// Reference build · system architecture
Synapse application architecture
The MDLC reference build: one Next.js application, four vertical slices over a shared library, one Postgres database. Generated from RESEARCH.md and hardened by the security gate.
Clients
◱
Anonymous
no signup
Runs the four free diagnostic tools at /tools/*.
◨
Signed-in user
session
Owns monitors, alert channels, and the dashboard. Sees only their own rows.
HTTPS
Next.js app · single deployment (App Router + TypeScript)
◈
Diagnostics
/tools/* + /api/diagnostics/{dns,ssl,http,propagation}. Every outbound call goes through the SSRF guard.
◨
Accounts
/auth/* sign-in / sign-up, password sessions, ownership context.
◉
Monitoring
/monitors, /api/monitors, /api/alert-channels. Create, list, detail; all ownership-scoped.
◷
Check runner
/api/cron, shared-secret only. Runs due monitors, writes results, opens/closes alerts.
Shared foundation · lib/
lib/db
Postgres access; ownership filter on every query.
lib/auth
KDF password hash, sessions, getSessionUser().
lib/ssrf
assertPublicUrl() + address pinning.
lib/dispatch
One alert per status transition.
every interval · shared secret
⏱
External scheduler
cron
A platform cron (or any scheduler) calls /api/cron on an interval to drive the always-on checks. Not publicly triggerable.
reads / writes · outbound
▦
Postgres
single DB
Tables: users, monitors, checks, alert_channels, alerts. A partial unique index keeps at most one open alert per monitor.
ownership in data layeralerts_one_open_per_monitor
◎
External endpoints
via SSRF guard
Public DoH resolvers (Google / Cloudflare) and the target hosts each check probes; webhook and email alert destinations.
DoHwebhook (https)email
Check pipeline · the always-on path
scheduler→
/api/cron→
select due monitors→
run check + SSRF guard→
write check · update status→
on transition · dispatch alert
What the MDLC security gate hardened
- SSRF guard closed an IPv6-literal bypass to the cloud metadata endpoint
- Address pinning added to defeat DNS-rebinding at connect time
- Ownership isolation enforced in the data layer on every query (no IDOR)
- Cron endpoint gated behind a shared secret, not publicly triggerable
- Passwords hashed with a modern KDF, salted
- DB TLS verification required, not disabled