Architecture

Muljax ID is engineered specifically for serverless edge environments, eliminating traditional container infrastructure and relational database clusters in favor of Cloudflare’s distributed primitives.

Component Topology

flowchart LR
    subgraph Clients["Clients"]
        Browser["User Browser<br/>(React 19 Dashboard)"]
        SSHClient["OpenSSH Client<br/>(id_ed25519-cert.pub)"]
        SSHDaemon["Target Server sshd<br/>(trusted_user_ca.pub)"]
        OIDCClient["OAuth2 / OIDC App<br/>(Grafana / Nextcloud)"]
    end

    subgraph Edge["Cloudflare Edge Workers"]
        APIWorker["API Worker (Hono)<br/>/api/* and /oauth/*"]
        DashboardPages["Dashboard Assets<br/>(Cloudflare Pages)"]
        WorkflowEngine["Cloudflare Workflows<br/>(LifecycleWorkflow)"]
    end

    subgraph Storage["Edge Storage & State"]
        D1Database["Cloudflare D1<br/>SQLite Cluster"]
        R2Buckets["Cloudflare R2<br/>Profile Avatars"]
    end

    Browser -->|Load SPA| DashboardPages
    Browser -->|"API Calls (Session Cookie)"| APIWorker
    OIDCClient -->|OAuth Token / Discovery| APIWorker
    SSHDaemon -->|Sync KRL / Revoked Keys| APIWorker
    SSHClient -->|SSH Connection| SSHDaemon

    APIWorker -->|ORM Queries| D1Database
    APIWorker -->|Object Storage| R2Buckets
    APIWorker -->|Durable Events| WorkflowEngine
    WorkflowEngine -->|Delayed State Updates| D1Database

---

Edge Service Layers

Edge API (apps/api)

The API service runs within Cloudflare Workers using the Hono framework:

• Routing and Middleware:
  • Global CORS middleware (/api/*) restricting cross-origin requests to configured dashboard origins.
  • Session verification middleware validating token hashes against sessions table.
  • Role-based authorization middleware verifying user permission flags.
• Scheduled Workers:
  • Cloudflare Workers scheduled() cron handler runs cleanupExpiredAuthData to purge expired sessions, authorization codes, and stale challenges from D1.
• Durable Workflows:
  • LifecycleWorkflow extends Cloudflare WorkflowEntrypoint to manage asynchronous delays (e.g., executing account deactivation after a grace period).

Management Dashboard (apps/dashboard)

The user and administrative console is a client-side single-page application built on:

• React 19 with TypeScript.
• TanStack Router: File-system based type-safe routing.
• TanStack Query: Request caching, background refetching, and optimistic mutations.
• Tailwind CSS: Modern accessible dark theme.

Database Layer (Cloudflare D1)

Data persistence is handled by Cloudflare D1, an edge-distributed SQLite database managed through Drizzle ORM:

• Automatic edge replication with zero connection pool limits.
• Foreign key constraints with cascading deletes enabled.
• Composite indexing for high-frequency queries (e.g., (user_id, client_id), (serial)).

---

Storage & Module Layout

• Directoryapps/api/src/

  • Directorydb/

    • index.ts D1 client instantiation with Drizzle
    • Directoryschema/ 11 schema modules defining SQLite tables

      • …
  • Directorylib/

    • Directoryauth/ Password hashing, WebAuthn verification, session tokens

      • …
    • Directorylifecycle/ Lifecycle execution engine and workflow hooks

      • …
    • Directoryoauth/ JWT signer, JWKS, token hashes, PKCE validation

      • …
    • Directoryrbac/ Permission definitions and role evaluation

      • …
    • Directoryssh/ RFC 4251 wire format, OpenSSH certificate serialization

      • …
  • Directorymiddleware/ CORS, authentication, and RBAC guards

    • …
  • Directoryroutes/

    • Directoryaccount/ User self-service profile and credential endpoints

      • …
    • Directoryadmin/ Operator administrative endpoints

      • …
    • Directoryauth/ Login, logout, session verification

      • …
    • Directoryoauth/ Standard RFC 6749 OAuth2 & OIDC endpoints

      • …
    • Directorypasskeys/ WebAuthn registration and authentication ceremonies

      • …
    • Directoryssh/ CA key distribution, cert issue, KRL sync

      • …
    • Directorywell-known/ OpenID Discovery and JWKS endpoints

      • …
  • Directoryworkflows/

    • lifecycle.ts Cloudflare Workflow durable entrypoint