OpenCTI is an open-source cyber threat intelligence platform that ingests, manages, and analyzes threat data using the STIX 2.0/2.1 standard. The system is a monorepo containing a Node.js/TypeScript GraphQL backend (opencti-graphql), a React/Relay frontend (opencti-front), a Python client library (client-python), and a Python worker service (opencti-worker). The backend uses Elasticsearch/OpenSearch as its primary data store, Redis for caching and pub/sub, RabbitMQ for connector queues, and PostgreSQL for migrations. The frontend provides full CRUD UIs, dashboards, workspaces, playbook automation, and workflow management. Key entry points include the GraphQL API (resolvers per entity type), the frontend React app with Relay data fetching, and the Python client for programmatic access. Data flows involve ingestion via CSV/JSON/TAXII/RSS feeds, manual creation, connector enrichment, and inference rules that automatically derive relationships. External dependencies include Elasticsearch, Redis, RabbitMQ, MinIO/S3 for file storage, and optional AI services. The platform supports enterprise features (playbooks, PIR, XTM Hub) gated by license checks.
This is the Flashbots MEV-Boost Relay, a production-grade Go service that mediates between Ethereum block proposers (validators) and block builders. It implements the proposer-builder separation (PBS) specification, providing REST APIs for builder block submission (with simulation), validator registration, and proposer block retrieval (getHeader/getPayload). The relay is the critical infrastructure that enables validators to outsource block construction to specialized builders, maximizing MEV extraction while maintaining trustless verification. The architecture is a multi-service system with three independently scalable components: an API server (builder, proposer, data, and internal endpoints), a housekeeper background service (validator updates, proposer duties, metrics), and a website service (public status page). It uses PostgreSQL for persistent storage, Redis for low-latency bid caching, optional Memcached for redundant payload storage, and connects to one or more beacon nodes (consensus layer clients) for chain data. Block simulation is performed via an external validation node with a concurrency rate limiter. Key engineering highlights include a multi-beacon-client with failover and least-used ordering, a datastore fallback chain (Redis → Memcached → PostgreSQL), streaming JSON decoding for large validator sets, SSZ/JSON content negotiation with version detection across Ethereum forks (Capella through Fulu), and extensive Prometheus/OpenTelemetry metrics. The codebase is well-tested with integration tests, mock databases, and test data for multiple fork versions. It is actively maintained with recent commits, CI/CD pipelines, and a clear migration path for database schema changes.
strawberry-django is a mature, production-grade library that integrates the Strawberry GraphQL framework with Django. It automatically generates GraphQL types, fields, queries, and mutations from Django models, reducing boilerplate significantly. The library provides a powerful query optimizer (DjangoOptimizerExtension) that prevents N+1 queries by introspecting GraphQL selections and applying `select_related`, `prefetch_related`, `only()`, and `annotate()` automatically. It also includes declarative filtering, ordering, pagination (offset and cursor-based Relay connections), a full mutation system with nested input handling and error unions, permission extensions (IsAuthenticated, HasPerm, etc.), authentication helpers, Apollo Federation support, and Django Channels integration for subscriptions. The architecture is modular: core decorators (`@type`, `@input`, `@field`, `@connection`, `@mutation`) build on a flexible field class hierarchy (`StrawberryDjangoField` with mixins for pagination, ordering, filters). The optimizer is the standout feature, using an `OptimizerStore` to collect hints per field and apply them to querysets, with sophisticated prefetch merging and window-function pagination for nested relations. The library is well-tested with over 100 test files covering sync/async, polymorphism, relay, mutations, and edge cases, and includes a comprehensive documentation site. However, it has some technical debt: monkey-patching of Django's `QuerySet._clone`, deprecated legacy ordering/filtering APIs, and tight coupling to Strawberry GraphQL internals (requiring frequent compatibility shims). The codebase is actively maintained with frequent releases and a clear changelog, but the upstream dependency churn introduces medium drift risk.
Coral is an open-source, multi-tenant comment moderation platform developed by Vox Media. It provides a full-stack application with embedded commenting widgets (stream), a comprehensive admin panel for moderation, configuration, and community management, an authentication system supporting local, OAuth2/OIDC, Google, Facebook, SSO, and account management pages. The system architecture consists of a Node.js/Express server with Apollo GraphQL, MongoDB for persistence, Redis for caching and pub/sub, and Bull for job queues. The client uses React with Relay for GraphQL data fetching, and is organized into several bundles: stream (the embeddable comment widget), admin, auth, account, install, count, and embed. The core data flow involves comments being submitted via GraphQL mutations, processed through a modular pipeline (spam detection, word list filtering, toxicity analysis via Perspective API, external moderation phases, and pre-moderation rules), stored in MongoDB, and then distributed via GraphQL subscriptions and notifications (email, Slack, webhooks). The codebase is extensive and well-tested, though it exhibits some legacy patterns (recompose HOCs, partial migration from class components to hooks, duplicated utility code between client and server scripts).