workspace "Realtime smart cities" "C4 Container model with ThingsBoard, Kafka, Spark Streaming ML, TDengine, Neo4j, Ontology DB, TB Adapter and Markov risk model" {

  !identifiers hierarchical

  model {
    operator = person "Operator" "Views dashboards and reacts to alerts."

    iot = softwareSystem "IoT/OT Devices" "Devices, gateways, PLC/RTU sources sending telemetry."
    social = softwareSystem "Social Networks" "External social feeds, APIs, webhooks."
    sys = softwareSystem "Sensors & Infrastructure (Syslog)" "Network devices, servers, and sensors emitting syslog."

    rtsa = softwareSystem "Streaming Platform" "Processes real-time data and serves dashboards through ThingsBoard." {

      thingsboard = container "ThingsBoard" "Direct IoT/OT ingest, dashboards, alarms, rule engine, device/entity management." "ThingsBoard"
      pg_tb = container "PostgreSQL (ThingsBoard)" "ThingsBoard internal metadata, relations, alarms and dashboard state." "PostgreSQL"

      kafka = container "Apache Kafka" "Real-time event streaming backbone for raw and processed events." "Apache Kafka"

      social_api = container "Social Ingest API" "Collects social feeds and publishes normalized events to Kafka." "FastAPI / Flask"
      syslog_api = container "Syslog Ingest API" "Collects RFC3164/RFC5424 syslogs and publishes normalized events to Kafka." "FastAPI / Flask + UDP/TCP listener"

      spark_ml = container "Spark Streaming ML" "Consumes raw telemetry, validates data, fills missing values, detects anomalies, and publishes cleaned data." "Spark Structured Streaming / MLlib"

      tdengine = container "TDengine" "Stores cleaned timestamped time-series for historical analysis." "TDengine"

      tb_adapter = container "TB Adapter API" "Reads historical and aggregated series from TDengine and publishes them to ThingsBoard for visualization." "FastAPI / Flask"

      neo4j = container "Neo4j" "Stores graph context of assets, dependencies, threats, vulnerabilities and state relationships." "Neo4j"
      ontology_db = container "Ontology DB" "Stores ontology concepts, rules and mitigations used by the risk model." "RDF Store / OWL Store / Graph DB"

      markov = container "Markov Risk & Mitigation Service" "Consumes cleaned data, calculates Markov states and risk scores, uses graph and ontology context, and selects mitigations." "Python / Scala / Java service"
    }

    operator -> rtsa.thingsboard "Views telemetry, historical data, alarms, Markov states and mitigation recommendations" "HTTPS"

    iot -> rtsa.thingsboard "Sends raw telemetry directly" "MQTT / HTTP / CoAP"

    social -> rtsa.social_api "Webhooks and API pulls" "HTTPS"
    rtsa.social_api -> rtsa.kafka "Publishes social.events" "Kafka Producer"

    sys -> rtsa.syslog_api "Sends syslog messages" "UDP/TCP 514"
    rtsa.syslog_api -> rtsa.kafka "Publishes infra.syslog" "Kafka Producer"

    rtsa.thingsboard -> rtsa.pg_tb "Stores internal platform data" "JDBC / SQL"
    rtsa.thingsboard -> rtsa.kafka "Publishes raw device telemetry/events for downstream analytics" "Rule Engine / Kafka integration"

    rtsa.kafka -> rtsa.spark_ml "Consumes raw telemetry/events" "Kafka Consumer"

    rtsa.spark_ml -> rtsa.tdengine "Writes cleaned timestamped time-series" "SQL / Native client"
    rtsa.spark_ml -> rtsa.markov "Publishes cleaned/imputed data for risk-state calculation" "Kafka / Stream / API"
    rtsa.spark_ml -> rtsa.thingsboard "Notifies detected anomalies for alerting" "REST API / MQTT"

    rtsa.tdengine -> rtsa.tb_adapter "Provides historical and aggregated time-series" "SQL / Native client"
    rtsa.tb_adapter -> rtsa.thingsboard "Publishes historical/aggregated telemetry for visualization" "REST API / MQTT"

    rtsa.markov -> rtsa.neo4j "Reads/writes graph context and state relationships" "Bolt / Cypher"
    rtsa.markov -> rtsa.ontology_db "Reads ontology rules and mitigation knowledge" "SPARQL / API"
    rtsa.neo4j -> rtsa.thingsboard "Publishes Markov states, risk scores and mitigation recommendations" "REST API / MQTT"
  }

  views {
    container rtsa "streaming-platform" {
      title "Streaming Platform - Container View"
      include *
      autolayout lr
    }

    styles {
      element "Person" {
        shape Person
        background #0f766e
        color #ffffff
      }

      element "Software System" {
        background #1168bd
        color #ffffff
      }

      element "Container" {
        background #438dd5
        color #ffffff
      }

      relationship "Relationship" {
        routing curved
      }
    }
  }
}