System Architecture & Components
AllSafeX is built as a modular microservice architecture combining a high-performance Go proxy gateway, a Django REST control plane, and responsive web/desktop interfaces.
Microservice Overview
The platform separates control-plane administration from data-plane proxying. This design guarantees that heavy SSH/RDP session traffic handled by the proxy engines does not degrade control-plane API responsiveness.
In high-availability configurations, multiple AllSafeX SSH Gateway nodes can be deployed behind a TCP load balancer (e.g., HAProxy or AWS NLB) sharing a centralized Core backend and PostgreSQL cluster.
Component Breakdown
1. Core (Control Plane & REST API)
Built on Django 4.2 and Python 3.11. Core serves as the central brain of AllSafeX. It manages user accounts, user permissions, asset inventories, organization hierarchies, and the REST API consumed by the frontend and desktop clients. Core handles password encryption, token generation, and audit indexing.
2. AllSafeX SSH Gateway (Port 2222)
Developed in Go for ultra-low memory footprint and high concurrent throughput. The AllSafeX SSH Gateway listens on port 2222. When an engineer connects via SSH, the gateway authenticates the session against the Control Plane, retrieves target credentials from the vault, negotiates the upstream SSH handshake, and streams audit recording frames to disk.
3. AllSafeX Web Console
A modern responsive single-page web console providing the primary administrative interface for managing users, permission policies, system settings, asset catalogs, and compliance reporting.
4. AllSafeX Web Terminal & Workbench
Integrates hardware-accelerated terminal emulation with WebSocket streaming to provide a zero-install, full-featured privileged terminal directly inside modern web browsers. Includes secure SFTP file transfer managers and multi-session multiplexing.
5. AllSafeX Remote Desktop Gateway
Translates native Windows RDP and Linux VNC protocols into secure HTML5 Canvas streaming over WebSockets, enabling audited remote desktop access directly in the browser without local client software.
6. Desktop Clients (AllSafeX JumpHost)
Cross-platform desktop application built on Electron. Distributed as a native .deb package for Linux and .exe / .msi installers for Windows. The desktop client embeds secure local terminal launchers and credential managers.
Network Port Matrix
Review the required firewall rules and port assignments for an AllSafeX deployment:
| Port | Protocol | Source | Target Component | Description |
|---|---|---|---|---|
80 |
TCP (HTTP) | Client Workstations | Nginx Ingress | Web redirect to HTTPS or management interface. |
443 |
TCP (HTTPS) | Client Workstations | Nginx Ingress | AllSafeX Web Console, Web Terminal & REST API. |
2222 |
TCP (SSH) | Client Workstations | AllSafeX SSH Gateway | Interactive SSH terminal gateway. |
8080 |
TCP (HTTP) | Internal Docker Network | Core Service | Internal REST API and Django application server. |
5432 |
TCP | Internal Docker Network | PostgreSQL 16 | Relational database storage. Must NOT be exposed publicly. |
6379 |
TCP | Internal Docker Network | Redis 7 | Cache and task queue broker. Must NOT be exposed publicly. |
Authentication & Session Flow
The sequence of operations during an SSH connection through AllSafeX:
- Client Connection: The engineer initiates an SSH connection to port
2222:ssh -p 2222 engineer@pam.company.com. - Credential & MFA Check: The AllSafeX SSH Gateway intercepts the connection and prompts for password and TOTP code, validating these credentials against the Control Plane via internal REST API.
- Asset Selection: The gateway presents an interactive terminal menu displaying the specific target servers authorized for the engineer.
- Vault Retrieval: The Control Plane retrieves the target system user's private key or password from the encrypted vault and delivers it to the gateway over a secure internal channel.
- Upstream Handshake: The AllSafeX SSH Gateway initiates the outbound connection to the target server on port 22, completing the handshake using the vaulted credentials.
- Session Recording: All interactive keystrokes and output bytes are buffered and written to the asciinema log directory on the host filesystem.
Storage & Persistence
AllSafeX stores persistent state across two directories mounted via Docker volumes:
/opt/allsafex/data/: PostgreSQL database files, Redis append-only files, and local session recordings./opt/allsafex/config/: Application settings, SSL certificates, Nginx configuration, and SSH host keys.