1.5Architecture overview
Last updated
SYNERGY Management Gateway is installed on one Windows server. The installation consists of the following parts.
| Component | Where it runs | Purpose |
|---|---|---|
| Web console | IIS site root (default C:\inetpub\wwwroot) | The single-page web application your users open in a browser |
| API | IIS application /backend in its own application pool (default content folder C:\inetpub\apps\api) | The server: both API surfaces, the MCP server, background work |
| Database | SQL Server, PostgreSQL or SQLite | Platform users, roles, connections, policies, operations log and audit trail, settings |
| Update agent | Windows service SYNERGY Management Gateway Update Agent | Checks for new releases and can install them on a schedule |
| Setup wizard | Desktop application, Start menu entry SYNERGY Management Gateway Setup | Configures IIS, the database, secrets and settings; can be re-run at any time |
The API connects outward to:
- Domain controllers, over LDAP or LDAPS, using the credentials of each directory connection.
- The Synergy licensing service at
https://public-hub.synergy.lt/over HTTPS (port 443), for licence activation and validation, update checks, feedback and bug reports and, if you allow it, anonymous usage statistics. - Optional services you configure: an email provider (SMTP, Microsoft Graph or Google Workspace), identity providers for single sign-on, a syslog collector, an OpenTelemetry collector, and log stream destinations (webhooks or a Sentry project).
Where data is kept
- Directory data stays in Active Directory. The product reads and writes it on demand and does not keep a copy, with one exception: when an object is deleted through the product, an encrypted image of it may be kept to help a later restore.
- Platform data — users, roles, connection definitions, policies, the operations log and settings — is kept in the product's database.
- Secrets — the token signing secret, the credential encryption key, the audit chain key — are held as environment variables of the API's IIS application pool, not in configuration files.
- Connection passwords and other stored credentials are encrypted in the database with the credential encryption key.
Single server by design
One installation runs on one server. Running several copies of the API against one database behind a load balancer is not supported.
Last updated
Thank you for your feedback.