Cloud-based Document Management System

Abstract

This reference architecture provides guidance on IaaS primitives, open source software, and architecture design, in order to implement a highly-available and production ready cloud-based document management system.

This deployment is using the Mayan Electronic Document Management System (EDMS) – an open source web application for document collaboration, tamper proof signing, transformations, and more. Mayan EDMS also comes with a REST API for integrations with 3rd party software. For this example, we are using the recommended Docker Compose installation, which the Mayan EDMS project recommends for most cases, with two exceptions. This architecture decouples the PostgreSQL database layer to achieve separation of concerns and architect for high availability; and employs NGINX as reverse proxies to the application, using Certbot with the dns_linode plugin for SSL/TLS certificate management. Unison provides bi-directional synchronization of the Let’s Encrypt directories so that both application nodes contain the same certificate and private key. Unison also synchronizes the Docker volume directories between the two instances.

A NodeBalancer is configured with the TCP protocol to pass traffic through to the backend servers for SSL/TLS termination, and with Proxy Protocol V1 so that NGINX can log the originating client IP addresses. Linode S3-compatible Object Storage is the storage backend for Mayan EDNS documents, as well as for routine database backups.

All nodes are secured with Cloud Firewalls for protection from the outside world, and communicate internally via private VLAN. The application servers connect to the databases via a shared floating VLAN IP address, with Keepalived to facilitate failover.

The PostgreSQL databases are implemented as an active-active cluster, using Bucardo for bi-directional replication. A backup script dumps the Mayan database, compresses the dump file, and then leverages Rclone to upload the timestamped archive to the Object Storage bucket.

Prometheus is used to collect metrics for infrastructure performance monitoring and alerting. Grafana provides rich visualization of the Prometheus data.

Technologies Used

• Mayan EDMS
• PostgreSQL 14
• Bucardo
• Keepalived
• Prometheus
• Grafana
• NGINX
• Certbot with the dns_linode plugin
• Unison
• Rclone
• Linode Services:
  • Compute
  • Object Storage
  • VLAN
  • NodeBalancer
  • DNS Manager
  • API

Business Benefits

• Web-based application – no software to install on end user devices
• Security, privacy, and total control of your data
• Easy integration with third-party software
• Automation of document workflows for business processes

Diagrams