From 2a0d194cae50864799ddb11d88089c29cb0f3f6c Mon Sep 17 00:00:00 2001 From: William Mantly Date: Sat, 8 Aug 2026 21:22:40 -0400 Subject: [PATCH] docs: audit docs and READMEs for Theta Suite 2.0, Theta Directory, Theta Gateway, and Docker-only deployment (#185) --- .gitmodules | 2 +- docs/architecture.md | 46 +++++++++++++++++++------------------------- jump-host | 2 +- proxy | 2 +- theta-agent | 2 +- 5 files changed, 24 insertions(+), 30 deletions(-) diff --git a/.gitmodules b/.gitmodules index 9b1406e..e3159f8 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,6 +1,6 @@ [submodule "sso-manager-node"] path = sso-manager-node - url = https://github.com/theta42/sso-manager-node.git + url = https://github.com/theta42/theta-directory.git [submodule "proxy"] path = proxy url = https://github.com/theta42/proxy.git diff --git a/docs/architecture.md b/docs/architecture.md index ab81c91..fd10052 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -1,38 +1,32 @@ --- layout: default title: Architecture -description: How theta-suite composes the SSO Manager, proxy, jump host, and ldap-client around a shared OpenBao secrets store — the OIDC/LDAP/secrets wiring setup.sh generates from one domain. +description: How Theta Suite 2.0 composes Theta Directory, Theta Gateway, Theta Proxy, and Theta Agent around a shared OpenBao secrets store — the zero-trust identity, mesh gateway, and telemetry architecture. --- # Architecture [← Back to Home](index.html) -theta-suite is a **composition** repo: it builds four applications from their -git submodules and adds the glue that wires them together — plus a shared -[OpenBao](https://openbao.org/) secrets store — on one Docker network. It -does not fork or patch the components; it composes and configures them. +Theta Suite 2.0 is a production-grade **composition repository**: it composes applications from git submodules and provides the automated first-run orchestration, secrets initialization, and container networking for a complete zero-trust infrastructure stack. --- -## Components +## Core Infrastructure Components -| Repo / image | Role | +| Subproject / Image | Component Role | |------|------| -| [`theta42/sso-manager-node`](https://github.com/theta42/sso-manager-node) | OIDC provider + OpenLDAP directory + web UI. All-in-one image (`Dockerfile.openldap`). | -| [`theta42/proxy`](https://github.com/theta42/proxy) | OIDC-protected reverse proxy (OpenResty + Node mgmt app + Redis). All-in-one image (`Dockerfile`). | -| [`theta42/jump-host`](https://github.com/theta42/jump-host) | Directory-driven SSH jump host (sshd + Node web UI). Image (`Dockerfile`). | -| [`theta42/ldap-client`](https://github.com/theta42/ldap-client) | Enrolls real Linux hosts into the directory (SSSD + AuthorizedKeysCommand). Also the opt-in `ldap-test-host` fixture. | -| `quay.io/openbao/openbao` | Central secrets store (Vault fork), KV-v2 at `secret/`. | -| `theta42/theta-suite` (this repo) | Composes all of the above on one network + automates first-run wiring. | - -The four applications are pinned as **git submodules**; OpenBao uses the -upstream image. `git clone --recursive` fetches the submodules in one step; -`git submodule update --remote` bumps them. +| [`theta42/theta-directory`](https://github.com/theta42/theta-directory) | **Theta Directory** — OIDC provider + OpenLDAP directory + Resource Catalog + Web Admin Console. All-in-one container. | +| [`theta42/jump-host`](https://github.com/theta42/jump-host) | **Theta Gateway** — Directory-driven SSH access gateway and WireGuard mesh router with NETMAP shadow subnets. | +| [`theta42/theta-agent`](https://github.com/theta42/theta-agent) | **Theta Agent** — Multi-platform host telemetry, hardware details, desktop session controls, and secret delivery agent. | +| [`theta42/proxy`](https://github.com/theta42/proxy) | **Theta Proxy** — OIDC-protected reverse proxy (OpenResty + Node management app + Redis). | +| [`theta42/ldap-client`](https://github.com/theta42/ldap-client) | **ldap-client** — Enrolls real Linux hosts into the directory for PAM/SSSD login, sudo rules, and SSH keys. | +| `quay.io/openbao/openbao` | **OpenBao** — Central secrets engine (Vault fork), KV-v2 versioned store at `secret/`. | +| `theta42/theta-suite` (this repo) | Composes all components on a single Docker network + automates `./setup.sh` first-run wiring. | --- -## The stack +## Architecture Stack ``` ┌──────────────────────────────────────────────────────────┐ @@ -42,17 +36,17 @@ upstream image. `git clone --recursive` fetches the submodules in one step; https (:443) ssh (:2222) ldaps (:636) │ │ │ ┌────────▼────────┐ ┌──────────▼────────┐ │ - │ proxy │ │ jump-host │ │ - │ OpenResty │ │ sshd :2222 │ │ - │ :80/:443/:4443 │ │ web UI :3002 │ │ + │ theta-proxy │ │ theta-gateway │ │ + │ OpenResty │ │ SSH Gateway │ │ + │ :80/:443/:4443 │ │ WireGuard Mesh │ │ │ mgmt app :3000 │ └────────┬──────────┘ │ └────────┬─────────┘ │ OIDC + LDAP │ - │ http:3001 (internal)│ via sso-manager │ - ▼ ▼ ▼ + │ http:3001 (internal)│ via theta-directory + ▼ ▼ ▼ ┌───────────────────────────────────────────────────────┐ - │ sso-manager (Express + OpenLDAP + Redis) │ - │ OIDC provider + LDAP directory │ - │ web UI :3001 (internal) ldaps :636 (published) │ + │ theta-directory (Express + OpenLDAP + Redis) │ + │ OIDC provider + LDAP directory + Resource Catalog │ + │ web UI :3001 (internal) ldaps :636 (published) │ └───────────────────────────────────────────────────────┘ ▲ loads secrets at boot (scoped token each) ┌───────────┴───────────────────┐ diff --git a/jump-host b/jump-host index 5a8dbae..2a15942 160000 --- a/jump-host +++ b/jump-host @@ -1 +1 @@ -Subproject commit 5a8dbaee0d4631a5e1014a7f770738980a4219a7 +Subproject commit 2a159428ddb81feb60af80df3100da9308a6edd8 diff --git a/proxy b/proxy index ac5bce6..be3e893 160000 --- a/proxy +++ b/proxy @@ -1 +1 @@ -Subproject commit ac5bce6a860c5b38ab01b7ea3c7d1d4e2317a5d5 +Subproject commit be3e89371cc5b8d6fd9a1c7a67107cdf2aaec3b0 diff --git a/theta-agent b/theta-agent index efae056..2a4fb21 160000 --- a/theta-agent +++ b/theta-agent @@ -1 +1 @@ -Subproject commit efae05686e41dcd0aee46e36811263d537cb32cc +Subproject commit 2a4fb21440679e923405551fc0ef5e892d4cdee2