PMS-GO — Runtime Architecture

PMS-GO — Runtime Architecture An architecture diagram generated by Archify. Browser users · web clients · Architecture component Browser users web clients Next.js PWA · AuthGuard · tokens · Play mode · offline / local Next.js PWA AuthGuard · tokens Go API · :8080 monolith · Docker network · internal › API trust zone › Play mode · offline / local Go API :8080 monolith Auth · Argon2id+TOTP · Docker network · internal › API trust zone › Play mode · offline / local Auth Argon2id+TOTP RBAC + ABAC · roles · tenant · Docker network · internal › API trust zone › Play mode · offline / local RBAC + ABAC roles · tenant Audit chain · hash-chained · Docker network · internal › API trust zone › Live mode · production online Audit chain hash-chained Domain engines · task · cost · 48 mods · Docker network · internal › API trust zone › Play mode · offline / local Domain engines task · cost · 48 mods PostgreSQL + TimescaleDB · :5432 store · Live · Docker network · internal › API trust zone › Live mode · production online PostgreSQL + TimescaleDB :5432 store · Live SQLite (offline) · Play mode store · Play mode · offline / local SQLite (offline) Play mode store PLAY mode · Offline · perpetual license · Play mode · offline / local PLAY mode Offline · perpetual license LIVE mode · Online · activations · Live mode · production online LIVE mode Online · activations Redis 7 · :6379 cache · Live · Docker network · internal › API trust zone › Live mode · production online Redis 7 :6379 cache · Live NATS 2.10 · :4222 bus · Live · Docker network · internal › API trust zone › Live mode · production online NATS 2.10 :4222 bus · Live OpenSearch 2.17 · :9200 search · Live · Docker network · internal › API trust zone › Live mode · production online OpenSearch 2.17 :9200 search · Live MinIO · :9000 S3 · Live · Docker network · internal › API trust zone › Live mode · production online MinIO :9000 S3 · Live License sidecar · Rust :8090 Ed25519 · Play mode · offline / local License sidecar Rust :8090 Ed25519 Biometric connector · Rust polls device · Docker network · internal › Live mode · production online Biometric connector Rust polls device License vendor · signed keys · External zone License vendor signed keys Attendance device · TCP 4370 · Live mode · production online › External zone Attendance device TCP 4370 HTTPS · TLS 1.3 Bearer · /api/v1/* dispatch verify authorize append SQL · dual-write publish · subscribe /verify · /issue signed keys BIOMETRIC_TOKEN · punches TCP 4370 Play mode · offline / local Live mode · production online Docker network · internal API trust zone External zone

Primary path · modes

  • • Browser → Next.js (sessionStorage JWT) → Go API :8080 → Argon2id+TOTP → RBAC+ABAC → Postgres (Redis cache, NATS events) → audit chain appended
  • • Play: docker-compose.offline.yml, SQLite, perpetual license, no Redis/NATS/OpenSearch/MinIO/biometric
  • • Live: docker-compose.yml full stack + Rust license sidecar (Ed25519) + biometric connector (TCP 4370) + signed activations

Security · modules · rate limits

  • • Auth: Argon2id + TOTP MFA, refresh-token pair, lockout after 5 fails/15 min, PMS_AUTH_RATE_LIMIT (20/min)
  • • RBAC+ABAC: SuperAdmin / PM / TeamMember / FinanceClerk / ExternalClient, tenant isolation incl. SuperAdmin
  • • Crypto: AES-256-GCM keyring (PMS_DATA_KEYS), REQUIRE_ENCRYPTION=1 fatal gate; hash-chained audit log with rebaseline
  • • Modules: 48 embedded via go:embed; PMS_MODULES_DIR adds runtime; PMS_RATE_LIMIT (600/min); PMS_TRUST_PROXY=0