Auto-Discovery
Your infrastructure,
mapped automatically.
Install the HostAtlas agent and watch your infrastructure map itself. Every server, every running service, every domain, every container, every SSL certificate — discovered automatically within seconds. No YAML files. No manual inventory. No stale spreadsheets.
What Gets Discovered
Six categories of infrastructure data, collected automatically.
The agent scans your server comprehensively across six distinct discovery categories. Each scan runs within seconds and captures detailed metadata about every component found.
Servers & Hostnames
The agent identifies the server's hostname, operating system, kernel version, architecture, and public/private IP addresses. This becomes the root node of your infrastructure graph.
Running Services
Detects nginx, Apache, MySQL, PostgreSQL, Redis, and Caddy by scanning the process table. For each service, the agent captures the version number and listening port.
Domains & Virtual Hosts
Web server configuration files are parsed to extract every domain hosted on the server. Nginx server blocks, Apache VirtualHosts, and Caddy site blocks are all supported.
SSL/TLS Certificates
Every SSL certificate referenced in web server configs is read from disk and validated. Expiration dates, issuer information, and Let's Encrypt detection are all captured automatically.
Docker Containers
The agent queries the Docker socket to enumerate every container on the server. Image name, tag, running status, port mappings, and resource allocation are all collected.
Log File Locations
The agent automatically discovers log file paths for each detected service. Access logs, error logs, and system logs are identified so you can stream them directly from the HostAtlas dashboard.
How Discovery Works
Eight steps from install to full visibility.
The discovery process is fully automated. No configuration files to write, no services to define, no ports to specify. The agent handles everything from the moment it starts.
Agent installs & registers
A single curl command downloads the Go binary, creates a systemd service, and registers with your HostAtlas workspace using an install key. The entire process takes under 30 seconds.
First discovery scan runs
Within 30 seconds of installation, the agent runs its first comprehensive discovery scan. Server metadata, running processes, and system information are collected immediately.
Process table scanned
The agent reads /proc to enumerate all running processes. Known service signatures (nginx, apache2, mysqld, postgres, redis-server, caddy) are matched against the process list.
Web server configs parsed
When a web server is detected, the agent parses its configuration files: nginx.conf, Apache vhost files, and Caddyfile are read to extract every hosted domain.
Docker socket queried
If Docker is present, the agent connects to /var/run/docker.sock and lists all containers. Image names, running states, port mappings, and resource limits are captured for each container.
SSL certificates validated
Certificate file paths referenced in web server configs (e.g. ssl_certificate) are read from disk. The agent extracts expiry dates, issuer info, and detects Let's Encrypt certificates.
Results pushed to API
The complete discovery payload is sent to the HostAtlas API over HTTPS. The platform processes the data, updates your infrastructure map, and makes everything searchable within seconds.
Changes detected as events
On subsequent scans (every 5 minutes), the agent compares results to the previous state. New services, removed domains, stopped containers, and expiring certificates are flagged as events automatically.
Continuous discovery, not a one-time scan
Discovery runs every 5 minutes for the lifetime of the agent. When you deploy a new service, add a domain, or spin up a container, it appears in your HostAtlas dashboard automatically — no manual registration, no config file changes, no API calls from your CI/CD pipeline.
Infrastructure Model
A hierarchy that mirrors reality.
HostAtlas organizes discovered infrastructure into a clear, navigable hierarchy. Every element has a parent, every relationship is tracked, and the entire graph is searchable.
Server
prod-web-01 · Ubuntu 22.04 · 203.0.113.42
nginx 1.24.0
ports 80, 443 · running
mysql 8.0.35
port 3306 · running
redis 7.2.4
port 6379 · running
Docker Engine 24.0.7
3 containers
Server → Services → Domains → Logs
Every piece of discovered infrastructure is placed into a strict hierarchy. The server is the root. Services are children of the server. Domains are children of the web server service that hosts them. Log files are associated with their parent service or domain.
