How your servers really connect. Drawn by them, and proved wire by wire.

Every team has an architecture diagram, and it is wrong: drawn once, by hand, from memory. The NOC is the other kind. Drop your servers on a canvas and Vigia reads each box's own firewall and its live connections and draws the wires itself. Then it proves them — not from your computer, which knows nothing about whether one server can reach another, but from the box each wire starts at. What works goes quiet. What is broken turns red and says why.

A NOC diagram in LockFlare Vigia: ten servers, all 73 WireGuard wires talking, with one server lit to show the connections it shares in both directions — Ten servers, all 73 wires talking, one box lit to show who it talks to — and who talks back.

A diagram you do not draw

Drag servers from the tree, one or a whole group, and each lands as a box with its address and an icon for what it is, read from what it listens on. You can wire them by hand — drag from a port on one box to another, click the chip to set the port. Or press Discover and let the boxes describe themselves.

Discover asks two witnesses on every box and merges what they say. The firewall: an allow rule on B for a port from A's address is the wire A to B — the topology as it was intended, written down in the one place that decides. And the connections: an established connection on B from A is the same wire — the topology as it is right now. A wire both saw is the strongest kind. One only the firewall saw is a door nobody walks through, and one only the connections saw is traffic no rule expected. Both are said in words on the wire, because those are the findings.

10servers dropped on the canvas

187wires found, from the boxes' own firewalls and connections

4ports in the picture: WireGuard, Redis, Sentinel, MariaDB

/ RUN DIAGRAM

Three facts per wire, proved where the traffic starts

A wire says db-2 talks to db-1 on 3306. That is a claim. Run Diagram proves it, every box proving its own wires at once, and each fact is said in a sentence — the failing one first.

Beside it, one port open — Redis — with the wires that work barely there, the broken ones red, and one of them opened beside the canvas: its three facts in words, and its own Check.

Reach

The source opened a connection to the destination's port. It is a probe run on the source box, over the shell Vigia already has there — the only place that question can honestly be answered.

Listen

Something on the destination listens on that port, on an address the source dials. Loopback only is the classic: the service is up, the wire is down, and every dashboard on the box is green.

Allow

The destination's firewall lets the source's address in — the Firewall screen's own reading of that box, not a guess from outside.

One port at a time, and the broken ones loud

A real fleet is a hairball, so Run Diagram opens one port — the busiest — and the others are chips across the top, each with its count, one click to open and prove. A run reverses the rule of drawing: everything that works is barely there, and a broken wire is red. Broken Only leaves just the red ones on the canvas; Selected Only, just the wires of the boxes you click.

Here Redis alone: 54 wires, 18 of them broken, found in the time the run took. Each red wire says which of its three facts failed. The usual story behind a batch like this is a firewall still letting a port in that nothing answers on any more — the kind of thing nobody finds until the day it matters. Then MariaDB alone: three boxes, six wires, all talking: the replication built earlier that day, drawn without anyone drawing it.

Light a box, and ask it a question

Click a server and its traffic is lit hard while the rest recedes. Click again to let it go; several can be lit at once.

Inbound: the wires arriving at it. Outbound: the ones leaving it. Each with its count, tagged like the ports.
Mutual is the third question: the wires where the lit box talks to a peer and that peer talks back on the same port. That is the shape of a replica set, a cluster, a mesh — and the quickest way to see who is really in one.
A wire opens beside the canvas with its three facts in words and its own Check. A box's right-click menu has Terminal here, a shell in a window over the diagram, and Ask Themis: her chat for that server in the same kind of window, the box's wires and their verdicts already sent — with a broken wire, she is asked for the reason.

Saved, and proved again every time it runs

A diagram is saved with its boxes and wires, stamped with your key and holding no secret. It opens for drawing, and nothing is connected or proven until you say so. Run Diagram is not looking at a picture from last month: it connects every box on it, finds the wires if none are drawn, and proves them, every box checking its own wires at the same time, so ten servers take as long as the slowest one. A broken wire costs its source a few seconds of waiting and nobody else anything. The line over the canvas says what it found — all 73 wires talking, checked just now — or how many are broken and which, and the arrow beside it proves it again.

/ IN PRACTICE

What people use it for

Each of these is a run, answered by the boxes themselves.

After a changeAfter a firewall change, run the diagram and it says, within seconds and from the boxes themselves, whether everything that talked before still does. The one wire you closed by accident is the red one.

Unused rules"Allowed, not seen" is an allow rule with no connection behind it: a door nobody walks through. Some are standbys waiting for their day. The rest are what is left of servers and services that went away years ago.

Unexpected trafficThe other direction: a connection seen talking that no firewall rule names, because the port is open to anywhere or there is no firewall at all. Said on the wire, in those words.

Before buildingA replica set, a database pair, a Sentinel set, a private network: every one of them is a set of wires. The builders in Vigia prove theirs before they write anything, and the NOC is where you see them all at once afterwards.

The WireGuard mesh

/ QUESTIONS

Questions people ask

Does it scan my network?

No. Nothing is scanned and nothing is probed from your computer. Discover reads each server's own firewall rules and established connections over the login you already have, and a run tries only the wires that are on the diagram, each from the server it starts at.

What makes a wire broken?

One of three facts failed, and the wire says which, first: the source could not open the connection, nothing on the destination listens on that port on an address the source dials, or the destination's firewall does not let the source in.

What does "allowed, not seen" mean?

The destination's firewall has a rule letting the source in on that port, and no established connection was seen using it when Vigia looked. It is the topology as it was intended rather than as it is: a standby path, or a rule left behind by something that no longer exists.

Does it need an agent on the servers?

No. It reads what the server already knows — its listening sockets, its connections, its firewall — over SSH, and the probe is an ordinary connection attempt from the source box. A diagram only holds servers Vigia can log in to, which is what makes every wire provable.

Is the diagram kept up to date?

It is proved again every time you run it, and the arrow beside the verdict proves it again while you watch, so what you see is never older than your last run. Discover can be run again to pick up wires that have appeared since.

Where are diagrams stored?

On your computer, with the rest of your map, stamped with your key and carried by its encrypted backup. A diagram holds boxes, wires and ports and no secret; nothing about your network is sent to LockFlare.

See what your servers say about each other

Vigia is free for 10 servers. Nothing is installed on them to try it.

Download Vigia