# Frequently asked questions

> Common questions about InfraWard, the self-hosted infrastructure inventory: cost, licence, agents, supported platforms, requirements and data.

## What is InfraWard?

InfraWard is a self-hosted infrastructure inventory that keeps itself up to date. You enrol a server with one command, and InfraWard discovers what runs on it (Proxmox virtual machines and containers, Docker and Podman containers and images, Plesk sites), scans it for vulnerabilities and reconciles the inventory on a schedule. See the [introduction](/docs.md).

## Is InfraWard free?

Yes. InfraWard is free and open source, released under the [GNU Affero General Public License v3.0](https://www.gnu.org/licenses/agpl-3.0.html). The code is on [GitHub](https://github.com/InfraWard/infraward). If you offer a modified version as a network service, you must make its source code available to its users.

## Does InfraWard need an agent on each server?

No. InfraWard is agentless. It connects over SSH with a dedicated, read-only `inventory` account that the enrolment script creates, with a restricted `sudoers` that only allows a closed list of queries. See [Adding servers](/docs/enrollment.md).

## What can InfraWard inventory?

Linux servers, Proxmox VE nodes (CTs and VMs), Docker and Podman hosts (containers, images, networks and volumes, including rootless Podman) and Plesk servers, with the relationships between them and a topology view. It also inventories domains from Cloudflare, with RDAP data, TLS certificate expiry and dangling DNS records. See [Inventory and projects](/docs/inventory.md) and [Domains](/docs/domains.md).

## How does InfraWard find and prioritise vulnerabilities?

Trivy scans servers and container images and stores a CycloneDX SBOM for each. Every finding gets a score from 0 to 100 based on CVSS, CISA KEV, EPSS and network exposure, so the list starts with what is exploited and reachable. Stored SBOMs are re-evaluated against new vulnerability data without reconnecting to the servers. See [Vulnerabilities](/docs/vulnerabilities.md).

## Where is my data stored?

On your own infrastructure. InfraWard runs as a set of containers with Docker Compose or Podman, and the database, Redis and OpenBao sit on an internal network. The worker only reaches the internet to download vulnerability data (the Trivy database, CISA KEV and EPSS) and, if you configure them, the Cloudflare API and RDAP. See [Concepts and architecture](/docs/architecture.md).

## What do I need to install it?

A 64-bit Linux host with Docker Engine 24 or later and the Compose v2 plugin (or Podman), 2 vCPU, 4 GB of RAM and 20 GB of free disk. The published images are for `linux/amd64`. Outside `localhost` you also need a DNS name and HTTPS. See [Requirements](/docs/requirements.md).

## How long does it take to try it?

About ten minutes. The [quick start](/docs/quickstart.md) runs a local instance with Docker Compose to evaluate InfraWard. For a production deployment, follow [Install with Docker Compose](/docs/installation.md).

## Does InfraWard support single sign-on and two-factor authentication?

Yes. Users sign in with a local account or through an OIDC provider, and TOTP two-factor authentication is mandatory for administrators. There are five roles, and sign-ins, changes and terminal sessions are recorded in an audit log. See [Authentication, MFA and OIDC](/docs/authentication.md).

## In which language is the interface?

The interface is in Spanish. The documentation is in English and Spanish, and quotes each label as it appears on screen followed by its English meaning.

## How do I report a security vulnerability?

Privately, through **Report a vulnerability** in the [Security tab of the repository](https://github.com/InfraWard/infraward/security) or by email to [info@infraward.net](mailto:info@infraward.net). Do not open a public issue. See [Security](/docs/security.md).

---

HTML page: https://infraward.net/docs/faq/