# OPC UA server

> The OPC UA server the station runs in-process: its row in the Servers folder, turning it on and off, Restart and Test connection, the Status card with the endpoint and six meters, the two checks a session passes, and what a remote browser may not do.

The station is an OPC UA server. It runs inside the application process and serves the tags, Logic variables, alarms and device commands listed on its [Served nodes](connector-opcua-served-nodes) card at `opc.tcp://<network name>:4840/UA/GanterLab` (with `localhost` as the same-machine alternative), where the name is the one written in **Network name** on [Configuration](connector-opcua-configuration), or this computer's own while that field is empty. An OPC UA client on the network reads them there and may write to the rows marked read and write; a write crosses the same Logic write funnel as any other, so the source locks and the runtime's refusals apply to it. The server publishes what the Connector reads and reads nothing itself: turning it off, or a port another program holds when it starts, stops only the server, and the Connector, the Logic and the recordings go on.

Its row is the first under the Servers folder of the Connector, and its panel says what it is under the title: "Serves the tags, Logic variables, alarms and device commands you list to the OPC UA clients that read and write them: SCADA and MES systems, historians, other stations. It receives connections and never makes one." The panel holds four cards, **Status**, **Configuration**, **Client access** and **Served nodes**; View connector reads them and Configure connector changes them. Until **Served nodes** has rows, the server serves nothing of the station.

## On or off {#on-or-off}

The server has a switch of its own, and it is off on a new station: port 4840 stays closed until somebody turns the server on. Once on, it starts with the application every time, and keeps serving while the window is hidden in the notification area, until somebody turns it off. A station updated from a version without the switch keeps what its clients had: a server that accepted sessions stays on, and one whose client authentication was Disabled, which refused every session, is turned off. An agent turns the same switch with `server_start` and `server_stop` (see [Agent tools](agent-tools)).

## The header {#the-header}

The panel's header carries a dot and the server's state, in the words its row reads:

| State | Dot | When |
| --- | --- | --- |
| "Turned off" | Grey | The switch is off, whatever else is happening. |
| "Listening on port 4840" | Green | The server is on and its address space is live. The row adds the clients connected: "No client connected", "1 client connected", "3 clients connected". |
| "Starting…" | Amber | Between a start and that moment, and while the Connector it publishes is coming up. |
| "Could not start" | Red | The server is on and its last start failed, typically because another program holds the port. The Status card says why under the endpoint. |
| "Connector stopped" | Grey | The server is on, but the Connector runtime is not running. |

The state is the server's alone. The Connector reads the devices whether the server runs or not, and the status bar and the tray speak for the Connector; see [The tray and the status bar](#the-tray-and-the-status-bar).

## The commands {#the-commands}

The command bar above the panel carries the server's verbs, as it carries the Modbus server's.

| Command | What it does | Greyed when (situation) | Not drawn when (role) |
| --- | --- | --- | --- |
| Enable | Turns the server on and starts it, serving its list; the Connector is not restarted (when it is not running at all, it is started first). The status bar reads "Starting the OPC UA server…" and then "OPC UA server turned on. Listening on `<endpoint>`.". A start that fails leaves the server on and reading Could not start, and the feed says why: "OPC UA server error: `<the reason>`", or "OPC UA server failed to start. It may be unable to bind port N. Check the logs." when the server only logged it. | While the server is on ("The server is already on."), while another command of the server runs ("Another server command is still running."), and while the station refuses configuration. | For a role without **Configure connector**. |
| Disable | Turns the server off and stops it gracefully: every client session ends and nothing is published until Enable. The Connector goes on reading the devices, and the Logic and the recordings go on. "Stopping the OPC UA server…" then "OPC UA server turned off." | While the server is off ("The server is already off."), and in the same two situations. | The same. |
| Restart | Stops the server and starts it again on the configuration in force; the Connector reads throughout. "Restarting the OPC UA server…" then "OPC UA server restarted.", or the failure text above. | While the server is off ("The server is off: Enable turns it on."), and in the same two situations. | The same. |
| Test connection | Reports what the station knows about its own server, without changing anything: "The OPC UA server is not listening, so no client can connect to it.", "The OPC UA server is starting, not ready yet.", or "OPC UA server reachable at `<endpoint>` with N active sessions." It is a statement from the running process, not a probe over the network. | Never. | Never. |

The station refuses configuration while a unit is running ("Configuration is locked while a Unit is running.") and while the runtime is stopped: stopping the plant's server is configuration work, not operation. A start that returns without an error is still checked, because the OPC UA stack can fail to bind its port and only log the fact, so the feed reports the failure rather than a success.

