The inventory model

Every record belongs to a site. Networks hold pools and addresses, devices hold interfaces, and an address is linked to the interface that uses it. Applications, services, and gateway routes then say what runs where and how people reach it.

An application instance runs on a device or listens on an IP address, never both. A service and a gateway belong to a site, or to no site when they are global.

The relationships are optional. A site, network, and allocated addresses can exist without devices or services. Add devices, applications, services, and routes as they become part of the inventory.

Intent and evidence are different

Inventory is what you accept as true: this interface owns this address; this service is provided here. Discovery is what an agent observed at a point in time. Observations stay separate. MiniPAM proposes the difference, shows its evidence, and applies the review policy.

Discovery does not replace accepted inventory. A temporary hostname, stale ARP entry, or ambiguous open port remains an observation until it is reviewed.

A few modeling decisions

Sites are operational boundaries. A home or branch office can be a site. Sites also keep overlapping private ranges apart, and tie each agent to the networks it can see.

Devices and servers are one inventory. The two directories are views for different jobs, and the same record appears in both, so do not create a second copy. A hypervisor and its guest can form a parent/child hierarchy.

Interfaces own addresses. Linking an address to an interface, not to a device, is what gives it a MAC, a vendor, and a device. Interfaces can also nest, for VLANs or other logical relationships.

Applications are concrete; services are human-facing. An application instance is one listener, such as Grafana on TCP 3000 on grafana-vm. A service is the name people use, “Grafana”, and points at the instances that provide it; it stays the same when they move or change. A gateway route says how people reach the service: a hostname and path on a reverse proxy. See Example: a web app behind a reverse proxy.

Tags add flexible classification across supported records without changing this structure.