Overview
Interactive architecture diagram showing all mipo components and their real-time health status. Each node represents a container or external service. Click any node to navigate to its detailed health page. Connection lines animate when data is flowing and turn solid when degraded.
Fields & columns
| Name | Description |
|---|---|
Backup | pg_dump cron service that backs up all three schemas of the db cluster |
S3 | Cloud storage node, only visible when S3 remote backup is configured |
Config | The config schema (relational) for identity, configuration, and audit events, in the single db cluster |
Results | The results schema (TimescaleDB hypertables) for scan results and state changes, in the single db cluster |
Jobs | The jobs schema (relational) for scan job orchestration, in the single db cluster |
Manager | User-facing API, GUI, and admin functions on port 3000 |
Ingest 1 / Ingest 2 | Scanner API nodes handling heartbeats, job dispatch, and results on port 3001 |
Dispatcher | Scan orchestration service with no HTTP API |
Gateway | Traefik reverse proxy for TLS termination and path-based routing |
DNS / HTTPS indicators | Public DNS and HTTPS certificate status for the configured FQDN |
Scanner nodes | Registered scanners shown with their current status (active, pending, offline, disabled) |
How to
Diagnose a component failure
- Look for red (unhealthy) nodes in the diagram
- Click the red node to navigate to its detailed health page
- Review the specific error messages and metrics on the detail page
Check backup health from the overview
- Navigate to Health > Overview.
- Look for the backup status indicator in the infrastructure section.
- Click the indicator to navigate to Admin > Backups for detailed scheduling.
Gotchas
- Animated connection lines indicate active data flow; solid lines mean the connection is inactive or degraded.
- The Dispatcher node is not clickable because it has no HTTP API. To troubleshoot dispatcher issues, check its container logs with `docker compose logs dispatcher`.
- DNS and HTTPS indicators reflect the public URL configured in Admin > Settings — they will show unknown if no public URL is set.
- Health evaluator thresholds: scanner load ratio 0.8, memory minimum ratio 0.10, DB sessions maximum ratio 0.80, long query threshold 60 seconds, auth failure limit 10 in 5-minute window, TLS certificate expiry warning at 30 days.
- The platform uses two Docker networks: external (internet-facing, outbound NAT) and internal (isolated, no outbound). The db cluster is internal-only. Services bridge both networks. See Network Architecture under Infrastructure for the full map.
- Node colors reflect ONLY infrastructure health (container running, healthy heartbeat). Job-error state hangs in a red subscript box BELOW the node showing "{N} Errors". Same visual pattern for every error-bearing node so you can scan the diagram uniformly.
- Scanner nodes get a red Errors subscript when active job errors route to that scanner (failed_scanner_auth, scanner_disabled, scanner_ip_changed, no_heartbeat, binary_version_mismatch, result_submit_failed). Click the main scanner box to open the Scanners page; click the red subscript to jump straight to Health > Job Errors.
- The Dispatcher node stays green if its container is healthy, but a red Errors subscript appears when there are orphan jobs (no_scanner), stuck jobs (stuck_pending, stuck_running, dispatcher_failure, expired), or scan-deletion cleanup gaps (scan_deleted). Click main = maintenance page; click subscript = job errors triage.
- The Config (config-schema) node behaves the same way: green main box when the db cluster is reachable, red subscript when there is bad scan-template content (target_invalid) or zero-rate misconfiguration in scanners/subnets/port-lists (rate_limit_exhausted). The DB is healthy; the data inside it is wrong.
- The left tier-label column shows summary error counts in red per tier (Scanners / Services / Databases). These mirror the per-node subscripts so you can scan the diagram top-to-bottom for active problems.
API calls (8)
| Method | Path | Description |
|---|---|---|
| GET | /api/health/services/manager | Manager service health and metrics |
| GET | /api/health/services/ingest | Ingest node statuses and metrics |
| GET | /api/health/infra/db-status | Database connection pool health |
| GET | /api/health/infra/proxy-status | Traefik reverse proxy metrics |
| GET | /api/scanners | Registered scanners and their statuses |
| GET | /api/health/internet-status | Public DNS and HTTPS reachability |
| GET | /api/health/infra/backup | Backup system health and S3 status |
| GET | /api/health/job-errors/topology | Aggregated job-error counts by topology target (scanner/dispatcher/db) |
Related
- Alarms — Active system alarms detected by built-in fault rules
- Manager — Detailed health metrics for the manager service
- Ingest — Per-node health for ingest-1 and ingest-2
- Database Status — Connection pool metrics for all databases
- Proxy Status — Traefik router, service, and middleware counts
- Scanners — Scanner connectivity and heartbeat status
- Backup — Backup schedule, storage, and trigger history
- Maintenance — Centralized container restart and maintenance operations (wrench icons link here)