Architecture

This page is the deeper technical view. For the beginner model, start with Concepts & Mental Model.

System architecture

The product is intentionally a small management layer around official FRP, not a replacement tunnel engine.

Control plane vs data plane

Plane	Purpose	Typical transport
Enrollment / management	bootstrap trust, identity, service metadata, management actions	verified HTTPS
FRP control	register proxies and maintain reverse tunnel control	FRP native TLS or WSS
Published service data	carry SSH/HTTP/HTTPS/custom TCP	TCP through FRP proxy

These planes use different credentials and should not be treated as interchangeable.

Direct mode

Direct is the default deployment mode.

Enterprise single-443

The backend ports 6099 and 7000 are loopback-only in this mode and should not be Internet-exposed.

Identity model

The important design rule is that mutable display metadata never becomes canonical identity.

Trust establishment

The FRP token authenticates the FRP tunnel. It is not the same credential as the Enrollment Code, Bootstrap Ticket, or client management identity.

Persistent server state

Important state includes:

/etc/frp-auto-deploy/config.json
/etc/frp-auto-deploy/pki/
/etc/frp/server_token
/var/lib/frp-auto-deploy/registry.json

The design goal is to preserve identity, CA trust, token, registry, and public-port reservations across normal updates, reboots, and supported restore workflows.

Fail-closed rules

The management layer should fail rather than guess when it encounters conditions such as:

unknown or ambiguous client identity
invalid signatures
CA mismatch
inconsistent registry state
unknown release identity
unsafe restore/update conditions

Scale boundary

FRP Auto Deploy is optimized for a few systems to a few dozen clients. It does not aim to become a large-fleet orchestrator, CMDB, endpoint compliance platform, or high-availability management cluster.

Getting Started

Client & Services

frpctl

Deployment

Operations

Security & Reference

Architecture

Architecture

System architecture

Control plane vs data plane

Direct mode

Enterprise single-443

Identity model

Trust establishment

Persistent server state

Fail-closed rules

Scale boundary

​Architecture

​System architecture

​Control plane vs data plane

​Direct mode

​Enterprise single-443

​Identity model

​Trust establishment

​Persistent server state

​Fail-closed rules

​Scale boundary

Architecture

System architecture

Control plane vs data plane

Direct mode

Enterprise single-443

Identity model

Trust establishment

Persistent server state

Fail-closed rules

Scale boundary