Architecture

This page describes how the three inboard components interact, aimed at IT administrators planning a deployment.

Component overview

Component	Role	Runs on
inboard app	Desktop client, local document storage	User workstations
Concourse	Auth, user management, query dispatch, audit	Docker container
Relay	Database bridge, credential holder	Docker container or standalone binary on-prem

Query flow

When a user runs a SQL query against an on-premises database, the following sequence occurs:

1. The inboard app sends a query request to Concourse.
2. Concourse dispatches the job to the appropriate relay over an SSE (Server-Sent Events) stream.
3. The relay executes the SQL against the target database.
4. Results flow back through Concourse to the app.

Key architectural facts

• Single port. Concourse listens on port 8080 for both HTTP and WebSocket traffic.
• No TLS termination. Concourse serves plain HTTP. Place it behind a reverse proxy (nginx, Caddy, or a cloud load balancer) for HTTPS.
• Outbound-only relay. The relay initiates all connections to Concourse. It uses SSE to receive jobs and HTTP POST to return results. No inbound firewall rules are needed on the database network.
• No credential storage on the server. Concourse never stores database credentials. The relay holds credentials locally in its configuration file.
• Local-first documents. The server manages access control and relays real-time sync traffic (via WebSocket) but never stores document content. Documents live on user machines.

Network requirements

Source	Destination	Protocol	Direction
inboard app	Concourse	HTTP/WebSocket (port 8080)	Outbound from client
Relay	Concourse	HTTPS	Outbound from relay
Relay	Database(s)	Database protocol (e.g., 5432 for Postgres)	Outbound from relay

No inbound connections are required to the relay or to the database network from Concourse.