Ingestor Service
The Ingestor is a dedicated Go service that handles high-volume telemetry uploads from Edge appliances. It is intentionally separate from the Cloud Backend API to allow independent scaling of the ingestion pipeline.
Purpose
Section titled “Purpose”Edge appliances collect continuous telemetry (network traffic, logs, security events, discovery data, backup events) and batch-upload it to the Ingestor. The Ingestor validates, authenticates, and persists the data to Azure SQL.
Tech stack
Section titled “Tech stack”| Component | Technology |
|---|---|
| Language | Go |
| Database | Azure SQL Server (same RLS mechanism as Cloud) |
| Deployment | Azure Container Apps |
| Production URL | https://ingest.cloud.monozu.io |
Single endpoint, two auth methods
Section titled “Single endpoint, two auth methods”The entire Ingestor surface is one endpoint, but it accepts two different credentials:
POST /v1/ingestX-Device-Key: <device_key> # Edge appliances (all kinds)Authorization: Bearer <host_token> # Host Agent direct-to-cloud (host_inventory only)Content-Type: application/json
[ { "kind": "telemetry", ... }, { "kind": "log", ... }, { "kind": "security_alert", ... }]Authentication: X-Device-Key header (device api_key minted at Edge claim-complete) or Authorization: Bearer (Host Agent’s own host_token, minted by Cloud Backend on approval). Both are accepted on the same route — see middleware.HostTokenOrDeviceKey in the ingestor repo.
Request body is { device_id, items: [...] } for the device-key path, or { host_id, items: [...] } for the Bearer path (the token alone already identifies the host — host_id is accepted but not required) — see Payload Schema. Success response is 200, not 204.
host_inventory is handled here too, not by Cloud Backend — Cloud Backend has no ingest endpoint of any kind. Host Agent snapshots either arrive proxied through edgezu-hostagent-gateway (device-key auth, host_id embedded in the payload) or posted directly by hostzu-agent when no local Edge gateway is reachable (Bearer auth). Both paths converge on the same internal/domain/hostinventory package: blob storage for the raw JSON, host_inventory_snapshots/host_ingest_events writes, and MAC-based Asset auto-merge. See Payload Schema and Host Agents payload.