Ordyn

Appearance

Architecture ​

Ordyn is designed so managed endpoints do not need direct access to the Ordyn server.

The main operational components are:

  • the Ordyn server, where administrators manage endpoints, jobs, packages, users, audit data, and settings
  • edge services, which provide the live connection path for endpoints and service clients
  • cache nodes, which deliver files and artifacts to endpoints
  • endpoint agents and service clients, which connect outward to their assigned edge service

Overview ​

  • the Ordyn server is the source of authority
  • edge services carry live command and result traffic
  • cache nodes handle file and artifact delivery
  • agents and service clients connect outward to edge and cache nodes

Edge Services ​

An edge service is the connection point for endpoint agents and service clients.

Agents and service clients connect outward to edge. Ordyn sends instructions through that connection, and results return through the same path.

Cache Nodes ​

A cache node stores and serves files used by endpoint operations.

When a workflow needs a file, Ordyn makes it available on the assigned cache node and gives the endpoint a signed download reference. The endpoint verifies the signed file information before using the file.

Endpoint Agents ​

The Ordyn agent runs on Windows and Debian endpoints.

Agents do not need incoming network access from the Ordyn server.

Service Clients ​

Service clients run near systems that Ordyn needs to reach indirectly.

For example:

  • SNMP service clients for switches and printers
  • Telematik service clients for card terminals
  • webhook service clients for public webhook ingress
  • net nodes for PXE, Wake-on-LAN, ping, and IPAM scanning

Service clients are created in Ordyn, enrolled with a scoped service-client enrollment token, and then connect through their assigned edge service.

Trust Model ​

Ordyn signs commands and file information before endpoints use them.

  • an edge service can route traffic, but it cannot create valid Ordyn commands
  • a cache node can serve files, but endpoints verify signed file information before using them
  • endpoint agents and service clients authenticate with certificates issued during enrollment
  • revoking a certificate prevents that agent or service client from connecting with that certificate
  • an expired service-client certificate prevents that service client from connecting until it is enrolled again