Skip to content

ADR-001: Dedicated Worker Gateway

Status: ACCEPTED.

Context

CURRENT: Scanner Workers connect directly to PostgreSQL, Redis, and S3-compatible storage. Startup and dependency initialization are implemented in backend/cmd/worker/main.go.

Future distributed Workers must connect outbound to hxEASM without direct PostgreSQL or Redis access.

Decision

Create a dedicated Worker Gateway as a separate Go binary in the existing backend module:

backend/cmd/worker-gateway/main.go

Gateway will reuse existing backend packages, repositories, services, and models where safe. It will provide gRPC APIs for task acquisition, lease management, progress reporting, result submission, artifact handling, and Worker authorization.

Gateway must not execute scanner plugins.

Alternatives

  • Keep direct PostgreSQL/Redis/S3 Worker access.
  • Embed Gateway into the API binary.
  • Build a generic database-over-gRPC proxy.

Consequences

  • Gateway becomes the central security boundary for Worker task access.
  • Scanner Workers can run remotely with only Gateway connectivity.
  • Existing asset, threat, scan, and file services can be reused.
  • Deployment gains one additional service.

Risks

  • Gateway must not duplicate existing persistence rules.
  • Gateway must be horizontally scalable.
  • mTLS, Worker identity, and revocation must be implemented correctly.