nais-device.puml

@startuml component

actor developer as "Developer"
participant device as "NAIS Device"
participant ndca as "NAIS Device Client Agent"
participant aad as "Azure Active Directory"
participant kolide as "Kolide"
participant nds as "NAIS Device Server"
database ndsdb as "NDS database"
collections vpnserver as "VPN Server"
collections ndga as "NAIS Device Gateway Agent"

==Enroll==
developer -> ndca: enroll device
ndca -> device: install kolide-agent
device -> kolide: register
ndca -> aad: login
aad -> ndca: token
ndca -> device: get serial
device -> ndca: serial
ndca -> nds: HTTP POST /device/register {token, serial}
nds -> ndsdb: add db entry {serial, email}
nds -> ndca: response

==Kolide==
loop
    device -> kolide: fetch queries
    kolide -> device: queries
    device -> device: run queries
    device -> kolide: results
end

==Monitor device statuses==
loop every x minutes
   nds -> kolide: get device statuses
   kolide -> nds: device statuses
   nds -> nds: update database entries with status
end

==Healthcheck VPN==
ndca->vpnserver: establish tcp connection
loop every second:
    ndca -> vpnserver: send byte
    vpnserver -> ndca: send byte
end
ndca -> ndca: if no byte response, trigger Connect to  VPN
ndca->ndca: close tcp connection
ndca->ndca: restart healthcheck

==Connect to VPN==
ndca -> ndca: if no cached token, login
ndca -> nds: HTTP GET /device/vpn/config {token, public key, serial}
nds -> ndsdb: is device ok?

nds -> ndsdb: get {psk, ip, routes, server-configs}
nds -> ndca: {psk, ip, routes, server-configs}

ndca -> device: ip dev add / ifconfig add / netsh add device
ndca -> device: wg set psk, private key, ip
ndca -> device: route add

==Enroll VPN Server==
ndga -> nds: HTTP POST /gateway/register {token, public key, public ip}
nds -> ndsdb: write server config
nds -> ndga: response

==Rotate psks==
loop every x minutes:
    nds -> nds: generate new psks
    nds -> ndsdb: write new psks
end

==Configure VPN Server (runs every minute or more)==
loop every minute
    ndga -> nds: HTTP GET /gateway/peers {token, public key}
    nds -> ndsdb: get peers
    nds -> ndga: {peers}
end

loop every peer
    ndga -> ndga: configure peer {public key, ip, psk}
    ndga -> ndga: configure route {peer ip}
end

@enduml