Administration·4 min read

Running the control plane on a server

Host the control plane on a server or cloud VM so you and your agents can reach it from anywhere.

By default everything runs on your own computer. To manage servers in other places, or let colleagues use the same setup, run the control plane on a server or cloud VM instead. Agents connect out to it, so the machines you manage do not need any open ports.

Ports

8080 — the app and API. Only people using PS-pocketEdge need to reach it.
8443 — agent connections. Only your agents need to reach it.

Keep both behind a private network or firewall rules that allow only those users and machines.

HTTPS is required

On a network address the control plane must use TLS. Give it a certificate and key whose names cover the address your agents and users use, and set its public URL to the HTTPS address. If your certificate comes from a private certificate authority, install agents with --ca-file pointing to that authority's certificate.

pe-controlplane \
  --grpc-addr=:8443 --http-addr=:8080 \
  --tls-cert=/etc/pspocketedge/tls.crt \
  --tls-key=/etc/pspocketedge/tls.key \
  --public-url=https://control.example.com:8080

Connect the desktop app

On each computer, run the Setup installer and choose to connect to an existing server, then enter your control plane's HTTPS address. Only the desktop app is installed. Sign in with your account.

Back up the control plane's database, its backup folder and its vault key together. Without the vault key, stored database passwords and Kubernetes credentials cannot be decrypted.