Siemens Industrial Edge

At the end of this guide, Proxus runs as an app on a Siemens Industrial Edge Device. Users open it at https://<device>/proxus/ with the device's own address and certificate. The device's backup keeps its configuration and its database.

The app is called Proxus IIoT Platform for Siemens Industrial Edge (proxus-industrial-edge). It is the same Proxus as the Docker installation, packaged by the rules Siemens sets for Industrial Edge apps.

Before you start

• An Industrial Edge Management (IEM) instance where you may import apps into the Catalog and install them.
• An Industrial Edge Device (IED) that is onboarded to that IEM and online. Note its architecture: the package is built for x86-64 and for arm64, one file for each.
• Memory on the device. The services reserve about 1.5 GB together and may use up to about 11 GB; most of the upper limit is the telemetry database (ClickHouse, up to 8 GB). The data grows with the number of tags you collect.
• The package for your device's architecture. Download it from the Proxus releases: a .app.zip file (very large packages are split into .partNN files) and the SHA256SUMS-app.txt file.
• Your Proxus license key. See License.

What the app contains

The app runs these services on the device:

Every service except proxus-init restarts on its own if it stops. Every service has a memory limit.

Step 1: Check the package

1. If the package came as several .partNN files, join them into one .app.zip file, in order:

   cat proxus-industrial-edge_2.0.0_amd64.app.zip.part* > proxus-industrial-edge_2.0.0_amd64.app.zip

   On Windows, use copy /b with the parts in order, for example copy /b file.part00 + file.part01 file.app.zip.

2. Unzip the file. You get one .app file, for example proxus-industrial-edge_2.0.0_amd64.app.

3. Check the .app file against SHA256SUMS-app.txt:

   shasum -a 256 proxus-industrial-edge_2.0.0_amd64.app

   On Windows: certutil -hashfile proxus-industrial-edge_2.0.0_amd64.app SHA256. The value must match the line for the file in SHA256SUMS-app.txt. If it does not, do not import the file; download it again.

Step 2: Import the app into the Catalog

1. Sign in to Industrial Edge Management.
2. Open Catalog and import the .app file. The upload takes a while: the package carries every image the app needs, so the device does not download anything from the internet.
3. When the upload has finished, the app appears in the Catalog as Proxus IIoT Platform for Siemens Industrial Edge, version 2.0.0.

Proxus publishes the package on its own releases page, not through Industrial Edge Hub.

Step 3: Install the app on the device

1. In Catalog, select the Proxus tile. The app's page opens.
2. Select Install. The Install App window opens.
3. The app needs no configuration file. Select Next.
4. Select the device and Install now.
5. Follow the installation under Job Status. When it has finished, the app is listed under My Installed Apps.

The first start creates the databases and the platform's security keys, so it takes longer than later starts.

Step 4: Open Proxus

1. Sign in to the Industrial Edge Device's web interface.
2. Open the Proxus app from the device's app list, or go to https://<device>/proxus/ in the same browser, where <device> is the address you use for the device.
3. On the Proxus sign-in page, enter the user name Admin, leave Password empty and select Log In.
4. Give Admin a password straight away: Platform > My Profile, Change My Password. See Security.
5. Activate your license. See Activate a license. If the device has no internet access, use the offline activation described there.
6. Choose the plant's time zone in Administration > Region and Time. The app runs in UTC and starts with UTC as the plant's time; times are stored in UTC either way, so this only changes how they are shown. See Region and Time.

Only users who are signed in to the device reach Proxus: the device checks its own sign-in before it passes a request to the app. Proxus then asks for its own user name and password.

How the app is set up

Access through the device's reverse proxy

Siemens requires an app's web interface to be reached through the device's reverse proxy. Proxus follows this:

• The UI is at https://<device>/proxus/. The device's reverse proxy ends HTTPS with the device's certificate and passes requests to the hub with the /proxus path kept. The hub serves its pages under that path ([Service] PathBase = "/proxus", see Configuration).
• The hub publishes no port of its own on the device. Anyone who can open the device's web interface can open Proxus; no other port has to be opened in a firewall for the UI.
• The device's reverse proxy passes WebSocket connections, which the web interface needs to stay live.
• Secure redirection is on: only users signed in to the device are let through.

The app registers these reverse proxy settings with the device:

Passwords

The app's files contain no password. At the first start, proxus-init creates a random password for PostgreSQL and one for ClickHouse, each different on every device. They are kept in the app's configuration folder, in secrets/, and only the database that uses a password and the platform's user can read it. The hub and the gateway read them when they start. Because the configuration folder is in the device's backup, a restored device keeps its passwords.

No root

The hub, the gateway and the message broker run as the images' own user, app (1654). The databases use their own users. Only proxus-init runs as root, for a few seconds at each start, to give the folders to that user; then it stops.

Ports published on the device

The web interface has no port in this list: it is reached only through the device's reverse proxy on 443. Close the ports you do not use in the device's firewall. See Security.

Backup and restore

The device's backup (Industrial Edge State Service) keeps the app's Host volumes:

After a restore, Proxus starts with the same configuration, devices, users, rules and passwords. Telemetry recorded before the backup is not in the device's backup. To keep telemetry history, send it to an outbound target as well (see Outbound targets) or back it up separately as described in Backup and restore.

Update the app

Import the new version into the Catalog and install it on the device as in steps 2 and 3. The configuration and the database stay on the device and are used by the new version.

A device that ran an earlier build of the app opened the UI on http://<device>:32780. The UI is now at https://<device>/proxus/ and port 32780 is no longer published. The database moves to the device's own password at the first start of the new build; nothing has to be done by hand.

Earlier builds ran in Istanbul time. From version 2.1.0 the app runs in UTC and the plant's time zone is chosen in Administration > Region and Time: after the update, choose it there once, or times are shown in UTC.

Limits

• Edge gateways on other machines. The app's hub coordinates its own gateway, SYSTEM, which reads the devices reachable from the Industrial Edge Device. Installing further edge gateways on other machines from this hub is not supported: the install command needs the hub's own HTTPS port, which the app does not publish. Use a Docker installation of the hub when you need gateways on several sites.
• Remote access through Industrial Edge Management. Opening Proxus through IEM's remote access has not been tested. Open it on the device's address.

When something does not work

To collect logs and settings for Proxus support, use a support bundle.

What's next

• Connect a device to the SYSTEM gateway.
• Security: the hardening checklist.
• License: read your entitlement and live capacity.