Appearance
System Settings
Last updated
Settings (admin section of the sidebar) holds appliance-wide configuration. It is admin-only: the settings API refuses other roles. Most cards share one Save Settings button at the top right; the License, Feature Toggles and OPC-UA Server cards save on their own. Saved values apply immediately — no restart.
General
| Field | Default | What it does |
|---|---|---|
| Site Name | Scada.Ink | Names this appliance: shown in the browser tab (for example Line 3 · Scada.Ink, including on the sign-in page) and under the logo in the sidebar, used as the sender name on email the appliance sends and in its default email subjects, and recorded as the source of configuration exports. Up to 80 characters. |
| Session Timeout (minutes) | 60 | How long a signed-in browser can go without keyboard, mouse or touch use before its session ends and it returns to the sign-in page. 5–1440; other values are refused when you save. Dashboards updating on their own do not count as use. A new value applies from each user's next sign-in or token refresh. A role with its own timeout (below) uses that instead. See Users and Roles. |
| Default Language | English | Language of the sign-in screen, of generated reports, and of the UI for any user who has not picked a language with the selector at the bottom of the sidebar. Choices: English, Deutsch, Español, Français. |
Password Policy & Session Timeouts
This card saves with its own Save security settings button, not the page's Save Settings. Values outside the ranges below are refused with a message rather than adjusted.
| Setting | Default | Range | Effect |
|---|---|---|---|
| Minimum length | 8 | 4–128 | Shortest password allowed |
| Require an uppercase letter / a lowercase letter / a digit / a symbol | off | — | Each one ticked must appear at least once. A symbol is anything that is not a letter or digit, a space included. |
| Expires after (days) | 0 (never) | 0–3650 | Once a password is older than this, signing in with it asks for a new one (see below) |
| Can't reuse last | 0 (no check) | 0–10 | A new password may not match the current one or any of the previous ones, up to this many in all. 1 means "different from the current one". |
| Lock after failures | 5 | 3–20 | Failed sign-ins in a row, per email address, before sign-in is refused |
| Lockout (minutes) | 15 | 1–1440 | How long sign-in stays refused. A wrong current password on My Account → Change Password counts too. |
- Length, character types and reuse are checked wherever a local password is set: adding a user, an administrator's reset on the Users page, My Account → Change Password, the first-run wizard, the expired-password screen, and
users.add/users.setPasswordin scripts. Forms list the rules as you type and tick each one off. Existing passwords keep working until they are next changed or expire. - Expiry: the password still has to be typed correctly. The sign-in screen then shows Password expired and asks for a new one that meets the policy; it signs in with it straight away (asking for the two-factor code too, if the account has one). That screen is good for 10 minutes and for one change. Each account's clock starts when its password was last set; on upgrade, every existing account's clock started at the upgrade.
- Lockout is held in memory: restarting the API clears it. While locked, sign-in answers Too many failed sign-in attempts. Try again in N minutes., even with the right password.
- Accounts that sign in through a directory (LDAP, SSO) follow the directory's rules; expiry and reuse do not apply to them here.
Session timeout by role — idle minutes (5–1440) for sessions of each role. Leave a role empty to use the general Session Timeout (minutes) above. Like the general timeout, a change applies from each session's next sign-in or renewal, and no session lasts longer than 7 days from sign-in. A user whose role changes gets the new role's timeout at their next renewal.
| Method | Endpoint | Purpose |
|---|---|---|
| GET | /api/admin/security | passwordPolicy and roleSessionTimeouts (admin) |
| PUT | /api/admin/security | { "passwordPolicy": { "minLength": 12, "requireDigit": true }, "roleSessionTimeouts": { "admin": 15, "viewer": null } } — either part, any subset of fields (admin) |
| GET | /api/auth/password-policy | The password rules; no sign-in needed (the expired-password screen uses it) |
| POST | /api/auth/password/expired | { "changeTicket": "…", "newPassword": "…" } — the ticket comes from the sign-in response with code PASSWORD_EXPIRED |
Onboarding
Replay Onboarding reopens the first-run setup wizard for you straight away. See First-run setup for its steps.