Server (root node)
The server is the top-level entity. Every other discovered resource is a child of the server. Server metadata includes hostname, OS, IP addresses, CPU, and memory.
Services
Each detected service (nginx, mysql, redis, etc.) is a direct child of the server. Services carry version numbers, listening ports, and running status. When a service disappears from the process table, HostAtlas creates an incident.
Domains
Domains are children of the web server service that hosts them. Each domain has an associated SSL certificate (if HTTPS is configured), health check status, and log file paths. Domains get their own dedicated page in the HostAtlas dashboard.
Containers
Docker containers are children of the server. Each container tracks its image, tag, status, port mappings, and resource limits. Container state changes (start, stop, restart) are recorded as events.
Log files
Log file paths are associated with the service that generates them. Nginx access/error logs, MySQL slow query logs, Redis server logs, and syslog are all linked to their parent services for easy navigation.
Supported Services
Deep detection for every major service.
The agent knows how to detect, interrogate, and monitor each of these services. For every one, we capture not just the presence of the process but its version, configuration, and the resources it manages.
nginx
Web server & reverse proxy
The most popular web server in our user base. The agent detects nginx processes, reads the main config and all included files, and extracts every server block and its associated domains.
Apache
HTTP server
Full support for Apache HTTP Server. The agent detects both apache2 and httpd processes, reads configuration files from standard and custom locations, and parses VirtualHost blocks.
Caddy
Web server with automatic HTTPS
Caddy's automatic HTTPS makes certificate detection straightforward. The agent reads the Caddyfile, extracts domain blocks, and identifies the auto-provisioned certificates managed by Caddy.
MySQL
Relational database
The agent detects mysqld processes and reads the MySQL configuration to determine the listening port, data directory, and log file locations. Version detection runs via the mysqld binary.
PostgreSQL
Relational database
PostgreSQL detection identifies the postgres process, extracts the version, and locates configuration files including pg_hba.conf. The listening port and log directory are captured automatically.
Redis
In-memory data store
Redis detection identifies the redis-server process, extracts the version via the binary, and reads the Redis configuration to determine the listening port and log file location.
Domain Extraction
Every domain, extracted from source configs.
The agent doesn't guess which domains live on your server. It reads the actual web server configuration files and extracts domain names from the directives that define them. This means your inventory is always accurate — it reflects what's actually configured, not what someone remembered to document.
server { listen 443 ssl; server_name example.com www.example.com; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; access_log /var/log/nginx/example.access.log; error_log /var/log/nginx/example.error.log; location / { proxy_pass http://127.0.0.1:3000; } }
nginx server_name directive
The agent parses the main nginx.conf and follows all include directives to find every server block. Each server_name value becomes a discovered domain. Multiple names on a single directive (like example.com www.example.com) are each tracked individually.
<VirtualHost *:443> ServerName example.com ServerAlias www.example.com SSLEngine on SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem CustomLog /var/log/apache2/example.access.log combined ErrorLog /var/log/apache2/example.error.log ProxyPass / http://127.0.0.1:3000/ </VirtualHost>
Apache VirtualHost blocks
Apache virtual host files are parsed from sites-enabled/ (Debian/Ubuntu) and conf.d/ (RHEL/CentOS). Both ServerName and ServerAlias directives are extracted. Each value becomes a discovered domain.
example.com { reverse_proxy localhost:3000 log { output file /var/log/caddy/example.access.log } } api.example.com { reverse_proxy localhost:8080 log { output file /var/log/caddy/api.access.log } } *.staging.example.com { reverse_proxy localhost:4000 }
Caddyfile site blocks
Caddy uses a clean syntax where the domain name is the site block label. The agent parses the Caddyfile and extracts every site address. Caddy's automatic HTTPS means certificates are provisioned without explicit configuration — the agent detects this and marks the certificate as Caddy-managed.
Stop maintaining spreadsheets.
Let your infrastructure describe itself.
Install the HostAtlas agent on your first server. Within 30 seconds, you'll see every service, domain, container, and certificate mapped in your dashboard. No credit card required.