Architecture & Security
StacksAtlas is a self-contained appliance built on .NET 10. Discovery, API, and UI run in one process with an embedded LiteDB database.
Hub & fleet topology
For multi-site deployments, StacksAtlas uses a Central Hub plus edge Nodes. The Hub aggregates fleet inventory; each Node scans its local LAN and syncs upstream. See the dedicated guide for enrollment, Tailscale remote sites, licensing, and troubleshooting.
Technical Stack
Core Engine
- Runtime: .NET 10 (C#)
- Architecture: Multi-threaded, asynchronous pipeline designed for parallel subnet scanning.
- Database: LiteDB (Embedded NoSQL). A serverless, high-performance document store that resides entirely on the local disk. This ensures zero latency for queries and eliminates the need for external SQL servers.
User Interface
- Framework: React 19
- Style System: Material UI (MUI v7)
- Delivery: The UI is compiled into the application binary and served directly by the .NET host (Kestrel), removing the need for separate web servers like IIS or Nginx.
File Structure
All application data is stored in a single, predictable location:
%ProgramData%\StacksAtlas. This makes backup and migration extremely simple.| File / Folder | Description |
|---|---|
| StacksAtlas.db | The main LiteDB database file containing your inventory, scan history, and user accounts. This is your critical data. |
| logs/ | Directory containing daily log files (log-YYYYMMDD.txt). Useful for troubleshooting. |
| certs/ | Directory housing the self-signed SSL certificate (StacksAtlas.pfx) generated during the first run. |
| license.key | A small file containing your encrypted activation key and instance ID. |
| networksettings.json | Configuration file storing scan scopes, engine tuning, and polling preferences. |
Note: The application binaries themselves are located in
%ProgramFiles%\StacksAtlas.Security & Access Control
StacksAtlas assumes a Zero Trust environment regarding external data while strictly protecting local access. For a deep-dive into our encryption, RBAC models, and data privacy policies, please see our dedicated Security documentation.
Network Footprint
StacksAtlas is designed to be a "good citizen" on the network.
- Passive Listening: The mDNS and ARP modules listen for broadcast traffic without flooding the network.
- Rate Limiting: Active scans (ICMP/TCP) are rate-limited to prevent triggering intrusion detection systems (IDS) or saturating low-bandwidth links.
- Ports (v1.7.5+ HTTP-first): First launch opens HTTP on 5000 (Windows/Docker) or 5050 (macOS). HTTPS on 5001 is available after optional local CA trust in onboarding. Ports are configurable in Settings.
- Hub federation (Business): enrolled Nodes also dial the Hub on TCP 5002 (mTLS). Open 5002 on the Hub host; the Windows MSI does not open it automatically. See Federation ports.