From e9143e0e58e4e4de308eade2543117fe925fb5d5 Mon Sep 17 00:00:00 2001
From: Johannes Rest <johannes@jr-it-services.de>
Date: Tue, 4 Aug 2026 11:15:25 +0200
Subject: [PATCH] Add architecture diagram to README

---
 README.md             |  20 +-------
 docs/architecture.svg | 103 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 104 insertions(+), 19 deletions(-)
 create mode 100644 docs/architecture.svg

diff --git a/README.md b/README.md
index 63e63fb..380fa4d 100644
--- a/README.md
+++ b/README.md
@@ -4,25 +4,7 @@
 BizTalk Server 2020 auf Windows Server 2019. Die Anwendung trennt den
 berechtigten BizTalk-Datenzugriff vollstaendig vom Checkmk-Agenten:
 
-```text
-Scheduled Task (normales dediziertes Servicekonto)
-  |
-  | jede Minute: BizTalkCheckmkPulse.exe --collect
-  v
-lokales BizTalk-WMI + BizTalk-SQL + Application Event Log
-  + parallele TCP-/UDP-Netzwerkprobes zu aktiven BizTalk-Endpunkten
-  |
-  | atomarer, versionierter, SHA-256-geschuetzter Snapshot
-  v
-%ProgramData%\BizTalkCheckmkPulse\data\biztalk-checkmk-pulse.snapshot
-  ^
-  | nur lesen: BizTalkCheckmkPulse.exe --consume
-  |
-Checkmk Windows Agent (LocalSystem)
-  |
-  v
-neun kompakte Checkmk Local Checks
-```
+![Architektur von BizTalk Checkmk Pulse mit Provider, Endpoint-Probes, Snapshot und Checkmk-Consumer](docs/architecture.svg)
 
