1. Architecture Diagram
About 1 min
1. Architecture Diagram
If all system capabilities are utilized, the component architecture will look as follows link.
StormBPMN Architecture
Core Component
- StormBPMN Application
The central web application provided by the StormBPMN team. Responsible for modeling, storing, and managing business processes.
Infrastructure Used (on the Customer's Side)
Infrastructure Components
| Component | Purpose |
|---|---|
| Load Balancer (nginx recommended) | Provides HTTPS, traffic distribution |
| Database (PostgreSQL 14+) | Storage of all information. We recommend PostgreSQL 16–17. Encoding UTF8 + extensions pgvector, pg_trgm, pgcrypto, uuid-ossp, hstore — see requirements |
| File Storage (MinIO or any S3-compatible) | Storage of documents, previews, attachments |
| SMTP Server (internal) | Email sending |
| Keycloak / OAuth2 / LDAP | Used for user authorization |
| Log Collector (e.g., Syslog) | Collection of security logs |
| Prometheus | Collection of metrics |
| Grafana | Visualization of metrics, alerts |
Deprecated Login Methods
LDAP and direct (built-in) integration with Keycloak are deprecated and not recommended for new installations. Use OAuth2: Keycloak, Azure AD, ADFS, and other providers are connected via this method, see Authorization System. LDAP configuration instructions are provided through the account manager.
External open-source solutions
| Component | Purpose |
|---|---|
| ListMonk | Used for complex email generation and distribution |
| PlantUML | UML diagram generation |
| Gotenberg | Conversion of images and HTML to PDF |
System Users
| Type | Description |
|---|---|
| User | Working with processes and templates |
| Administrator | Configuring applications, systems, and metrics |
| Security Administrator | Configuring logging and security controls |
Core Interactions
Users and administrators interact with the system via a load balancer over HTTPS.
Application
stormbpmn:- stores data in PostgreSQL;
- sends and receives files through an S3-compatible storage;
- sends emails via SMTP (or via ListMonk for complex generation);
- connects to authorization systems: Keycloak, OAuth, LDAP;
- generates diagrams via PlantUML and PDF documents via Gotenberg;
- sends logs to Log Collector;
- exposes Prometheus metrics.
Prometheus collects metrics from the application.
Grafana displays metrics and configures alerts.
Security
- All external connections are secured via HTTPS.
- SSH connections are available for administrators and information security personnel.
- Legacy LDAP is isolated as a component and is not recommended for use.