Remote access

Opening this station's dashboards to other devices on the network, over HTTPS if you choose, who may use them, and the restart every change costs.

Remote access is the last row of the GENERAL group on the Settings page. Off, the station's web host answers only its own machine on the loopback address, which is how the desktop window itself draws the interface, and nothing listens on the network. On, every network address of the station is bound too, and a tablet or another PC on the same LAN can open the same interface in a browser. The page takes the Change settings permission, and the three settings here restart the web server that draws the very screen you are on, so each asks first.

The settings

While the switch is on, the card explains who may connect (see below) and then shows one of three things.

• Open on another device: a QR code and the address to type, http://<address>:<port>/ (or https://), where the address is the first LAN address the host bound when it started. Scan it or type it in a browser on the same network.
• "This station isn't on a network yet. Connect it to your plant network to get an address to share.": the switch is on, but the station had no LAN address when the host started, so only loopback is bound and no firewall rule was created. The setting stays on, and the host is rebound when an address appears.
• Remote access is unavailable, a caution banner: HTTPS was requested and the certificate could not be loaded or created. The banner carries the reason: "Remote access was not started because its HTTPS certificate could not be loaded or created. Loopback access remains available; check Events and change the remote-access setting to retry." The station never falls back to plain HTTP on its own, and a "Remote dashboard unavailable" notification says the same when the host starts.

Applying a change: the restart

Flipping either switch or committing a new port opens the dialog Restart the web server?. Its paragraph states the cost and ends with "This screen is drawn by that server, so it stops for a few seconds and comes back on its own.":

• turning the switch on: "Opening dashboards on other devices restarts the web server.";
• turning it off: "Closing dashboards on other devices restarts the web server, and a device that reads this station over the network stops reaching it.";
• HTTPS on: "Serving over HTTPS restarts the web server, and each device asks you to accept this station's own certificate the first time."; HTTPS off: "Serving over plain HTTP again restarts the web server.";
• a new port: "Moving this station to port N restarts the web server."

Cancel puts the switch and the port field back to what the station listens on. Apply and reload saves the setting; the app then removes the old firewall rule, stops the host, starts it with the new options and recreates the rule. While that happens a cover titled Restarting the web server stands over the app: "The screen comes back on its own as soon as the station answers again." on the desktop window, "The screen comes back on its own as soon as the new address answers." in a browser, and in both "Acquisition, recording and the OPC UA server keep running the whole time." A browser probes the new address every half second for up to thirty seconds and goes there when it answers; if nothing answers in time the cover steps aside and the ordinary reconnection screen, with its Try again and Reload, takes over. The desktop window re-points its own view. Whoever asked for the change is the one who waits; every other device simply loses its connection and reconnects. A browser that turned remote access off has, by its own choice, nothing to come back to.

While the runtime is stopped this page is not drawn at all (see Settings), so none of the three can be reached until the runtime is back.

HTTPS and its certificate

The certificate is self-signed, issued to "Ganter Lab Dashboard", valid for five years, and lists localhost, 127.0.0.1 and every LAN address the station had when it was made. It is kept as dashboard-cert.pfx under the station's data root and is made again when it is missing, unreadable, within a day of expiring, or no longer covers one of the station's addresses. Browsers do not trust it by themselves: each device shows its own warning once and you accept the station's certificate there. Without HTTPS, sign-in PINs cross the network in clear text, and so does anything else the station shows over the network, including the OPC UA server user name on Configuration; a password typed there crosses the same way on its way in, though the stored one is never sent to the browser.

The firewall rule and the address watch

The "Ganter Lab Dashboard" rule is created and removed with netsh as the app applies the setting. Creating a rule needs elevation, and the app does not assume it: a failure is journaled and swallowed, because the bind and the private-range allowlist still confine the host, and Windows then shows its own "allow access" prompt instead. The rule is dropped and recreated on every change, so no stale rule for an old port stays behind.

The station's addresses can move under a running host (a new DHCP lease, a move from Wi-Fi to cable, a dock). The app watches them and, while remote access is on, rebinds the host on the current addresses, which also renews the certificate when it no longer covers them; the address card follows.

Who may open a dashboard

The first question is not who is asking but what the request addressed. The station answers at 127.0.0.1 on its own machine and, while remote access is on, at each LAN address it bound and at this machine's own network name; a request that names any other host, or that carries a page of another site as its origin, is refused with 403 and the line "This station answers only at the address it publishes." before a screen, a file or a connection is served. That is what keeps a site you happen to be visiting from driving this station through your browser: such a page can point its own domain at this machine, but it cannot choose the address the browser writes into the request it makes for it, and the attempt is journaled to Events. The agent endpoint refuses its own callers by the same rule.

The web host serves the whole interface, not only dashboards, and every browser is its own connection with its own signed-in user. Whether an identity may enter from the network at all is its role's Remote access (LAN) permission on the Users page: a browser whose identity lacks it sees no page, only the sign-in panel, until someone with the bit signs in. The Not signed in role has it off by default, so turning remote access on shares nothing until a user signs in, unless you deliberately grant that role the bit for a kiosk or a tablet. A browser on the station's own machine is never gated by it. From there on the signed-in role decides everything else, exactly as on the station's window; see Signing in.

What a remote browser cannot do

A few actions exist only on the station's own desktop and stay greyed in a browser with "Available on the station's local desktop only.": opening the backups folder, restarting to take an update, and opening the detached Events window from the Warnings meter. The Desktop zoom row is not drawn at all. Trusting, blocking, revoking and importing certificates on Client access and Equipment access, and the OPC UA firewall button, are refused in a browser: "Client access can only be changed in the station's desktop app." Everything else, these remote-access settings included, follows the signed-in role.

What this section does not do

The station is never exposed to the internet and sets up no tunnel: the bind is a LAN bind, the firewall rule is scoped to the local subnet, and the allowlist refuses public addresses even if both were misconfigured. There is no list of connected browsers here, no per-device allow or deny, no separate password for viewing (identity is the local user), and the port of the agent endpoint is set on the Agent page, not here.