## The Status card {#the-status-card}

The card shows the endpoint a client on the network dials, `opc.tcp://<network name>:<port>/UA/GanterLab`, always a stable name and never `0.0.0.0` or a DHCP address; the same-machine alternative is under Connection addresses on [Client access](connector-opcua-client-access). While the server is on and could not start, the reason stands in a caution note under the endpoint. Then six meters, redrawn every second:

| Meter | What it counts |
| --- | --- |
| Uptime | Time since the server last started, as `2h 14m 5s`, `14m 5s` or `5s`; a gap mark while it is stopped. The same instant feeds the Server.StartTime and Server.Uptime points of the Logic address space. |
| Sessions | The client sessions the server has accepted right now, the same list Connected now shows on [Client access](connector-opcua-client-access). |
| Devices | The devices configured in the [Connector](connector), across every driver, enabled or not. |
| Drivers | How many distinct drivers those devices use. |
| Errors | The error lines in the communication host's log feed (server and drivers). The feed keeps the most recent 500 lines; the count turns red when it is not zero. |
| Warnings | The warning lines in the same feed, amber when not zero. For a role holding **View events** the number is a button that opens the detached Events window on the station's own desktop ("Open the Events window"); in a browser on another device it is greyed with "Available on the station's local desktop only.", and for a role without the permission it is a plain number. |

## Two checks, kept apart {#two-checks-kept-apart}

An OPC UA session passes two checks that this panel configures separately. **Certificate trust**, on [Client access](connector-opcua-client-access), decides whether an application may reach the server at all: an unknown certificate is refused on its first attempt and kept for your review, nothing is trusted automatically, and the fingerprint, never the name a certificate claims, is the identity to verify. **Client authentication**, on [Configuration](connector-opcua-configuration), then decides how a trusted application signs in: anonymously, the default, or with the one configured user name and password. The same idea points the other way on the [OPC UA driver's page](driver-opc-ua#equipment-access): the station reads nothing from OPC UA equipment whose certificate you have not approved.

## The tray and the status bar {#the-tray-and-the-status-bar}

The server's live state is read on its row and in its panel. The status bar's health line, the tray icon, its tooltip and the tray menu's line speak for the [Connector](connector-health) instead, the devices it reads, because a server that is off costs no reading and is not what an operator watching the station needs to be told. The running flag, the start time, the uptime and the session count are also points of the [Logic](logic-from-other-pages) address space, under its Server root (Running, StartTime, Uptime, SessionCount), so a dashboard or an expression can read them.

When the station starts with the server on and the server cannot open its port, the window raises the card "Server could not start", with **Use port 4841** and **Open Connector**; see [Configuration](connector-opcua-configuration#when-the-server-cannot-open-its-port-at-start). Every outcome of a command here lands in the status bar's action feed, and every refusal and decision about a certificate is journaled: the server's own log lines are on the [Events](events-console) Console tab, and their error and warning counts are the last two meters of the Status card.

## What a remote browser may not do {#what-a-remote-browser-may-not-do}

A browser on another device with a role holding Configure connector sees this panel exactly as the station's window does, and it may turn the server on and off, restart it and apply a configuration. What it may not do is decide about certificates: Add client, Trust, Block, Revoke, Unblock, Discard all, Import certificate and the Windows Firewall button are refused there with "Client access can only be changed in the station's desktop app.", and an information banner on the card says so: "Open the desktop app to change client access". The Warnings meter's link into the detached Events window is greyed with "Available on the station's local desktop only.".

Where the certificates live: the server's own application certificate and the stores of trusted, pending and blocked client certificates are under `ua\pki` in the station's data root, the equipment stores under `ua\pki\southbound`. They survive restarts and are not part of a configuration [backup](settings-backups).

## What this panel does not do {#what-this-panel-does-not-do}

It does not disconnect one session (revoking a certificate on Client access does), it does not clear the log counts (the feed is bounded and rolls on its own), it does not stop the Connector's reading, and it does not restart the application. It never starts the server again on its own after a failure: a failed start is reported and waits for your Restart, or for the port you pick on the card. The endpoint is changed on [Configuration](connector-opcua-configuration), and only while the server is not listening.