Skip to content
Menu
Platform
Features
Architecture
Who we are
Guides
Getting started
Get involved
GitHub
Sponsor
CaptainPBX Full-Stack Architecture
Architecture diagram showing client interfaces, edge security, application services, privileged system agent, persistence, and Asterisk media engine.
CAPTAINPBX · PLATFORM ARCHITECTURE
A secure, modular communications platform
From browser and endpoint access to application services, protected system operations and real-time voice.
FULL STACK VIEW
01 CLIENT INTERFACES
The access layer for administrators, users and voice endpoints
Admin SPA
React · Vite
User Portal
React
SIP / WebRTC Endpoints
Desk phones · Softphones · Browsers
02 OS EDGE & HOST SECURITY
Traffic filtering, secure ingress and certificate lifecycle
FIREWALL
Captain Shield
nftables · allowlisted traffic
INGRESS
Nginx Reverse Proxy
HTTPS routing to application
CERTIFICATES
Captain Trust
ACME · TLS certificate management
03 APPLICATION LAYER
Runs as the unprivileged
captain
user
Captain Core
Symfony · PHP 8.4
API / LOGIC
Product Modules
Feature and domain services
captain-jobs
BullMQ background workers
captain-events
AMI event pump
04 PRIVILEGED SYSTEM OPERATIONS
A narrow, controlled boundary for root-level actions
captain-system-agent
Root daemon · Unix socket · allowlisted verbs only
ROOT BOUNDARY
05 DATA PERSISTENCE
Durable records, event streams and asynchronous queues
MariaDB
Tenant records
Redis
Event streams · queues
06 MEDIA ENGINE
Runs independently as the
asterisk
user
Asterisk PJSIP Engine
SIP signalling · RTP media · call control
HTTPS ingress
Application API
Tenant data
Events / queues
Solid lines: primary request / service paths
Dashed lines: event, control or certificate-related paths
CAPTAINPBX
