# Siemens Industrial Edge > Run Proxus as an app on a Siemens Industrial Edge Device. Import the package into Industrial Edge Management, install it and open the UI. Source: https://proxus.io/docs/operate/siemens-industrial-edge At the end of this guide, Proxus runs as an app on a Siemens Industrial Edge Device. Users open it at `https:///proxus/` with the device's own address and certificate. The device's backup keeps its configuration and its database. The app is called **Proxus IIoT Platform for Siemens Industrial Edge** (`proxus-industrial-edge`). It is the same Proxus as the [Docker](https://proxus.io/docs/operate/docker) installation, packaged by the rules Siemens sets for Industrial Edge apps. ## Before you start - An Industrial Edge Management (IEM) instance where you may import apps into the **Catalog** and install them. - An Industrial Edge Device (IED) that is onboarded to that IEM and online. Note its architecture: the package is built for **x86-64** and for **arm64**, one file for each. - Memory on the device. The services reserve about 1.5 GB together and may use up to about 11 GB; most of the upper limit is the telemetry database (ClickHouse, up to 8 GB). The data grows with the number of tags you collect. - The package for your device's architecture. Download it from the [Proxus releases](https://github.com/proxusiiotplatform/proxus-distro/releases/latest): a `.app.zip` file (very large packages are split into `.partNN` files) and the `SHA256SUMS-app.txt` file. - Your Proxus license key. See [License](https://proxus.io/docs/administer/license). ## What the app contains The app runs these services on the device: | Service | What it does | Runs as | | --- | --- | --- | | `proxus-init` | Runs once at every start of the app, then stops. On the first start it creates the device's own database passwords; at every start it gives the folders the platform writes to the platform's user. | root, for these few seconds only | | `proxus-hub` | The hub: the web interface, the REST API and the coordination of the gateway. | user `1654` (`app`) | | `proxus-gateway` | The hub's own edge gateway, **SYSTEM**. It reads the devices you connect and runs the built-in MQTT broker. | user `1654` (`app`) | | `proxus-nats` | The message broker between the hub and the gateway. | user `1654` (`app`) | | `proxus-postgresql` | The configuration database: devices, profiles, rules, users, audit trail. | the database's own user | | `proxus-clickhouse` | The telemetry database: every value read, and the system logs. | the database's own user | Every service except `proxus-init` restarts on its own if it stops. Every service has a memory limit. ## Step 1: Check the package 1. If the package came as several `.partNN` files, join them into one `.app.zip` file, in order: ```bash cat proxus-industrial-edge_2.0.0_amd64.app.zip.part* > proxus-industrial-edge_2.0.0_amd64.app.zip ``` On Windows, use `copy /b` with the parts in order, for example `copy /b file.part00 + file.part01 file.app.zip`. 2. Unzip the file. You get one `.app` file, for example `proxus-industrial-edge_2.0.0_amd64.app`. 3. Check the `.app` file against `SHA256SUMS-app.txt`: ```bash shasum -a 256 proxus-industrial-edge_2.0.0_amd64.app ``` On Windows: `certutil -hashfile proxus-industrial-edge_2.0.0_amd64.app SHA256`. The value must match the line for the file in `SHA256SUMS-app.txt`. If it does not, do not import the file; download it again. ## Step 2: Import the app into the Catalog 1. Sign in to Industrial Edge Management. 2. Open **Catalog** and import the `.app` file. The upload takes a while: the package carries every image the app needs, so the device does not download anything from the internet. 3. When the upload has finished, the app appears in the **Catalog** as **Proxus IIoT Platform for Siemens Industrial Edge**, version `2.0.0`. Proxus publishes the package on its own [releases page](https://github.com/proxusiiotplatform/proxus-distro/releases), not through Industrial Edge Hub. ## Step 3: Install the app on the device 1. In **Catalog**, select the Proxus tile. The app's page opens. 2. Select **Install**. The **Install App** window opens. 3. The app needs no configuration file. Select **Next**. 4. Select the device and **Install now**. 5. Follow the installation under **Job Status**. When it has finished, the app is listed under **My Installed Apps**. The first start creates the databases and the platform's security keys, so it takes longer than later starts. ## Step 4: Open Proxus 1. Sign in to the Industrial Edge Device's web interface. 2. Open the Proxus app from the device's app list, or go to `https:///proxus/` in the same browser, where `` is the address you use for the device. 3. On the Proxus sign-in page, enter the user name `Admin`, leave **Password** empty and select **Log In**. 4. Give **Admin** a password straight away: **Platform > My Profile**, **Change My Password**. See [Security](https://proxus.io/docs/operate/security#default-credentials-to-change). 5. Activate your license. See [Activate a license](https://proxus.io/docs/administer/license#activate-a-license). If the device has no internet access, use the offline activation described there. 