# Installing the equipment gateway

The gateway runs around the clock with no window and no user signed in. Put it where the equipment is visible and outbound access to 443 is allowed: the SCADA server, an industrial PC or a server in the DMZ between the plant network and the office network.

## What is supported

| Platform | How it runs | Updates |
|---|---|---|
| Windows 10, Windows Server 2016 and later, x64 | the Windows service Samreshuuu Equipment Gateway, automatic start and restart on failure | install themselves unless turned off at the site |
| Linux with Docker | a container | with a new image; the gateway does not replace itself |
| Linux without Docker | a systemd service | with a new build; the gateway does not replace itself |

OPC DA and Mitsubishi CNC (EZSocket) work only in a gateway on Windows, more in [protocols](/help/equipment-protocols).

**Where to get the build**
Equipment data is enabled on request, and we hand over the gateway build when we turn it on. [Write to us](/help/contacts).

## Activation code

Under **Integrations**, on the **Gateways** tab, press **Connect a gateway**, choose the site, name the gateway and press **Get code**. The window shows **Command on the site server** as one line, and the code itself. The code works once and for a limited time; the time left shows under the code. Once the gateway comes online, the window says **Gateway “…” is connected**.

The command trades the code for the gateway key, and the key goes straight into the system's secret store. The service picks up the new activation itself, no restart needed. The gateway sends data only to the intake address built into its build: a line with another address sends it nowhere else.

## Windows

### Install the service
In an administrator console run `equipment-gateway install-service`. The gateway copies itself to `%ProgramFiles%\Samreshuuu\EquipmentGateway` and registers the service Samreshuuu Equipment Gateway, which starts on its own and restarts after a failure.

### Connect the gateway
Run the command from the activation window: `equipment-gateway activate …`.

Settings and data live in `%ProgramData%\Samreshuuu\EquipmentGateway`: the `gateway.toml` file and the `data` folder with the buffer, the key and the certificates. The gateway closes the folder to the system and administrators. To remove the service: `equipment-gateway uninstall-service`.

## Linux: container

```bash
docker volume create equipment-gateway-data
docker run --rm -v equipment-gateway-data:/var/lib/equipment-gateway equipment-gateway activate <CODE>
docker run -d --restart unless-stopped --name equipment-gateway \
  -v equipment-gateway-data:/var/lib/equipment-gateway equipment-gateway
```

The volume holds the buffer, the key and the certificates: do not delete it when you change the image. A settings file, if you need one, is mounted at `/etc/equipment-gateway/gateway.toml`.

## Linux: systemd service

```bash
install -m 0755 equipment-gateway /usr/local/bin/equipment-gateway
useradd --system --home-dir /var/lib/equipment-gateway equipment-gateway
install -d -o equipment-gateway -m 0700 /var/lib/equipment-gateway
sudo -u equipment-gateway equipment-gateway activate <CODE>
systemctl enable --now equipment-gateway
```

The unit runs the gateway as a dedicated system user, without privilege escalation, with a read-only file system except `/var/lib/equipment-gateway`. Settings are read from `/etc/equipment-gateway/gateway.toml`.

## Settings file

You need the file only if the site has something to decide itself. No file means all defaults. With a file that does not parse, the gateway does not start and names the error.

```toml
proxy = "http://proxy.plant.local:3128"
no_proxy = "crl.plant.local"
equipment_hosts = ["10.20.0.0/16", "scada1.plant.local", ".plc.plant.local"]
auto_update = true
buffer_max_mb = 1024
```

- **`proxy`, `no_proxy`**: an explicit proxy for the way out to the cloud and the addresses that bypass it. Without `proxy` the gateway takes the machine's route: the HTTPS_PROXY and NO_PROXY environment variables, on Windows also the WinHTTP proxy (`netsh winhttp set proxy`), PAC and WPAD. A proxy login and password can go in the address. The gateway reaches equipment directly, not through the proxy.
- **`equipment_hosts`**: the site network addresses the gateway may connect to. Without the line the gateway connects to any address in the connection settings. With it, a connection to an address outside the list does not start and says **Invalid connection settings**. The cloud cannot widen the list. An empty list allows nothing.
- **`auto_update`**: `false` turns automatic updates off at the site, and the cloud cannot turn them back on.
- **`buffer_max_mb`**: the disk ceiling for data waiting to be sent. Above it the oldest data is evicted.

Entries of `equipment_hosts`: an address (`10.20.1.5`), a network (`10.20.0.0/16`), a name (`plc1.plant.local`) or every name under a domain (`.plant.local`). A name is matched as written and never resolved to an address: a network admits only a connection written as an address, a name only a connection written as a name.

## Updates

A Windows gateway installs a new version itself on the cloud's command: the package is checked by its signature, and if the new version does not come online, the service returns to the previous one. Data the previous version had not sent yet passes to the new one. The update mode shows in the gateway row on the Gateways tab: **Automatic updates**, **Automatic updates disabled at the site** or **Updates installed by the operator** with the reason.

A Linux gateway does not update itself: the operator installs the update, with a new container image or a new build for systemd.

## Revoking a gateway

In the gateway row on the Gateways tab choose **Revoke** and confirm in the **Revoke gateway “…”?** window. The key stops working at once, data from the site stops arriving, and this gateway's buffer on its disk is erased. The connections stay and can be given to a new gateway. To install the gateway again on the same machine, get a new code and run the command again.