Architecture

Edition: Community and Enterprise Offering: Self-managed

sealfix is three long-running services, three optional ones, and two short jobs at start. They are split along one line: who may read a sealed value.

flowchart TB
    U["People, in a browser"] -->|HTTPS| P["Your TLS proxy"] --> API
    API["api<br/>web application<br/>public key only"] --> META[("meta-pg<br/>metadata store")]
    EX["executor<br/>private key<br/>target connections"] --> META
    EX -->|"bind variables only"| T[("Target databases")]
    OPT["notifier, gitsync, siem<br/>optional"] --> META
    classDef secret fill:#F6E8EB,stroke:#7D1D2F,stroke-width:2px,color:#13202D
    classDef core fill:#DCE3EE,stroke:#13202D,stroke-width:2px,color:#13202D
    classDef opt fill:#E9EEF6,stroke:#23407A,color:#13202D
    class EX secret
    class API,META core
    class OPT opt

The web application reaches your directory (LDAP or OIDC). The optional services reach their own destinations: mail and chat for the notifier, your Git server for gitsync, your SIEM for siem. Nothing else leaves the host.

The services

Service	Runs	Holds	Database role
api	Always	The executor's public key; the directory's service account	sealfix_api: cannot update or delete audit events, cannot write executions
executor	Always	The private key; every target's connection string	sealfix_exec: the only writer of dry runs, executions and before-images
meta-pg	Always	Requests (sealed), approvals, the audit chain, users, configuration	Owner
notifier	Optional	The notification channels' secrets	sealfix_notify: reads events, writes its own cursor
gitsync	Optional	The Git signing key	Reads the chain, writes its own commits table
siem	Optional	The TLS client certificate for your SIEM	Reads the chain, writes its own cursor
keygen, migrate	At start		Create the key once; run the migrations and grants

Why the API and the executor are apart

The web application faces your users and the network, so it is the most exposed part. It holds only the public key: it can seal values, never open them. The executor faces no user. It is the only process that can open a sealed value, and the only one that can reach a target database.

So a compromised web application cannot read a sealed value, cannot read a before-image and cannot reach a target. Every database role is granted the least its service needs, and the grants are re-applied at every start.

Sizing

Defaults suit a pilot: the metadata store 2 GB and 2 CPUs, the API and the executor 1 GB and 2 CPUs each, the optional services 512 MB and 1 CPU. Raise them in deploy/prod/.env, for example SEALFIX_EXECUTOR_MEM=2g for large dry runs.