Infrastructure Dependencies

Audience: operators planning a deployment and engineers reasoning about runtime dependencies. Takeaway: Stella Ops runs on a small, well-defined set of required infrastructure components. Everything else is optional and must never become a hidden dependency for core workflows.

Stella Ops is a self-hosted release control plane designed for on-prem and air-gapped estates. It deliberately keeps its required footprint minimal: a relational store, a cache/coordination layer, and object storage. Optional components extend operational characteristics without becoming load-bearing for the core scan, advisory, policy, and release flows.

PostgreSQL (required)

Primary store for durable state. Each service owns a schema to keep boundaries clear and enable tenant isolation strategies.

Schema	Owner (primary)	Purpose
`authority`	Authority	Users, clients, tenants, keys, audit trails.
`scanner`	Scanner	Scan manifests, triage, scan results metadata.
`vuln`	Concelier	Advisory raw documents, linksets, observations.
`vex`	Excititor	VEX raw documents, consensus, provider state.
`scheduler`	Scheduler	Jobs, runs, schedules, impact snapshots.
`notify`	Notify	Channels, templates, delivery history, digests.
`policy`	Policy	Exception objects, snapshots, unknowns.
`orchestrator`	Orchestrator	Sources, runs, jobs, DAGs, pack runs.

See Data isolation model for how the schema-per-service boundary supports tenant isolation, and Data Schemas for the authoritative table/column contracts.

Valkey (required)

Redis-compatible cache and coordination substrate.

Pattern	Typical services	Purpose
DPoP nonces	Authority	RFC 9449 nonce storage (short TTL).
Streams / events	Scanner, Notify, Scheduler	Event emission and fan-out (deterministic ordering per stream).
Queues	Scanner, Notify	Worker coordination (consumer groups).
Cache	All services	Tenant-prefixed caching with explicit TTLs.
Rate limiting	Gateway, Authority	Token bucket counters.

RustFS / S3-compatible object storage (required)

Artifact store for SBOMs, evidence bundles, and replayable outputs. The exact bucket layout depends on the deployment profile; treat deployment manifests as authoritative.

NATS JetStream (optional)

Alternative messaging transport for environments that require persistent streams or specific operational characteristics. NATS must be explicitly configured and must never be required for core workflows.

Deployment references

Install guide — end-to-end installation and prerequisites.
Docker / Compose deployment — container deployment profiles.
DevOps & release operations — compose stacks, runbooks, and release tooling.