Infrastructure Settings
Settings → INFRASTRUCTURE controls appliance networking, software updates, TLS trust, and API access tokens. Admin role required.
Portable builds see a reduced tab (ports, TLS, display toggles). Business appliances add syslog/SIEM export and API token management.
For adapter roles and multi-NIC policy, see Network control (INTERFACES tab). For webhooks and email, see ALERTS on Integrations.
Software updates
StacksAtlas does not phone home on a timer. Admins choose when to check. Signed manifests come from
releases.stacksatlas.com (Ed25519). Open Settings → Infrastructure → Software Updates.Self-update (this appliance)
- Windows Business (MSI / portable): Check channel, download, and apply after confirm. MSI takes a database snapshot first.
- macOS: Check is supported; apply by opening a new DMG (portal or CDN).
- Docker: No one-click apply in the UI. Use host
docker pull+ compose recreate, Watchtower, or Hub depot metadata when enrolled. - Portable: May show availability; always-on service still needs a full Business installer.
Hub update depot (Central Hub)
On a Central Hub, stage a release once into a local depot, then enrolled Nodes pull over federation mTLS. Only the Hub needs outbound CDN access for a typical air-gap fleet.
| Block | Role |
|---|---|
| Hub update depot | Stage stable or preview from the CDN. Status lists staged versions and artifact keys under the appliance data directory. |
| Hub self-update | Check/apply for this Hub appliance (separate from fleet depot). |
| Scheduled apply | Opt-in weekly window on this appliance (Business only; not portable). Background worker; not a browser setting. |
Stage uses the same stable / preview preference as self-update. Staging fails or stays empty if that channel has no published release yet.
Version chips (Hub Dashboard / Federation)
| Chip | Meaning |
|---|---|
| Hub version | Running version of this Hub. |
| N of M behind Hub | Count of enrolled sites older than the Hub. |
| Behind / Current / Ahead / Unknown | That site's reported version vs the Hub. |
| Notify update / Update now | Push an update offer to an online Node. Offline sites hide these actions. |
Update now does not silently upgrade a remote site. It tells the Node a staged package is available. A Node admin still confirms under Software Updates (unless that Node enabled Scheduled apply).
What happens on a Node
- Admin opens Software Updates and clicks Check for Updates (or receives a Hub offer banner).
- When enrolled, check prefers the Hub depot over public CDN (no silent CDN fallback while federation certs are present).
- Dismiss the offer without applying is allowed.
- Apply: confirm checklist, then platform-native install where supported.
Platform apply matrix
| Platform | Hub notify | One-click apply |
|---|---|---|
| Windows MSI | Yes | Yes |
| Windows portable | Yes | Yes (launcher replace) |
| macOS DMG | Yes | No (open DMG / replace app) |
| Linux Docker | Yes (image + digest metadata in depot) | No (host pull + compose recreate; UI shows commands) |
Scheduled apply
Opt-in weekly window stored on the appliance (not portable). When enabled, the appliance may apply an already-accepted update during that window. It is not Hub-brain silent force-apply across the fleet. Each Node (or the Hub itself) opts in locally.
Defaults (what does not happen automatically)
| Behavior | Default |
|---|---|
| Background CDN poll | No |
| Silent install from Hub | No (local confirm; scheduled apply is explicit opt-in) |
| Enrolled Nodes hitting public CDN | No (Hub depot preferred) |
| Session-start update chip | Convenience check on admin login (respects snooze); not fleet policy |
Can the Hub force an update? No. Notify / stage + Node confirm, or Node-local scheduled apply if that site enabled it.
Docker standalone Watchtower recipe: Installation → Watchtower. Enrollment and Hub firewall: Federation. Portable limits: Site identity.
Appliance networking
The APPLIANCE NETWORKING panel configures core listener ports. Changes require SAVE & RESTART (service restart on Business; session restart on portable).
| Field | Default | Notes |
|---|---|---|
| HTTP PORT | 5000 (Win/Linux/Docker) · 5050 (macOS) | Primary UI and API when TLS is not yet trusted. macOS uses 5050 because Monterey+ reserves 5000 for AirPlay. |
| HTTPS PORT | 5001 | TLS listener after certificate trust is established. |
Syslog & SIEM export (Business only)
Enable SYSLOG & SIEM EXPORT to stream RFC5424 events (discovery, security grades, health changes) to Splunk, Elastic, or other collectors.
| Field | Purpose |
|---|---|
| SYSLOG HOST | Target collector IP or hostname. |
| PORT | UDP port (default 514). |
| APP NAME | RFC5424 TAG for SIEM filters. |
Hub governance
Federated Nodes may inherit SIEM settings from the Central Hub when sync SIEM settings is enabled in federation policy:
- Governed by Hub (Active): fields are read-only; Hub values apply.
- Overridden Locally: Node paused sync; local values active until you click Revert.
Toggle Override / Revert from the banner inside this panel. Fleet-wide policy is documented in Federation.
TLS security
DOWNLOAD TLS CERTIFICATE exports the appliance root CA for browser trust. First launch is HTTP-first (no certificate warning); use onboarding Trust on this PC or import the
.cer when you want HTTPS on port 5001.Details: Security: HTTP-first & TLS trust.
API integrations (Business only)
The API INTEGRATIONS panel manages long-lived
sa_ access tokens for scripts, CMDB automation, and custom integrations (separate from Settings → OPENAVC, which stores OpenAVC Control Bridge credentials).| Step | Action |
|---|---|
| 1 | Enter a TOKEN LABEL (e.g. CMDB-sync). |
| 2 | Click GENERATE ACCESS TOKEN and copy the sa_ value immediately (shown once). |
| 3 | Use Authorization: Bearer <token> or the key header documented in /api-docs. |
| 4 | Revoke with the delete icon when rotating credentials. |
Full integration recipes: Integrations & API.
Portable-specific controls
Portable sessions show an info banner with the data directory path. DISPLAY & DIAGNOSTICS duplicates DARK THEME and DIAGNOSTICS MODE from the Identity tab (Business) for session-only operators.
Syslog and API tokens are not available until you install the Business appliance.
Related guides
- Installation: Docker Watchtower and enrolled-Node host commands
- Federation: Hub notify and port 5002 firewall
- Integrations: webhooks, OpenAVC, SMTP via ALERTS
- Security: RBAC, SSO, encryption
- Troubleshooting: 401/403 after port or token changes