update uml

Author: sechmann

nais-device.png

@@ -2,7 +2,7 @@
 
 actor developer as "Developer"
 participant device as "NAIS Device"
-participant dnca as "NAIS Device Client Agent"
+participant ndca as "NAIS Device Client Agent"
 participant aad as "Azure Active Directory"
 participant kolide as "Kolide"
 participant nds as "NAIS Device Server"
@@ -11,17 +11,16 @@ collections vpnserver as "VPN Server"
 collections ndga as "NAIS Device Gateway Agent"
 
 ==Enroll==
-developer -> dnca: enroll device
-dnca -> device: install kolide-agent
+developer -> ndca: enroll device
+ndca -> device: install kolide-agent
 device -> kolide: register
-dnca -> aad: login
-aad -> dnca: token
-dnca -> device: get serial
-device -> dnca: serial
-dnca -> nds: HTTP POST /register {token, serial}
-nds -> aad: validate token
+ndca -> aad: login
+aad -> ndca: token
+ndca -> device: get serial
+device -> ndca: serial
+ndca -> nds: HTTP POST /device/register {token, serial}
 nds -> ndsdb: add db entry {serial, email}
-nds -> dnca: response
+nds -> ndca: response
 
 ==Kolide==
 loop
@@ -38,23 +37,30 @@ loop every x minutes
    nds -> nds: update database entries with status
 end
 
+==Healthcheck VPN==
+ndca->vpnserver: establish tcp connection
+loop every second:
+    ndca -> vpnserver: send byte
+    vpnserver -> ndca: send byte
+end
+ndca -> ndca: if no byte response, trigger Connect to  VPN
+ndca->ndca: close tcp connection
+ndca->ndca: restart healthcheck
+
 ==Connect to VPN==
-dnca -> nds: HTTP GET /psk {token, public key, serial}
-nds -> nds: validate token
+ndca -> ndca: if no cached token, login
+ndca -> nds: HTTP GET /device/vpn/config {token, public key, serial}
 nds -> ndsdb: is device ok?
 
 nds -> ndsdb: get {psk, ip, routes, server-configs}
-nds -> dnca: {psk, ip, routes, server-configs}
+nds -> ndca: {psk, ip, routes, server-configs}
 
-dnca -> device: ip dev add / ifconfig add / netsh add device
-dnca -> device: wg set psk, private key, ip
-dnca -> device: route add
+ndca -> device: ip dev add / ifconfig add / netsh add device
+ndca -> device: wg set psk, private key, ip
+ndca -> device: route add
 
 ==Enroll VPN Server==
-ndga -> aad: login
-aad -> ndga: token
-ndga -> nds: HTTP POST /gateway/register {token, server-id, public ip}
-nds -> nds: validate token
+ndga -> nds: HTTP POST /gateway/register {token, public key, public ip}
 nds -> ndsdb: write server config
 nds -> ndga: response
 
@@ -66,10 +72,7 @@ end
 
 ==Configure VPN Server (runs every minute or more)==
 loop every minute
-    ndga -> aad: login
-    aad -> ndga: token
-    ndga -> nds: HTTP GET /peers {token, server-id}
-    nds -> nds: validate token
+    ndga -> nds: HTTP GET /gateway/peers {token, public key}
     nds -> ndsdb: get peers
     nds -> ndga: {peers}
 end