Beelzebub
Concepts

Runtime Architecture

How configuration, protocol strategies, plugins, and tracing fit together.

At startup the CLI reads core YAML and either service YAML files or the BEELZEBUB_SERVICES_CONFIG JSON array. It validates the result, builds one protocol strategy per service, and starts listeners. Each strategy emits a common tracer event; the configured tracing strategy writes logs and can forward events to RabbitMQ or Beelzebub Cloud.

  1. 1
    ConfigurationYAML files and environment variables
  2. 2
    Parsing and ValidationSchemas and procedural validators
  3. 3
    Runtime BuilderProtocol strategies, TCP framing, and registered plugins
  4. 4
    Protocol ListenersSSH, HTTP, TCP, TELNET, and MCP
  5. 5
    Shared EventsNormalized interaction and session evidence
  6. 6
    DestinationsLogs, Prometheus, RabbitMQ, and Cloud
Runtime data flow from operator configuration to observable deception events.

Commands can return static handlers or dispatch to a registered CommandPlugin. HTTP plugins can control status, headers, and body; service plugins can run background work. The TCP strategy can frame binary application messages and invoke service-scoped WirePlugin hooks after building a response but before writing it and emitting the final event. External plugins are compiled into the same process as the runtime and therefore must be trusted like runtime code.