Ordyn

Appearance

Edge ​

An Edge service is the connection point used by Ordyn agents and service clients.

Edge services are placed on a host that endpoints and service clients can reach. They may also be reachable from the public internet.

Use at least one Edge service for endpoint and service-client communication.

Requirements ​

Before installing an Edge service, prepare:

Installation ​

Checkout the Edge deployment folder from the Ordyn compose repository:

bash
apt install git
if [ ! -d /opt/ordyn-compose/.git ]; then
  git clone --filter=blob:none --sparse https://github.com/ordyn-project/compose.git /opt/ordyn-compose
fi
cd /opt/ordyn-compose
git sparse-checkout add edge

Create the Edge environment file:

bash
cd /opt/ordyn-compose/edge
cp .env.example .env

Set these values in .env:

dotenv
SERVICE_DOMAIN=ordyn-edge.example.com
EDGE_STATE_PATH=/data/edge-state.json
BACKEND_SOURCE_RANGE=172.17.0.0/16

SERVICE_DOMAIN is the public DNS name routed by Traefik and used by the Edge service. BACKEND_SOURCE_RANGE restricts management routes; set it to the source range used by the Ordyn server.

Start the container:

bash
cd /opt/ordyn-compose/edge
docker compose pull
python3 /opt/cosign-docker-verify/verify.py

Continue with docker compose up -d only when the Edge image verifies successfully and no failed verification message appears.

bash
docker compose up -d

On first start, the Edge service creates a pending local state and prints a remote bootstrap token in the container logs:

bash
docker compose logs edge

Copy the remote bootstrap token. The token is used once when the Edge service is created in Ordyn.

Create The Edge Service In Ordyn ​

Open Administration > Services, select the Edge tab, and select Add edge service.

Enter:

  • Name: optional display name
  • Hostname: the DNS name only, for example ordyn-edge.example.com
  • Certificate Authority: the CA that should be trusted by this Edge service
  • Remote bootstrap token: the token shown by the pending Edge container
  • Enabled: whether Ordyn should use the Edge service

After saving, Ordyn verifies the host, authenticates with the bootstrap token, sends the selected certificate authority to the Edge service, and stores service credentials for future connections.

The Edge detail page should show: Bridge connected

Reconfiguration ​

Use Reconfigure this Edge Service only after the remote Edge service has been reset and is pending again.

When reconfiguring, paste the remote bootstrap token shown by the pending Edge service. Ordyn does not store the remote bootstrap token.

For normal edits on the same host, leave Reconfigure this Edge Service disabled and leave the bootstrap token field empty.

Security Guidance ​

  • Only HTTPS is supported for edge services.
  • Restrict the management route to the Ordyn server.
  • Treat the remote bootstrap token as a secret.
  • Disable or delete an Edge service when its host is decommissioned.

Endpoint jobs are still authorized and signed by Ordyn. The Edge service provides transport and connection admission; even if the Edge is compromised, it will be unable to create instructions that agents will accept.