Flowgate on Linux¶
Supported platform¶
- Linux on x86-64. Installation packages are built for the Debian family (
.deb) and the RHEL family (.rpm). Debian 13 is the reference platform: the validation chain and all published benchmark results run on it. - ARM (for example Raspberry Pi class hardware) is not yet available.
- systemd is required for the packaged service integration.
Software requirements¶
The package declares its own dependencies, which the package manager installs automatically: the C runtime and the Mbed TLS cryptography and X.509 libraries. Everything else, including the web management console, is contained in the package. No Java, no .NET, no container runtime, and no database server are required. A node serves the management console from its own binary even if the separately packaged console UI is not installed.
Service¶
The package installs a systemd service named flowgate running under a dedicated
system account (flowgate-svc), with a hardened unit definition. The service is not
started automatically on installation: enable and start it explicitly once the
configuration is in place. The service restarts automatically if it stops, which is
also what makes the console's own restart button work.
Network¶
Default ports, all configurable:
| Port | Direction | Purpose |
|---|---|---|
| 17070 | Inbound | The node's OPC UA endpoint: data clients, chained nodes, and the validation tooling all connect here. |
| 17071 | Inbound | Reverse Connect listener. Only used on a node that accepts Reverse Connect links from nodes below it. |
| 8080 | Inbound | Web management console and management API, HTTPS. |
| 17071 or 17070 | Outbound | A node below another node dials its parent: Reverse Connect to the parent's 17071, or a forward push to the parent's 17070, depending on link configuration. |
A node that only dials outward (the normal posture for the node closest to the OT network) needs no inbound rules at the OT boundary at all. Port 4840, the OPC UA discovery port, is deliberately left free.
On first contact the console serves HTTPS with a certificate authority the node minted for itself, so the browser warns until that CA is imported or a certificate from your own PKI is installed. The console's automated validation runs on Chromium; other current browsers are expected to work but are not part of the validated set.
Storage¶
| Path | Contents |
|---|---|
/etc/flowgate/node.yaml |
Node configuration. Preserved across package upgrades. |
/etc/flowgate/users.yaml |
Local user accounts. |
/var/lib/flowgate |
Node state: PKI material, store and forward spools, snapshots, audit trail, and connector certificates. |
Log files live in the state directory with rotation on by default; the default caps hold the log footprint under about 100 MB. Store and forward spool growth depends entirely on how much data you select for durable delivery and how long links stay down: see Store and Forward for how the spool behaves and how to bound it.
Hardware¶
A formal minimum specification has not been published yet. The measured reference point: all published Performance Baselines were recorded on nodes with 8 CPU cores and 16 GB of memory, where the busiest node peaked under 3 GB of memory at a sustained 9,600 updates per second. Lighter workloads run in correspondingly less.