Which Windows does the gateway run on?

Windows 10 or Windows Server 2016 and later, x64 only. On an older system the gateway does not start and names the reason itself.

The code has run out. What now?

Press New code in the same window and run the new command. A code that has run out no longer connects a gateway.

Does the gateway update itself?

The Windows service updates itself unless automatic updates are turned off at the site. A Linux gateway does not update itself: it is updated with a new image.

Installing the equipment gateway

The gateway runs around the clock with no window and no user signed in. Put it where the equipment is visible and outbound access to 443 is allowed: the SCADA server, an industrial PC or a server in the DMZ between the plant network and the office network.

What is supported

Platform	How it runs	Updates
Windows 10, Windows Server 2016 and later, x64	the Windows service Samreshuuu Equipment Gateway, automatic start and restart on failure	install themselves unless turned off at the site
Linux with Docker	a container	with a new image; the gateway does not replace itself
Linux without Docker	a systemd service	with a new build; the gateway does not replace itself

OPC DA and Mitsubishi CNC (EZSocket) work only in a gateway on Windows, more in protocols.

Where to get the build

Equipment data is enabled on request, and we hand over the gateway build when we turn it on. Write to us.

Activation code

Under Integrations, on the Gateways tab, press Connect a gateway, choose the site, name the gateway and press Get code. The window shows Command on the site server as one line, and the code itself. The code works once and for a limited time; the time left shows under the code. Once the gateway comes online, the window says Gateway “…” is connected.

The command trades the code for the gateway key, and the key goes straight into the system's secret store. The service picks up the new activation itself, no restart needed. The gateway sends data only to the intake address built into its build: a line with another address sends it nowhere else.

Windows

Install the service

In an administrator console run equipment-gateway install-service. The gateway copies itself to %ProgramFiles%\Samreshuuu\EquipmentGateway and registers the service Samreshuuu Equipment Gateway, which starts on its own and restarts after a failure.

Connect the gateway

Run the command from the activation window: equipment-gateway activate ….

Settings and data live in %ProgramData%\Samreshuuu\EquipmentGateway: the gateway.toml file and the data folder with the buffer, the key and the certificates. The gateway closes the folder to the system and administrators. To remove the service: equipment-gateway uninstall-service.

Linux: container

docker volume create equipment-gateway-data docker run --rm -v equipment-gateway-data:/var/lib/equipment-gateway equipment-gateway activate <CODE> docker run -d --restart unless-stopped --name equipment-gateway \ -v equipment-gateway-data:/var/lib/equipment-gateway equipment-gateway

The volume holds the buffer, the key and the certificates: do not delete it when you change the image. A settings file, if you need one, is mounted at /etc/equipment-gateway/gateway.toml.

Linux: systemd service

install -m 0755 equipment-gateway /usr/local/bin/equipment-gateway useradd --system --home-dir /var/lib/equipment-gateway equipment-gateway install -d -o equipment-gateway -m 0700 /var/lib/equipment-gateway sudo -u equipment-gateway equipment-gateway activate <CODE> systemctl enable --now equipment-gateway

The unit runs the gateway as a dedicated system user, without privilege escalation, with a read-only file system except /var/lib/equipment-gateway. Settings are read from /etc/equipment-gateway/gateway.toml.

Settings file

You need the file only if the site has something to decide itself. No file means all defaults. With a file that does not parse, the gateway does not start and names the error.

proxy = "http://proxy.plant.local:3128" no_proxy = "crl.plant.local" equipment_hosts = ["10.20.0.0/16", "scada1.plant.local", ".plc.plant.local"] auto_update = true buffer_max_mb = 1024

proxy, no_proxy: an explicit proxy for the way out to the cloud and the addresses that bypass it. Without proxy the gateway takes the machine's route: the HTTPS_PROXY and NO_PROXY environment variables, on Windows also the WinHTTP proxy (netsh winhttp set proxy), PAC and WPAD. A proxy login and password can go in the address. The gateway reaches equipment directly, not through the proxy.
equipment_hosts: the site network addresses the gateway may connect to. Without the line the gateway connects to any address in the connection settings. With it, a connection to an address outside the list does not start and says Invalid connection settings. The cloud cannot widen the list. An empty list allows nothing.
auto_update: false turns automatic updates off at the site, and the cloud cannot turn them back on.
buffer_max_mb: the disk ceiling for data waiting to be sent. Above it the oldest data is evicted.

Entries of equipment_hosts: an address (10.20.1.5), a network (10.20.0.0/16), a name (plc1.plant.local) or every name under a domain (.plant.local). A name is matched as written and never resolved to an address: a network admits only a connection written as an address, a name only a connection written as a name.

Updates

A Windows gateway installs a new version itself on the cloud's command: the package is checked by its signature, and if the new version does not come online, the service returns to the previous one. Data the previous version had not sent yet passes to the new one. The update mode shows in the gateway row on the Gateways tab: Automatic updates, Automatic updates disabled at the site or Updates installed by the operator with the reason.

A Linux gateway does not update itself: the operator installs the update, with a new container image or a new build for systemd.

Revoking a gateway

In the gateway row on the Gateways tab choose Revoke and confirm in the Revoke gateway “…”? window. The key stops working at once, data from the site stops arriving, and this gateway's buffer on its disk is erased. The connections stay and can be given to a new gateway. To install the gateway again on the same machine, get a new code and run the command again.