# The embedded OPC UA server

> The OPC UA server the station runs in-process: what it publishes, the four Settings rows that watch, configure and guard it, what it shares with the tray and the status bar, and what a remote browser may not do.

The station is an OPC UA server. It runs inside the application process, starts with it, keeps serving while the window is hidden in the notification area, and publishes the Connector's devices and their tags at `opc.tcp://<computer name>:4840/UA/GanterLab` (with `localhost` as the same-machine alternative). An OPC UA client on the network reads the tags there and may write to those that accept writes; a write crosses the same Logic write funnel as any other, so the source locks and the runtime's refusals apply to it. The same host carries the device communication: stopping the server stops the drivers with it.

Four rows of the Settings left index belong to it: **Status**, **Configuration** and **Client access** under OPC UA SERVER, and **Equipment access** under OPC UA EQUIPMENT. Opening the page takes the **Change settings** permission.

## In this area {#in-this-area}

| Page | What it covers |
| --- | --- |
| [Status](settings-opcua-status) | The faceplate: the lamp and state text, the endpoint, Start, Stop, Restart and Test connection, and the six meters (Uptime, Sessions, Devices, Drivers, Errors, Warnings). |
| [Configuration](settings-opcua-configuration) | Application name, Listen port, Client authentication (Disabled, Anonymous, Username & password), the user name and password, Apply & restart, and why the fields are editable only while the server is stopped. |
| [Client access](settings-opcua-client-access) | The certificates of the applications that dial this station: Add client and its identity check, the pending list and its ceiling, Connection addresses, the Windows Firewall row, Connected now, Trusted clients with Import certificate, Blocked clients. |
| [Equipment access](settings-opcua-equipment) | The certificates of the OPC UA equipment the Connector dials: Waiting for approval, Approved equipment with Import certificate, Withdraw approval, Blocked equipment, and what a waiting device says in the Connector. |

## Two gates, kept apart {#two-gates-kept-apart}

An OPC UA session passes two checks that this area configures separately. **Certificate trust** decides whether an application may reach the server at all: an unknown certificate is refused on its first attempt and kept for your review, nothing is trusted automatically, and the fingerprint, never the name a certificate claims, is the identity to verify. **Client authentication** then decides how a trusted application signs in: not at all (Disabled, the default, which refuses every session), anonymously, or with the one configured user name and password. The same idea points the other way on Equipment access: the station reads nothing from OPC UA equipment whose certificate you have not approved.

## What is shared with the tray and the status bar {#what-is-shared-with-the-tray-and-the-status-bar}

The server's live state is one truth read by several surfaces. The lamp and state text on Status, the health dot on the tray icon and its tooltip ("Ganter Lab: Online"), the tray menu's "Server: Online" line, and the status bar's health dot all read the same monitor; the status bar names the server ("Server: Starting…", "Server: Stopped") whenever it is not online and otherwise reports the worst device. The running flag, the start time, the uptime and the session count are also points of the [Logic](logic-from-other-pages) address space, under its Server root (Running, StartTime, Uptime, SessionCount), so a dashboard or an expression can read them.

Every outcome of a command here lands in the status bar's action feed, and every refusal and decision about a certificate is journaled: the server's own log lines are on the [Events](events-console) Console tab, and their error and warning counts are the last two meters of the faceplate.

## The two locks {#the-two-locks}

Start, Stop, Restart, Apply & restart, every field of Configuration and every certificate decision are engineering work. While a unit is running they are greyed with "Configuration is locked while a Unit is running.": stopping the plant's server is configuration work, not operation. While the runtime is stopped they are greyed too, and a press that gets through is refused with "Runtime stopped". Test connection, the meters, the addresses and the rosters stay readable through both.

## What a remote browser may not do {#what-a-remote-browser-may-not-do}

A browser on another device with a role holding Change settings sees these four rows exactly as the station's window does, and it may start, stop and restart the server and apply a configuration. What it may not do is decide about certificates: Add client, Trust, Block, Revoke, Unblock, Discard all, Import certificate, Approve, Withdraw approval and the Windows Firewall button are refused there with "Client access can only be changed in the station's desktop app." (or its equipment counterpart), and an information banner on each card says so: "Open the desktop app to change client access." The Warnings meter's link into the detached Events window is greyed with "Available on the station's local desktop only.".

Where the certificates live: the server's own application certificate and the stores of trusted, pending and blocked client certificates are under `ua\pki` in the station's data root, the equipment stores under `ua\pki\southbound`. They survive restarts and are not part of a configuration [backup](settings-backups).