Aarkam.IO Management Portal & Gateway Backbone

Aarkam.IO is the primary enterprise-facing control tower of the entire Aarkam storage fabric. It operates as both a comprehensive graphical management portal (Web UI) and the high-performance API gateway backbone that fronts distributed storage clusters.

┌────────────────────────────────────────────────────────────────────────┐
│                        Aarkam.IO Web Portal (UI)                       │
│    ┌─────────────────┬──────────────────┬────────────────────────┐     │
│    │ Cluster Health  │ Tenant & Org Mgr │ Visual Bucket Explorer │     │
│    ├─────────────────┼──────────────────┼────────────────────────┤     │
│    │ HSM Key Custody │ IAM & Multi-MFA  │ WORM Audit Viewer      │     │
│    └─────────────────┴──────────────────┴────────────────────────┘     │
└───────────────────────────────────┬────────────────────────────────────┘
                                    │ Edge Dispatch & S3 Gateway Engine
                                    ▼
┌────────────────────────────────────────────────────────────────────────┐
│                      Aarkam.IO Gateway Backbone                        │
│   • S3 SigV4 Authentication & Request Authorization                    │
│   • Direct Rokka Placement Resolution (mTLS gRPC)                      │
│   • Client-Side Envelope Encryption (AES-256-GCM)                      │
│   • Zero-Allocation Parallel 4KB Chunk Streamer                        │
└────────────────────────────────────────────────────────────────────────┘

The UI Management Portal

The Aarkam.IO Web Portal provides enterprise administrators, compliance officers, and tenant operators with a centralized, secure interface to orchestrate the storage fabric:

1. Multi-Tenant Organization Management

• Hierarchical Tenancy: Provision independent tenant accounts, departments, and project boundaries with zero cross-tenant metadata leakage.
• Enterprise Identity & MFA: Native support for TOTP Multi-Factor Authentication (Google Authenticator / Microsoft Authenticator), SAML 2.0, and OpenID Connect (OIDC) integration for Microsoft Entra ID.

2. Visual Cluster & Node Observability

• Real-Time Topology: Live visual telemetry mapping storage nodes, coordinator quorums, physical disk wear levels, and network latency meshes.
• Abodi Integration: Visual display of predictive health scores, impending drive degradation alerts, and automated rebalance progress.

3. Bucket & Policy Governance

• Visual Bucket Management: Create, configure, and inspect S3-compatible buckets with granular capacity quotas.
• Compliance & WORM Ledgers: Configure immutable Object Lock policies (Retention Days, Legal Holds) and view append-only audit events (FullAuditingLog).

4. Cryptographic Key Management (BYOK)

• Zero-Knowledge Key Dashboard: Manage Key Encrypting Keys (KEKs) hosted in customer-operated Hardware Security Modules (HSMs) via PKCS#11 / KMIP.
• Automated Lifecycle: Track 90-day key rotation schedules and cryptographic shredding execution logs.

The Backbone of the Gateway

Aarkam.IO is not merely an administrative portal—it is the mandatory architectural backbone that powers the storage gateway:

flowchart LR
    S3App["S3 Applications / CLI"] -->|REST / HTTPS| Portal["Aarkam.IO<br/>(Edge Gateway Backbone)"]
    Portal -->|"1. Query Ring Placement"| Coord["Rokka.Coordinator"]
    Portal -->|"2. AES-256-GCM Encrypt & Slice"| Crypto["Kdouja.Primitives"]
    Portal -->|"3. Parallel 4KB Chunks"| Node1["Storage Node 1"]
    Portal -->|"3. Parallel 4KB Chunks"| Node2["Storage Node 2"]
    Portal -->|"3. Parallel 4KB Chunks"| Node3["Storage Node 3"]

Why Aarkam.IO is Mandatory for Cluster Operations

1. Authentication Broker: Validates incoming S3 SigV4 HMAC-SHA256 signatures against secure tenant credentials stored in the encrypted relational metadata store.
2. Topology Coordinator: Resolves dynamic hash ring node allocations from Rokka.Coordinator to determine the exact replica or Cauchy parity placement.
3. Client-Side Envelope Encryption Engine: Generates ephemeral Data Encryption Keys (DEKs) and encrypts object streams before network transmission, ensuring physical storage nodes never observe plaintext.
4. Stream Multiplexer: Manages concurrent, non-blocking gRPC streaming channels across all active Rokka.StorageNode endpoints.

Configuration & Ports

Aarkam.IO runs on ASP.NET Core Kestrel with enterprise security headers and TLS 1.3: