problems --> changes[changes]
        changes --> releases[releases]
        releases --> pir[pir]
        pir --> servicerequest[servicerequest]
        servicerequest --> maintenance[maintenance]
    end

    subgraph Security [Security - optional]
        sec[security] --> vulnerabilities[vulnerabilities]
        vulnerabilities --> cvefeed[cvefeed]
        cvefeed --> compliance[compliance]
        compliance --> playbooks[playbooks]
        playbooks --> attacktechniques[attacktechniques]
    end

    subgraph Operations [Operations - optional]
        backup[backup] --> vpn[vpn]
        vpn --> devices[devices]
    end

    subgraph Knowledge
        knowledge[knowledge] --> diagrams_pkg[diagrams]
    end

    subgraph Platform
        billing[billing] --> notifications[notifications]
        notifications --> integrations[integrations]
        integrations --> admin[admin]
        admin --> mgmt_pkg[management]
    end

    Core --> CMDB
    Core --> ITSM
    Core --> Platform

Domain descriptions

Core

Package	Responsibility
`auth`	Login, registration, TOTP MFA, OIDC callbacks, password reset, invitations
`tenant`	Tenant CRUD, onboarding flow, tenant status (pending/active)
`rbac`	Groups, permission assignment, catalog
`audit`	Immutable audit_logs for all mutating operations, retention policy, export
`settings`	License info, OIDC config, SSH/API keys, SLA policies, priority matrix

CMDB

Package	Responsibility
`assets`	Asset CRUD, metadata, lifecycle, supervision, cross-links to ITSM
`sites`	Physical site registry
`zones`	Network zones and VLANs
`vendors`	Vendor registry, security assessments, vendor portal
`edge`	Edge appliance provisioning keys and registration

ITSM

Package	Responsibility
`incidents`	Full incident lifecycle, SLA tracking, priority matrix, major incidents
`problems`	Problem records, root cause, workaround, links to incidents
`changes`	ITIL change requests, multi-stage approvals, state machine
`releases`	Release management, links to changes
`pir`	Post-incident reviews
`servicerequest`	Service catalog and request lifecycle
`maintenance`	Maintenance windows, calendar, email notifications

Security (optional — `VITE_FEATURE_SECURITY=true`)

Package	Responsibility
`security`	Alert inbox, investigation terminal, SOC workflows
`vulnerabilities`	CVE records, remediation tracking, asset matching
`cvefeed`	NVD CVE API sync, CISA KEV sync, scheduled jobs
`compliance`	Frameworks, controls, evidence, posture scoring
`playbooks`	Automated alert response rules
`attacktechniques`	MITRE ATT&CK technique catalog and heatmap data

Operations (optional modules)

Package	Responsibility
`backup`	Backup repositories, folders, files (SHA-256 checksums), schedules, jobs
`vpn`	VPN gateways, access policies, session management
`devices`	Edge device command dispatch, OTA snap updates

Knowledge

Package	Responsibility
`knowledge`	Markdown articles, tags, publication status, ITSM cross-links
`diagrams`	Network diagrams (ReactFlow JSON), CRUD, versioning

Platform

Package	Responsibility
`billing`	License enforcement (blocks login for `pending` tenants)
`notifications`	In-app notification badge, email via Resend
`integrations`	Webhook ingest (`POST /integrations/ingest/:token`)
`admin`	Cross-tenant admin CRUD (requires `ADMIN_PANEL_ENABLED=true`)
`management`	M2M client for Management Backend communication

Backend/internal/domain/<package>/
├── handler.go     # HTTP handlers
├── service.go     # Business logic
└── repository.go  # sqlx queries

The route for each domain is registered in Backend/internal/app/register_<package>.go.