fix(adr-023/024/025): restaurer diagrammes Mermaid
Les diagrammes Mermaid sont utiles pour visualiser l'architecture et ne posent pas de problème de doublon code/doc. Restauration des 3 diagrammes : - ADR-023 : Flux modération (Client → API → Worker → IA → Dashboard) - ADR-024 : Stack monitoring (Services → Prometheus/Grafana → Alerting) - ADR-025 : Architecture secrets (Dev/Prod → Vault → Encryption) Code textuel (SQL, bash, Go, YAML) reste retiré comme demandé. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
jpgiannetti
@@ -28,15 +28,54 @@ Architecture hybride **humain + IA** avec file d'attente intelligente.
|
||||
|
||||
### Architecture
|
||||
|
||||
**Flux de traitement** :
|
||||
1. **Client** (App Mobile/Web) → Signalement utilisateur
|
||||
2. **API Backend** (Fiber) → Endpoint `/moderation/report`
|
||||
3. **Queue PostgreSQL** → LISTEN/NOTIFY pour dispatch asynchrone
|
||||
4. **Worker Go** → Goroutine de traitement (transcription + analyse)
|
||||
5. **IA Self-hosted** → Whisper large-v3 (transcription) + distilbert/roberta (NLP)
|
||||
6. **Cache Redis** → Sorted Sets pour priorisation temps réel
|
||||
7. **Dashboard React** → Interface modérateurs avec Wavesurfer.js (player audio)
|
||||
8. **Stockage** → PostgreSQL (signalements + logs audit) + Redis (cache priorisation)
|
||||
```mermaid
|
||||
graph TB
|
||||
subgraph Client["App Mobile/Web"]
|
||||
Report["Signalement utilisateur"]
|
||||
end
|
||||
|
||||
subgraph Backend["Backend Go"]
|
||||
API["API Fiber<br/>/moderation/report"]
|
||||
Queue["PostgreSQL Queue<br/>LISTEN/NOTIFY"]
|
||||
Worker["Worker Go<br/>(transcription + NLP)"]
|
||||
end
|
||||
|
||||
subgraph AI["IA Self-hosted"]
|
||||
Whisper["Whisper large-v3<br/>(transcription)"]
|
||||
NLP["distilbert<br/>(sentiment + haine)"]
|
||||
end
|
||||
|
||||
subgraph Moderation["Modération Dashboard"]
|
||||
Dashboard["React Dashboard"]
|
||||
Player["Wavesurfer.js<br/>(lecture audio)"]
|
||||
end
|
||||
|
||||
subgraph Storage["Stockage"]
|
||||
DB["PostgreSQL<br/>(signalements + logs)"]
|
||||
Redis["Redis<br/>(priorisation + cache)"]
|
||||
end
|
||||
|
||||
Report --> API
|
||||
API --> Queue
|
||||
Queue --> Worker
|
||||
Worker --> Whisper
|
||||
Whisper --> NLP
|
||||
NLP --> Redis
|
||||
Worker --> DB
|
||||
Dashboard --> Player
|
||||
Dashboard --> Redis
|
||||
Dashboard --> DB
|
||||
|
||||
classDef clientStyle fill:#e3f2fd,stroke:#1565c0
|
||||
classDef backendStyle fill:#fff3e0,stroke:#e65100
|
||||
classDef aiStyle fill:#f3e5f5,stroke:#6a1b9a
|
||||
classDef storageStyle fill:#e8f5e9,stroke:#2e7d32
|
||||
|
||||
class Client,Report clientStyle
|
||||
class Backend,API,Queue,Worker backendStyle
|
||||
class AI,Whisper,NLP aiStyle
|
||||
class Storage,DB,Redis storageStyle
|
||||
```
|
||||
|
||||
### Workflow de Traitement
|
||||
|
||||
|
||||
@@ -31,27 +31,64 @@ Stack **Prometheus + Grafana + Loki** self-hosted avec alerting multi-canal.
