Architecture

Proxus has two kinds of runtime: one hub and any number of edge gateways. The hub is where people work and where the history is kept. The gateways sit close to the machines and do the reading. A message server carries everything between them.

The hub

The hub is the web application you sign in to, together with the services behind it. It:

• keeps the configuration of the whole installation: gateways, devices, device profiles, rules, pipelines, functions, users and roles;
• sends each gateway the part of the configuration it needs, and tells it when something changes;
• receives the values of the devices that deliver to the historian (every new device does) and writes them to the historian;
• shows live values, trends, dashboards and reports, and keeps the alarms;
• sends notifications to people (email, SMS, chat) when a rule asks for it;
• checks the license and serves the REST API.

There is one hub per installation. In the Docker Compose stack it is the proxus-ui service.

Edge gateways

An edge gateway is the Proxus runtime that talks to machines. It:

• reads devices with their protocol, at the interval set for each device, and receives values that devices send over MQTT or HTTP;
• gives every value its time and quality;
• runs the pipelines, rules and functions assigned to it;
• publishes the values in the Unified Namespace on its own MQTT broker;
• sends the values to the outbound targets of each device, and queues them while a target cannot be reached;
• passes the values to the hub, and keeps them while the hub cannot be reached.

A gateway keeps no configuration of its own. When it starts, or when its connection comes back, it receives its devices, pipelines, rules and functions from the hub. You set up everything in the hub, and a gateway that is replaced or restarted picks up where the old one stopped.

The SYSTEM gateway

Every installation has one gateway called SYSTEM, which runs next to the hub (the proxus-server service in the compose file). It reads machines on the hub's own network, and it runs the simulator. New rules and functions run on SYSTEM unless you choose other gateways.

Remote gateways

For machines on another network or at another site, you install a gateway near them. Each remote gateway runs together with a small message server of its own. That message server connects to the hub's message server on port 7422, over TLS. The connection is opened from the gateway's side, so a gateway needs one outgoing connection to the hub, and nothing on the plant network has to accept connections from the hub. Install an edge gateway shows how.

How the hub and gateways talk

All traffic between the hub and the gateways goes through a message server (NATS, the hub-server service in the compose file). Values, configuration changes, status, logs and alarms each travel as messages.

• Messages wait for their receiver. The message servers store messages on disk for a limited time, so a receiver that is offline gets them later. A configuration change made while a gateway is offline reaches it when it is back; values read while the hub is out of reach reach the hub later. How data flows describes this buffer.
• Each gateway has its own identity. On its first start the hub creates the security settings of the message server. Each gateway is enrolled with its own key; there is no shared password between gateways.
• Every connection is encrypted. The message server uses TLS on all its ports, and every connection checks the server's certificate against the platform's certificate authority in the Certificate Store.
• The gateway confirms what it applied. After a gateway applies a change (a new device, a changed rule), it reports back, so the hub can show whether the change is running.

Where data is kept

Copies of the data also go to the outbound targets you configure: your own databases, message brokers and cloud services.

What's next

• How data flows follows one value through these parts.
• Install Proxus with Docker sets up the hub and the SYSTEM gateway.
• Run Proxus on Kubernetes covers larger installations.