jaque deploys as one binary started with a -target flag that names the role the process plays. The default role, all, is the whole system in one process with no external service. Every other role is the same binary doing less, and the only thing any two roles ever share is a log server: the event log lives there, and so do the work queue and the coordination store that the split shapes add. This page says when all is enough, what each further -target buys, and what it costs. Topologies and Cluster and coordination carry the detail; this is the map.

1. -target all is the default

jaque -config jaque.cue

With no -target flag the process runs as all: the engine schedules checks, executes them itself, folds their results through the state machine and appends every event to the log, in one process. The event log defaults to -eventlog memory, in-memory and not durable, and can be pointed at the embedded, on-disk event log store with -eventlog file://... instead. Coordination defaults to in-memory too, with -coordination nats://... as the shared alternative. Perfdata sinks and the archive are optional and run in the same process when enabled. One static binary, no service to stand up first.

2. When all is the whole story

-target all is sufficient when three things hold: the estate fits on one host's execution capacity, every check can reach its target from that host, and losing in-memory state on restart is acceptable, or has been made moot by -eventlog file://.../-retain. There is no operational tax for staying here. No cluster, no log server to keep alive, no coordination store to provision. An estate migrating off one Nagios host usually fits this description, because that host already proved the capacity is enough.

3. What each further -target adds

Split roles when one of the following is needed, and only then.

Checks from more than one network or machine: a worker in a DMZ, or a worker whose local plugins cannot run centrally. This is the engine/worker split in Topologies.

A read-only surface separate from execution: a dashboard reachable without exposing the process that schedules checks. This is -target ui.

Perfdata or notification delivery that scales independently of check execution. This is -target sink and -target notifier.

High availability of the engine itself: more than one engine sharing ownership of the object set with automatic failover. This is more than one -target engine and the mechanism in Cluster and coordination.

Each of these is additive on top of the default. It is the same binary with a different -target and, for anything beyond all, an external -eventlog nats://... and -coordination nats://... that every role points at.

4. The one server between roles

The sequence below starts one all process and grows it, one -target at a time, into the split and HA shapes. At every step the only thing that crosses a network boundary is traffic to the log server: the event log every role follows, the work queue the engine publishes to and workers pull from, and the membership buckets engines announce themselves in. No role opens a connection to another role. A worker is started with -queue and no engine address; a ui process is started with -eventlog and never learns an engine exists.

  host A                                   host B
  +---------------------------------+      +-------------------+
  | jaque -target engine            |<---->| log server        |
  |   -coordination nats://B        | log  |   event log       |
  +---------------------------------+      |                   |
  host A'                                  |   work queue      |
  +---------------------------------+      |   membership/     |
  | jaque -target engine            |<---->|   jaque.cmd.<id>  |
  |   -coordination nats://B        | log  |                   |
  +---------------------------------+      |                   |
  host C        worker             ------->|                   |
  host D        ui, sink, notifier <-------|                   |
                                           +-------------------+
two engines share ownership; B is still the only crossing

  host A                                   host B
  +---------------------------------+      +-------------------+
  | jaque -target engine            |<---->| log server        |
  |   -coordination nats://B        | log  |   event log       |
  +---------------------------------+      |                   |
  host A'                                  |   work queue      |
  +---------------------------------+      |   membership/     |
  | jaque -target engine            |<---->|   jaque.cmd.<id>  |
  |   -coordination nats://B        | log  |                   |
  +---------------------------------+      |                   |
  host C        worker             ------->|                   |
  host D        ui, sink, notifier <-------|                   |
                                           +-------------------+

  two engines share ownership; B is still the only crossing

The consequence for network design is one address to reach: the log server. Every role needs a route to it, and nothing needs a route to a role, except the people and tools that read the dashboard, the API or Livestatus on a ui or all process.

5. Security considerations

Splitting by role changes what is exposed, not how it is authenticated. The log server becomes the thing every role trusts, so its network is the perimeter. The listeners a role opens (dashboard, API, Livestatus) are the same in every shape and are unauthenticated except for the command API behind -api-token. Read Security before choosing which network any of these processes sits on.