|
||||
|
||||
### Architecture
|
||||
|
||||
**Services surveillés** :
|
||||
- Backend Go API (métriques Fiber)
|
||||
- PostgreSQL (pg_exporter)
|
||||
- Redis (redis_exporter)
|
||||
- Zitadel (endpoint metrics)
|
||||
```mermaid
|
||||
graph TB
|
||||
subgraph Services["Services RoadWave"]
|
||||
API["Backend Go API<br/>(Fiber metrics)"]
|
||||
DB["PostgreSQL<br/>(pg_exporter)"]
|
||||
Redis["Redis<br/>(redis_exporter)"]
|
||||
Zitadel["Zitadel<br/>(metrics endpoint)"]
|
||||
end
|
||||
|
||||
**Stack Monitoring** :
|
||||
- **Prometheus** : Collecte métriques (scrape), stockage TSDB 15j rétention
|
||||
- **Grafana** : Visualisation dashboards
|
||||
- **Loki** : Agrégation logs (chunks compressés, 7j rétention)
|
||||
- **Alertmanager** : Routing alertes multi-canal
|
||||
- **Uptime Kuma** : Checks HTTP externes, SSL monitoring
|
||||
subgraph Monitoring["Stack Monitoring"]
|
||||
Prom["Prometheus<br/>(scrape + TSDB)"]
|
||||
Grafana["Grafana<br/>(dashboards)"]
|
||||
Loki["Loki<br/>(logs aggregation)"]
|
||||
Alert["Alertmanager<br/>(routing)"]
|
||||
Uptime["Uptime Kuma<br/>(external checks)"]
|
||||
end
|
||||
|
||||
**Alerting** :
|
||||
- Email (Brevo) : asynchrone, faible intrusivité
|
||||
- Webhook (Slack/Discord) : temps réel, on-call
|
||||
subgraph Notifications["Alerting"]
|
||||
Email["Email (Brevo)"]
|
||||
Slack["Webhook Slack/Discord"]
|
||||
end
|
||||
|
||||
**Stockage** :
|
||||
- Prometheus TSDB : métriques 15j
|
||||
- Loki chunks : logs 7j
|
||||
- Backups PostgreSQL : WAL-E continuous vers S3 OVH
|
||||
subgraph Storage["Stockage"]
|
||||
PromStorage["Prometheus TSDB<br/>(15j retention)"]
|
||||
LokiStorage["Loki Chunks<br/>(7j retention)"]
|
||||
Backups["Backups PostgreSQL<br/>(S3 OVH)"]
|
||||
end
|
||||
|
||||
API --> Prom
|
||||
DB --> Prom
|
||||
Redis --> Prom
|
||||
Zitadel --> Prom
|
||||
|
||||
API -.->|logs stdout| Loki
|
||||
Prom --> Grafana
|
||||
Loki --> Grafana
|
||||
Prom --> Alert
|
||||
|
||||
Alert --> Email
|
||||
Alert --> Slack
|
||||
|
||||
Uptime -.->|external HTTP checks| API
|
||||
Uptime --> Alert
|
||||
|
||||
Prom --> PromStorage
|
||||
Loki --> LokiStorage
|
||||
DB -.->|WAL-E continuous| Backups
|
||||
|
||||
classDef serviceStyle fill:#e3f2fd,stroke:#1565c0
|
||||
classDef monitoringStyle fill:#fff3e0,stroke:#e65100
|
||||
classDef notifStyle fill:#f3e5f5,stroke:#6a1b9a
|
||||
classDef storageStyle fill:#e8f5e9,stroke:#2e7d32
|
||||
|
||||
class Services,API,DB,Redis,Zitadel serviceStyle
|
||||
class Monitoring,Prom,Grafana,Loki,Alert,Uptime monitoringStyle
|
||||
class Notifications,Email,Slack notifStyle
|
||||
class Storage,PromStorage,LokiStorage,Backups storageStyle
|
||||
```
|
||||
|
||||
### Métriques Clés
|
||||
|
||||
|
||||
@@ -30,15 +30,55 @@ Stratégie **secrets management + encryption at rest + HTTPS** avec stack self-h
|
||||
|
||||
### Architecture Secrets
|
||||
|
||||
**Environnements** :
|
||||
- **Développement** : Fichier .env local (non versionné)
|
||||
- **Production** : HashiCorp Vault (self-hosted)
|
||||
```mermaid
|
||||
graph TB
|
||||
subgraph Dev["Environnement Dev"]
|
||||
EnvFile[".env file<br/>(local uniquement)"]
|
||||
end
|
||||
|
||||
**Flux** :
|
||||
1. **Vault** stocke secrets sensibles (JWT signing key, DB credentials, Mangopay API key, encryption master key)
|
||||
2. **Backend API** récupère secrets depuis Vault au démarrage
|
||||
3. **Encryption layer** : AES-256-GCM pour PII, TLS 1.3 pour transport
|
||||
4. **Stockage** : PostgreSQL (data encrypted at rest), Redis (TLS enabled)
|
||||
subgraph Prod["Production"]
|
||||
Vault["HashiCorp Vault<br/>(secrets storage)"]
|
||||
API["Backend Go API"]
|
||||
DB["PostgreSQL<br/>(encrypted at rest)"]
|
||||
Redis["Redis<br/>(TLS enabled)"]
|
||||
end
|
||||
|
||||
subgraph Encryption["Encryption Layer"]
|
||||
AES["AES-256-GCM<br/>(PII encryption)"]
|
||||
TLS["TLS 1.3<br/>(transport)"]
|
||||
end
|
||||
|
||||
subgraph Secrets["Secrets Stockés"]
|
||||
JWT["JWT Signing Key<br/>(RS256 private key)"]
|
||||
DBCreds["DB Credentials<br/>(user/pass)"]
|
||||
Mangopay["Mangopay API Key<br/>(sandbox + prod)"]
|
||||
EncKey["Encryption Master Key<br/>(AES-256)"]
|
||||
end
|
||||
|
||||
EnvFile -.->|dev only| API
|
||||
Vault --> API
|
||||
|
||||
Vault --- JWT
|
||||
Vault --- DBCreds
|
||||
Vault --- Mangopay
|
||||
Vault --- EncKey
|
||||
|
||||
API --> AES
|
||||
API --> TLS
|
||||
AES --> DB
|
||||
TLS --> DB
|
||||
TLS --> Redis
|
||||
|
||||
classDef devStyle fill:#fff3e0,stroke:#e65100
|
||||
classDef prodStyle fill:#e3f2fd,stroke:#1565c0
|
||||
classDef encStyle fill:#f3e5f5,stroke:#6a1b9a
|
||||
classDef secretStyle fill:#ffebee,stroke:#c62828
|
||||
|
||||
class Dev,EnvFile devStyle
|
||||
class Prod,Vault,API,DB,Redis prodStyle
|
||||
class Encryption,AES,TLS encStyle
|
||||
class Secrets,JWT,DBCreds,Mangopay,EncKey secretStyle
|
||||
```
|
||||
|
||||
### Secrets Management avec Vault
|
||||
|
||||
|
||||
Reference in New Issue
Block a user