 Damit bekommt `LocalSystem` keine BizTalk- oder SQL-Berechtigung. Nur das
 dedizierte Provider-Konto wird in die konfigurierte BizTalk Server Read Only
diff --git a/docs/architecture.svg b/docs/architecture.svg
new file mode 100644
index 0000000..351ab44
--- /dev/null
+++ b/docs/architecture.svg
@@ -0,0 +1,103 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="720" viewBox="0 0 1200 720" role="img" aria-labelledby="title description">
+  <title id="title">BizTalk Checkmk Pulse Architektur</title>
+  <desc id="description">Ein privilegierter Scheduled Task liest BizTalk-Daten und prueft aktive Endpunkte. Er schreibt einen validierten Snapshot, den der Checkmk-Agent als LocalSystem nur konsumiert.</desc>
+  <defs>
+    <marker id="arrow-blue" markerWidth="10" markerHeight="10" refX="9" refY="3" orient="auto" markerUnits="strokeWidth">
+      <path d="M0,0 L0,6 L9,3 z" fill="#2563eb"/>
+    </marker>
+    <marker id="arrow-green" markerWidth="10" markerHeight="10" refX="9" refY="3" orient="auto" markerUnits="strokeWidth">
+      <path d="M0,0 L0,6 L9,3 z" fill="#059669"/>
+    </marker>
+    <filter id="shadow" x="-10%" y="-10%" width="120%" height="130%">
+      <feDropShadow dx="0" dy="3" stdDeviation="4" flood-color="#0f172a" flood-opacity="0.12"/>
+    </filter>
+    <style>
+      .title { font: 700 28px Arial, sans-serif; fill: #0f172a; }
+      .lane-title { font: 700 17px Arial, sans-serif; fill: #334155; }
+      .box-title { font: 700 17px Arial, sans-serif; fill: #0f172a; }
+      .box-text { font: 14px Arial, sans-serif; fill: #334155; }
+      .small { font: 13px Arial, sans-serif; fill: #475569; }
+      .label { font: 700 13px Arial, sans-serif; fill: #1e40af; }
+      .provider-box { fill: #ffffff; stroke: #2563eb; stroke-width: 2; }
+      .endpoint-box { fill: #ecfdf5; stroke: #059669; stroke-width: 2; }
+      .snapshot-box { fill: #fff7ed; stroke: #ea580c; stroke-width: 2; }
+      .consumer-box { fill: #ffffff; stroke: #64748b; stroke-width: 2; }
+      .blue-arrow { fill: none; stroke: #2563eb; stroke-width: 3; marker-end: url(#arrow-blue); }
+      .green-arrow { fill: none; stroke: #059669; stroke-width: 3; marker-end: url(#arrow-green); }
+    </style>
+  </defs>
+
+  <rect width="1200" height="720" rx="18" fill="#f8fafc"/>
+  <text x="60" y="52" class="title">BizTalk Checkmk Pulse</text>
+  <text x="60" y="78" class="small">Privilegierte Datenerfassung und unprivilegierter Checkmk-Consumer</text>
+
+  <rect x="35" y="105" width="1130" height="355" rx="18" fill="#eff6ff" stroke="#bfdbfe" stroke-width="2"/>
+  <text x="60" y="138" class="lane-title">Provider-Zone: dediziertes AD-Servicekonto</text>
+
+  <g filter="url(#shadow)">
+    <rect x="70" y="175" width="245" height="105" rx="14" class="provider-box"/>
+    <text x="192" y="207" text-anchor="middle" class="box-title">Scheduled Task</text>
+    <text x="192" y="232" text-anchor="middle" class="box-text">jede Minute, RunLevel Limited</text>
+    <text x="192" y="254" text-anchor="middle" class="box-text">IgnoreNew verhindert Ueberlappung</text>
+  </g>
+
+  <g filter="url(#shadow)">
+    <rect x="395" y="165" width="310" height="125" rx="14" class="provider-box"/>
+    <text x="550" y="198" text-anchor="middle" class="box-title">BizTalkCheckmkPulse --collect</text>
+    <text x="550" y="225" text-anchor="middle" class="box-text">BizTalk-WMI + BizTalk-SQL</text>
+    <text x="550" y="247" text-anchor="middle" class="box-text">Application Event Log</text>
+    <text x="550" y="269" text-anchor="middle" class="box-text">aktive Send-/Receive-Artefakte</text>
+  </g>
+
+  <g filter="url(#shadow)">
+    <rect x="795" y="165" width="330" height="125" rx="14" class="endpoint-box"/>
+    <text x="960" y="198" text-anchor="middle" class="box-title">Externe BizTalk-Endpunkte</text>
+    <text x="960" y="225" text-anchor="middle" class="box-text">TCP: HTTP(S), SFTP, FTP, WCF, SMB</text>
+    <text x="960" y="247" text-anchor="middle" class="box-text">UDP: explizite udp://-Ziele</text>
+    <text x="960" y="269" text-anchor="middle" class="box-text">nur Started / Enabled</text>
+  </g>
+
+  <path d="M315 227 H385" class="blue-arrow"/>
+  <path d="M705 227 H785" class="green-arrow"/>
+  <text x="745" y="211" text-anchor="middle" class="label" fill="#047857">TCP / UDP</text>
+
+  <g filter="url(#shadow)">
+    <rect x="395" y="335" width="310" height="90" rx="14" class="snapshot-box"/>
+    <text x="550" y="367" text-anchor="middle" class="box-title">Validierter lokaler Snapshot</text>
+    <text x="550" y="392" text-anchor="middle" class="box-text">atomar + versioniert + SHA-256</text>
+    <text x="550" y="413" text-anchor="middle" class="small">Endpoint-Katalog und kompakte Checkmk-Daten</text>
+  </g>
+  <path d="M550 290 V325" class="blue-arrow"/>
+  <text x="565" y="316" class="label">schreiben</text>
+
+  <line x1="35" y1="485" x2="1165" y2="485" stroke="#94a3b8" stroke-width="2" stroke-dasharray="9 7"/>
+  <rect x="470" y="470" width="260" height="30" rx="15" fill="#f8fafc" stroke="#94a3b8"/>
+  <text x="600" y="490" text-anchor="middle" class="small">Berechtigungsgrenze</text>
+
+  <rect x="35" y="510" width="1130" height="175" rx="18" fill="#f1f5f9" stroke="#cbd5e1" stroke-width="2"/>
+  <text x="60" y="543" class="lane-title">Checkmk-Zone: LocalSystem ohne BizTalk-/SQL-Rechte</text>
+
+  <g filter="url(#shadow)">
+    <rect x="75" y="575" width="245" height="75" rx="14" class="consumer-box"/>
+    <text x="197" y="607" text-anchor="middle" class="box-title">Checkmk Windows Agent</text>
+    <text x="197" y="632" text-anchor="middle" class="box-text">LocalSystem</text>
+  </g>
+
+  <g filter="url(#shadow)">
+    <rect x="430" y="565" width="300" height="95" rx="14" class="consumer-box"/>
+    <text x="580" y="597" text-anchor="middle" class="box-title">--consume</text>
+    <text x="580" y="622" text-anchor="middle" class="box-text">liest nur den Snapshot</text>
+    <text x="580" y="643" text-anchor="middle" class="box-text">kein WMI, SQL oder Netzwerkzugriff</text>
+  </g>
+
+  <g filter="url(#shadow)">
+    <rect x="840" y="575" width="285" height="75" rx="14" class="consumer-box"/>
+    <text x="982" y="607" text-anchor="middle" class="box-title">9 kompakte Local Checks</text>
+    <text x="982" y="632" text-anchor="middle" class="box-text">inkl. Endpoint Reachability</text>
+  </g>
+
+  <path d="M320 612 H420" class="blue-arrow"/>
+  <path d="M730 612 H830" class="blue-arrow"/>
+  <path d="M705 380 H765 V545 H580 V555" class="blue-arrow"/>
+  <text x="775" y="463" class="label">nur lesen</text>
+</svg>