Backend

The backend component provides a centralized place where all the osctrl data is stored. In the diagram above, it is displayed with a PostgreSQL logo, and in fact, the default provisioning of osctrl does install PostgreSQL as backend. However, the code that handles database access uses GORM so the changes to make osctrl work with a different backend solution would be minimal.

Each component uses the backend differently but all of them have read/write operations.

Read replica

The database can optionally have a read replica. When it is configured, osctrl-api sends its read-heavy, staleness-tolerant queries (dashboard, node lists, audit log, posture and vulnerability views) and osctrl-tls its alert rule node scans and osctrld metrics to the replica and keeps everything else on the primary: writes, authentication, enrollment, and the query and carve lifecycle. Replication lag therefore only affects what the dashboard and lists display, never authorization or a read inside a write flow.

Replicas are not supported with SQLite. See Read replica for the settings.