Docs / Guides / Architecture
System Architecture & Security
Deep dive into the agentless execution model, data-at-rest encryption, and scalable worker pools.
1. Agentless Execution Engine
Unlike legacy orchestration tools that require installing heavy daemons on every endpoint, FlowForge is 100% agentless. It orchestrates all commands via native SSH (Linux) and WinRM (Windows).
This drastically reduces the attack surface and eliminates the need to patch agent software across thousands of nodes.
graph LR
A[FlowForge Core Worker] -->|SSH Port 22| B(Linux Target)
A -->|WinRM Port 5986| C(Windows Target)
A -->|SSH Port 22| D(Network Switch)
style A fill:#2563eb,stroke:#1d4ed8,color:#fff
style B fill:#0f172a,stroke:#334155,color:#fff
style C fill:#0f172a,stroke:#334155,color:#fff
style D fill:#0f172a,stroke:#334155,color:#fff
2. Durable Terminal Sessions
The interactive web terminal is not a raw TCP socket to the endpoint. It proxies through the FlowForge core worker, which automatically wraps every session in a `screen` multiplexer.
sequenceDiagram
participant B as Browser
participant F as FlowForge Core
participant T as Target Node
B->>F: Connect Terminal (WSS)
F->>T: SSH Connect
F->>T: Execute 'screen -x'
T-->>F: Stream stdout/stderr
F-->>B: Relay to xterm.js
Note over B,T: If Browser disconnects, screen keeps running
3. Managed File Transfer (MFT)
When transferring large payloads, the FlowForge MFT engine chunks the file into 4MB segments, calculates a SHA-256 hash for each chunk, and verifies integrity upon reassembly at the destination. It automatically resumes interrupted transfers.
graph TD
A[Source File] -->|Split| B(4MB Chunk 1)
A -->|Split| C(4MB Chunk 2)
A -->|Split| D(4MB Chunk N)
B -->|SHA-256| E{Checksum Verify}
C -->|SHA-256| E
D -->|SHA-256| E
E -->|Transfer via SSH/SFTP| F[Target Node]
F -->|Reassemble| G[Final File]
style A fill:#2563eb,stroke:#1d4ed8,color:#fff
style E fill:#0f172a,stroke:#334155,color:#fff
style G fill:#10b981,stroke:#047857,color:#fff