6. Choose the plant's time zone in **Administration > Region and Time**. The app runs in UTC and starts with UTC as the plant's time; times are stored in UTC either way, so this only changes how they are shown. See [Region and Time](https://proxus.io/docs/administer/region-and-time). Only users who are signed in to the device reach Proxus: the device checks its own sign-in before it passes a request to the app. Proxus then asks for its own user name and password. ## How the app is set up ### Access through the device's reverse proxy Siemens requires an app's web interface to be reached through the device's reverse proxy. Proxus follows this: - The UI is at `https:///proxus/`. The device's reverse proxy ends HTTPS with the device's certificate and passes requests to the hub with the `/proxus` path kept. The hub serves its pages under that path (`[Service] PathBase = "/proxus"`, see [Configuration](https://proxus.io/docs/reference/configuration)). - The hub publishes no port of its own on the device. Anyone who can open the device's web interface can open Proxus; no other port has to be opened in a firewall for the UI. - The device's reverse proxy passes WebSocket connections, which the web interface needs to stay live. - **Secure redirection** is on: only users signed in to the device are let through. The app registers these reverse proxy settings with the device: | Setting | Value | | --- | --- | | Service | `proxus-hub` | | Name (path) | `proxus` | | Protocol | `HTTP` (the device ends HTTPS) | | Port | `32780` (inside the app, not published) | | Rewrite target | `/proxus` (the path is kept) | | Secure redirection | on | | Directives | WebSocket upgrade (`Upgrade`, `Connection`), `Host`, `X-Forwarded-For`, `X-Forwarded-Proto`, `X-Forwarded-Host`, `proxy_read_timeout 3600s` | ### Passwords The app's files contain no password. At the first start, `proxus-init` creates a random password for PostgreSQL and one for ClickHouse, each different on every device. They are kept in the app's configuration folder, in `secrets/`, and only the database that uses a password and the platform's user can read it. The hub and the gateway read them when they start. Because the configuration folder is in the device's backup, a restored device keeps its passwords. ### No root The hub, the gateway and the message broker run as the images' own user, `app` (`1654`). The databases use their own users. Only `proxus-init` runs as root, for a few seconds at each start, to give the folders to that user; then it stops. ### Ports published on the device | Port on the device | Service | What it is for | | --- | --- | --- | | `32883` | `proxus-gateway` | The built-in MQTT broker, for machines and systems that publish to Proxus. | | `38083` | `proxus-gateway` | The gateway's own HTTP endpoint (health). | | `34222` | `proxus-nats` | The message broker's client port. | | `37422` | `proxus-nats` | The message broker's connection port for edge gateways. | | `38222` | `proxus-nats` | The message broker's monitoring endpoint. | The web interface has no port in this list: it is reached only through the device's reverse proxy on `443`. Close the ports you do not use in the device's firewall. See [Security](https://proxus.io/docs/operate/security#network-ports). ## Backup and restore The device's backup (Industrial Edge State Service) keeps the app's **Host** volumes: | Folder in the app | What it holds | In the device's backup | | --- | --- | --- | | `proxus-config` | Configuration, security keys, certificate store key, message broker trust, the device's passwords | yes | | `proxus-postgresql` | The configuration database | yes | | ClickHouse data | Telemetry history and system logs | no | | Gateway state | The pipelines' window state | no | After a restore, Proxus starts with the same configuration, devices, users, rules and passwords. Telemetry recorded before the backup is not in the device's backup. To keep telemetry history, send it to an outbound target as well (see [Outbound targets](https://proxus.io/docs/connect/outbound-targets)) or back it up separately as described in [Backup and restore](https://proxus.io/docs/operate/backup-and-restore). ## Update the app Import the new version into the **Catalog** and install it on the device as in steps 2 and 3. The configuration and the database stay on the device and are used by the new version. A device that ran an earlier build of the app opened the UI on `http://:32780`. The UI is now at `https:///proxus/` and port `32780` is no longer published. The database moves to the device's own password at the first start of the new build; nothing has to be done by hand. Earlier builds ran in Istanbul time. From version 2.1.0 the app runs in UTC and the plant's time zone is chosen in **Administration > Region and Time**: after the update, choose it there once, or times are shown in UTC. ## Limits - **Edge gateways on other machines.** The app's hub coordinates its own gateway, **SYSTEM**, which reads the devices reachable from the Industrial Edge Device. Installing further edge gateways on other machines from this hub is not supported: the install command needs the hub's own HTTPS port, which the app does not publish. Use a [Docker](https://proxus.io/docs/operate/docker) installation of the hub when you need gateways on several sites. - **Remote access through Industrial Edge Management.** Opening Proxus through IEM's remote access has not been tested. Open it on the device's address. ## When something does not work | What you see | Why | What to do | | --- | --- | --- | | `https:///proxus/` shows the device's sign-in page. | Secure redirection: you are not signed in to the device. | Sign in to the device's web interface, then open the address again. | | The Proxus page loads but stays on the start screen. | The live connection (WebSocket) does not get through. | Check that no proxy or security gateway between the browser and the device blocks WebSockets. | | The app's tile shows it as not running, and the `proxus-hub` log repeats `Waiting for the device passwords (proxus-init)...`. | `proxus-init` did not run or did not finish. | Open the `proxus-init` log. It ends with `Proxus: device passwords and folder owners are ready.` when it worked. Restart the app. | | A service log shows `Permission denied` for a folder of the app. | The folder's owner was changed outside the app. | Restart the app: `proxus-init` gives the folders back to the platform's user. | | After a restore, trends and reports have no history. | Telemetry is not in the device's backup. | See [Backup and restore](#backup-and-restore). | To collect logs and settings for Proxus support, use a [support bundle](https://proxus.io/docs/administer/support-bundle). ## What's next - [Connect a device](https://proxus.io/docs/connect/devices/add-a-device) to the **SYSTEM** gateway. - [Security](https://proxus.io/docs/operate/security): the hardening checklist. - [License](https://proxus.io/docs/administer/license): read your entitlement and live capacity.