Architecture

Athena is three parts you host yourself — the server, the Hermes agent, and pluggable providers — communicating over two TLS ports with no cloud dependency.

Components#

• Athena Server — a single ASP.NET Core app hosting the Blazor Server web console and the API/agent gateway.
• Hermes Agent — a lightweight Windows/Linux agent that executes deployments, runs commands, and collects inventory.
• Plugins — database and audit providers loaded at startup.

Ports & protocols#

Agent communication#

The agent opens an outbound gRPC connection to port 8444 — there are no inbound agent ports and no external broker.

The agent keeps a bidirectional streaming gRPC channel open to the server for live commands and telemetry, and makes a separate one-time registration call when it first enrolls. All of it runs over the single outbound connection on port 8444.

Database & plugins#

The database provider is chosen by Database:Provider. Providers shipped as plugins:

• SQLite (default)
• PostgreSQL

At startup the server scans plugins/Database/ and plugins/Audit/ and loads the provider plugins it finds there, registering each by name (Plugins:BasePath = "plugins").

Authentication model#

The web console and REST API use JWT bearer tokens (15-minute expiry, held in browser localStorage); agents authenticate with per-agent X.509 certificates issued by the server's Root CA.

See Agent Enrollment and Roles & Permissions.

Storage layout#

The server persists state on local disk:

These map to the Docker volumes in Installation.