Skip to content
Ichnois
docs/architecture

Architecture & Security Zones

Ichnois separates telemetry ingestion from core orchestration across two isolated security zones, enforcing an 8-layer edge perimeter before any database or LLM invocation.

Two-Zone Topology: Server A operates in the public DMZ as an ultra-fast, stateless edge gateway. Server B operates on the private internal network housing the SQLite database, git blame correlator, and bounded LLM reasoning engine.

Two-Tier Zone Architecture

Zone 2 · Server A (Edge Gateway)

Standalone FastAPI microservice located in the DMZ (port 8001). Exposes public telemetry endpoints, terminates TLS, mitigates Slowloris/DoS attacks, validates project keys against zero-DB in-memory cache, strips PII, and returns HTTP 202 in < 25ms.

Zone 1 · Server B (Core Platform)

Internal core orchestration service (port 8000). Houses multi-tenant workspace SQLite databases, dual-gated incident state machines, release SHA blame correlations, and bounded LLM synthesis. Only reachable from Server A via authenticated internal tokens.

The 8-Layer Edge Security Perimeter

Every telemetry event hitting Server A passes through eight sequential defense layers before forward dispatching:

1

TLS Termination & Secure Headers

Enforces HSTS (max-age 1yr), X-Content-Type-Options: nosniff, and DENY frame options.

2

Slowloris Stream Cutoff

Hard 2.5s read timeout on incoming byte chunks to prevent connection pool exhaustion.

3

Hard Body Ceiling (≤ 50 KB)

Streaming payloads exceeding 50KB are instantly aborted with HTTP 413 Payload Too Large.

4

Anti-Attack Payload Inspection

Blocks SQL injection vectors, RCE shell syntax, and enforces maximum JSON nesting depth of 10.

5

Project Key & DSN Authenticator

Validates pk_live_ credentials against zero-DB in-memory project cache synced every 30 seconds.

6

Leaky-Bucket Rate Limiter

Applies dual quotas: per-IP burst protection and per-project minute quotas.

7

Edge DLP & Secret Scrubbing

High-entropy token scanner scrubs bearer tokens, Stripe keys, and AWS credentials in < 0.1ms.

8

Fast-ACK & Async Forwarder

Returns HTTP 202 Accepted (<25ms) and enqueues async background task to Server B with DLQ fallback.

v2/edge_gateway/app.py — 8-Layer Security Perimeter
1# Server A Edge Gateway — 8-Layer Security Perimeter
2# Layer 1: TLS Termination & Security Headers (nosniff, DENY frame, HSTS)
3# Layer 2: Slowloris Read Timeout Guard (2.5s hard stream cutoff)
4# Layer 3: Hard Payload Body Ceiling (<= 50KB, HTTP 413)
5# Layer 4: Anti-Attack Inspection (SQLi patterns, RCE tokens, max JSON depth 10)
6# Layer 5: Project Key & DSN Authenticator (zero-DB in-memory sync cache)
7# Layer 6: Leaky-Bucket Rate Limiter (Per-IP & Per-Project quotas)
8# Layer 7: Edge DLP & Synchronous PII Scrubbing (< 0.1ms latency)
9# Layer 8: Fast-ACK Dispatcher (HTTP 202 in < 25ms, background async forward)

Zero-DB Edge Key Synchronization

To maintain sub-millisecond edge authentication without querying the SQLite database on each request, Server A maintains an in-memory dictionary of all active public keys. When keys are created or rotated on Server B, an instant cache invalidation webhook (POST /internal/v1/cache/keys/invalidate) flushes and updates Server A in real time.