Ordyn

Appearance

Services ​

Ordyn services extend the core server into the networks and systems that endpoints use.

Some services accept public HTTPS traffic through Traefik. Other services connect outbound to an assigned Edge service and need no public ingress.

Public Ingress Services ​

These services expose HTTPS routes through Traefik:

  • Edge, which accepts endpoint-agent and service-client connections
  • Cache Nodes, which serve signed downloads and receive synchronized files
  • Net, which exposes HTTP boot handoff for PXE workflows
  • Webhooks, which receive external webhook requests

Outbound Service Clients ​

These services connect outbound to Edge and receive signed work through that connection:

  • Package Discovery, for public software discovery and installer import
  • SNMP, for switch, printer, and trap workflows
  • Telematik, for card terminal reachability, status, and reboot workflows

Network Services ​

Net runs near endpoint networks and supports Wake-on-LAN, IPAM probing, PXE boot, and OS installation handoff.

Net uses host networking for PXE, TFTP, and SMB. HTTP boot handoff is routed through Traefik.

Supporting Infrastructure ​

Traefik routes public HTTP and HTTPS traffic for the provided compose deployments and can obtain Let's Encrypt certificates.

Use the service-specific pages for installation, required environment values, enrollment, and operational guidance.

Enrolled Service-Client Certificates ​

SNMP, Telematik, Webhooks, Package Discovery, and Net authenticate to Edge with a certificate issued during service-client enrollment.

The service-client detail page shows:

  • connection state
  • current certificate serial
  • certificate expiration
  • last enrollment time
  • last seen time and recent connection errors, where available

Plan certificate renewal before the displayed expiration date. To renew a service-client certificate:

  1. Create a service-client enrollment token for the same service client.
  2. Run the service client's enrollment command with that token.
  3. Restart the service container.
  4. Confirm that the detail page shows a later certificate expiration and an active connection.

If the certificate expires or is revoked, the service client cannot connect until it is enrolled again. The affected service appears disconnected and jobs or probes that require it cannot run successfully.

See service-client certificate lifetime and renewal for the shared renewal workflow.