Solution strategy

This section summarises the key decisions that shaped the architecture of the dataLOFT platform.

Custom connector over existing frameworks

The platform uses RUN-DSP, a purpose-built connector written in Go, rather than adopting an existing framework such as Eclipse Dataspace Components (EDC). EDC is Java/OSGi-based and assumes one instance per participant, which is impractical at scale for individual data owners. RUN-DSP was designed for multi-tenancy from the start and runs as a single lightweight binary with minimal resource requirements. See ADR-001 for the full decision record.

gRPC for internal interfaces

All interfaces between RUN-DSP and its backend services (both provider backends and consumer clients) are defined in Protocol Buffers and served over gRPC. The proto definitions are published in the run-dsrpc repository. This gives data service authors a typed, language-agnostic contract and keeps the connector independent of any particular implementation language.

DID Web and DPoP for participant identity

Rather than relying on a central identity server, the platform uses did:web-based decentralised identifiers. Each participant's identity is expressed in a DID document hosted by HST-DID and registered in FC-Service. Authentication uses DPoP tokens (RFC 7800) whose issuer field contains the participant's did:web URI. The Signature-Auth-Handler resolves the DID document, verifies the token signature against the declared key, and checks that the participant is registered in the catalogue. This approach aligns with the Gaia-X Trust Framework without requiring a centralised IdP.

Standards-based dataspace communication

The platform currently implements the IDSA Dataspace Protocol as a well-defined, interoperable standard. This is a deliberate choice at the time of platform creation, not a permanent constraint. The architecture does not preclude adopting other dataspace protocols as the ecosystem evolves. The requirement is that dataspace communication is based on established, open standards.

GitOps for deployment

All cluster state is declared in the dataLOFT-gitops repository and applied by FluxCD. Infrastructure is provisioned with Terraform on IONOS Cloud. Secrets are encrypted with SOPS. This gives full auditability of infrastructure changes and enables reproducible environment setup.