Ordyn

Appearance

Services ​

Ordyn services extend the core server into the networks and systems that endpoints use.

Some services accept public HTTPS traffic through Traefik. Other services connect outbound to an assigned Edge service and need no public ingress.

Public Ingress Services ​

These services expose HTTPS routes through Traefik:

  • Edge, which accepts endpoint-agent and service-client connections
  • Cache Nodes, which serve signed downloads and receive synchronized files
  • Net, which exposes HTTP boot handoff for PXE workflows
  • Webhooks, which receive external requests for endpoint and infrastructure job automations
  • Relay, which accepts authorized KVM and SOL WSS connections from browsers and AMT clients

Outbound Service Clients ​

These services connect outbound to Edge and receive signed work through that connection:

  • Runners, for Windows and Linux script execution and infrastructure build work
  • Package Discovery, for public software discovery and installer import
  • SNMP, for switch, printer, interface traffic, and trap workflows
  • Telematik, for card terminal reachability, status, and reboot workflows
  • Intel AMT clients, for site-local firmware management
  • Relay service clients, for public session transport and Relay enrollment

Network Services ​

Net runs near endpoint networks and supports Wake-on-LAN, IPAM probing, PXE boot, and OS installation handoff.

Net uses host networking for PXE, TFTP, and SMB. HTTP boot handoff is routed through Traefik.

Supporting Infrastructure ​

Traefik routes public HTTP and HTTPS traffic for the provided compose deployments and can obtain Let's Encrypt certificates.

Use the service-specific pages for installation, required environment values, enrollment, and operational guidance.

Enrolled Service-Client Certificates ​

Runners, SNMP, Telematik, Webhooks, Package Discovery, Net, Intel AMT clients, and Relay service clients authenticate to Edge with a certificate issued during service-client enrollment.

The service-client detail page shows:

  • connection state
  • current certificate serial
  • certificate expiration
  • last enrollment time
  • last seen time and recent connection errors, where available

Plan certificate renewal before the displayed expiration date. For a service client:

  1. Create a service-client enrollment token for the same service client.
  2. Stop the service.
  3. Run the service-specific one-shot enrollment command with that token and --force.
  4. Start the service only after enrollment succeeds.
  5. Confirm that the detail page shows a later certificate expiration and an active connection.

Runner enrollment is managed by the Runner installation tools; follow the Runner instructions.

If the certificate expires or is revoked, the service client cannot connect until it is enrolled again. The affected service appears disconnected and jobs or probes that require it cannot run successfully.

See service-client certificate lifetime and renewal for the shared renewal workflow.