The following diagram shows the overview of the AWS architecture.
(The diagram was made with draw.io desktop.)
The following subsections briefly describe each component.
All the resources of the Mumble service are described with AWS Cloud Development Kit (CDK) and deployed as a AWS CloudFormation stack.
Please refer to the /cdk folder for more details.
The Amazon CloudFront distribution faces the Internet and serves the REST API (Amazon API Gateway) and media files (Amazon S3). What Mumble API clients recognize as the Mumble API is delivered from this distribution. A custom ___domain name may be associated with this distribution, and its certificate is managed by AWS Certificate Manager.
The REST API on Amazon API Gateway provides the endpoints of the Mumble API. The endpoints include those required for ActivityPub and WebFinger*. Thanks to Redoc, the OpenAPI documentation is available at https://redocly.github.io/redoc/?url=https://raw.githubusercontent.com/codemonger-io/mumble/main/cdk/openapi/api-production.json.
Most of the endpoints are implemented with API integration functions (AWS Lambda).
Some endpoints need user authentication, and a client has to provide an ID token issued by the user pool (Amazon Cognito) to access them.
* WebFinger is required by Mastodon to locate accounts on distributed networks.
The Amazon S3 bucket stores ActivityPub objects and media files.
Changes in the bucket trigger workflows (AWS Step Functions) via Amazon EventBridge.
Amazon EventBridge rules fire events when objects are created, updated, or deleted in the Amazon S3 bucket.
This group of AWS Lambda functions implements the API integrations of the REST API on Amazon API Gateway.
The Lambda function that receives an ActivityPub object posted to the "inbox" endpoint of the Mumble API is in this group. The function validates the object and saves it in the Amazon S3 bucket.
State machines on AWS Step Functions implement the workflows to handle inbound and outbound ActivityPub objects.
States of the state machines are implemented with state functions (AWS Lambda).
This group of AWS Lambda functions implements states of the state machines on AWS Step Functions.
There are two Amazon DynamoDB tables.
- "user table" manages user information
- "object table" manages metadata of ActivityPub activities and objects
DynamoDB Streams of the tables trigger statistics functions (AWS Lambda) when items are created, update, or deleted in the tables.
This group of AWS Lambda functions updates statistics, like the number of followers, the number of replies, etc., when items are created, updated, or deleted in the Amazon DynamoDB tables.
The Amazon Cognito user pool manages authentication and identities of users.
The Amazon Cognito identity pool provides the Amazon IAM role for authenticated users.
A Mumble API client can exchange an ID token issued by the user pool (Amazon Cognito) for an Amazon IAM role that allows the client to directly upload objects to the Amazon S3 bucket.
AWS Certificate Manager manages the certificate associated with the distribution of the Mumble API (Amazon CloudFront).
A Mumble API client provides a user interface to interact with the Mumble API.
A Mumble user interacts with the Mumble API via a Mumble API client.
The Mumble API is specifically designed to talk to Mastodon servers. Mastodon adopts HTTP Signature to validate any incoming activities, and the Mumble API supports it.