License and Feature Toggles
The License card shows the appliance's hardware ID and activates license keys; Feature Toggles switches individual licensed features on or off for this appliance. Both are described in Getting Started.
TV Display
| Field | Default | What it does |
|---|---|---|
| Allow public access to TV Display | Off | When on, the /tv page (device status and active alarms for a wall monitor) loads without signing in. When off, its data request answers Public TV display is not enabled. |
Navigation
A toggle per page hides it from the sidebar for everyone, and visiting its URL redirects to the overview. This is cosmetic: licensing, permissions and data are unchanged, and the API still answers. Hideable pages: Dashboards, Scripts, Libraries, Custom Pages, Data Tables, Workflows, History, Alarms, Files, Schedules, Driver Health, Users, Appliance.
Warning: Hiding Users or Appliance hides them from admins too. Turn the toggle back on here to get them back.
Kiosk Display
Controls what a monitor attached to the appliance shows at boot. The kiosk browser opens /kiosk, which redirects to the screen chosen here.
| Field | Default | What it does |
|---|---|---|
| Enable kiosk landing | Off | When off, /kiosk always goes to the login screen |
| Default screen | Login screen | Login screen, Dashboard, Custom page, Operator Hub, or TV Display |
| Dashboard / Custom page | — | Shown when that screen type is chosen; pick the target |
Dashboard, page, Operator Hub and TV targets show a small lock button that returns to the login screen. Private dashboards and pages need a sign-in on the device, and nobody touches a wall screen, so that session ends after the Session Timeout, returning the screen to the login page. For an unattended wall screen, use a dashboard or page that does not require sign-in, or the TV Display with public access on. The operating system's kiosk boot is set up on the appliance with deploy/setup-kiosk.sh.
Data API
Read-only live tag values for external systems. Details: REST API Reference.
| Field | Default | What it does |
|---|---|---|
| Enable Public Data API | Off | Makes /api/data/tags.json and /api/data/tags.xml answer |
| Require Authentication | Off | Requests must carry a sign-in token in Authorization: Bearer or ?token=. When off, anyone on the network can read every tag value. |
OPC-UA Server
Exposes selected tags to external OPC-UA clients. Off by default. Which tags are exposed, and whether each is writable, is chosen per tag on each device's Manage Tags tab.
| Field | Default | What it does |
|---|---|---|
| Enable server | Off | Starts the server; the badge shows Running or Stopped |
| Port | 4840 | 1–65535. Endpoint: opc.tcp://<appliance>:4840/scadaink/server |
| Allow anonymous access | Off | Accept clients with no user identity |
| Security Policy | Basic256Sha256 | Also Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss, None |
| Security Mode | SignAndEncrypt | Also Sign, None |
| Username | opcua | The one user identity the server accepts |
| Password | not set | Stored encrypted; leave blank to keep the current one ((set — leave blank to keep)) |
| Accept new client certificates automatically | Off | Commissioning only — trusts every new client certificate on first connect. Off: unknown certificates are refused and listed under Pending below for you to trust individually |
Click Save & apply; the server restarts with the new settings, or shows why it couldn't start. With anonymous off and no password, no client can connect — the card warns about this. Tags appear under Devices → Device name (#id) and Expression Tags. A client certificate is required only for secure endpoints (Sign/Sign & Encrypt) — anonymous connections with security None don't present one. Trusted certificates are accepted even past their expiry or before their start date, since PLC/HMI clocks are often wrong. Writes from clients are allowed only for tags marked writable on devices with writes enabled, and are recorded in the audit log as opcua_write. See Integrations for the client-certificate list (Pending/Trusted, with Trust/Remove/Delete actions).
Historian API
Read-only historical data as JSON. Details: Historian API.
| Field | Default | What it does |
|---|---|---|
| Enable Historian API | Off | Makes /api/data/history.json answer. Requires tags and start, e.g. ?tags=1:Spindle/Speed&start=-24h |
| Require Authentication | Off | As for the Data API |
Data Retention
Storage on the appliance is limited, so this card deletes old data automatically before it can fill the disk and stop recording. Enter 0 in any field to keep that data forever. Pruning runs a few minutes after the API starts and then every hour; Prune now runs it immediately and shows what it removed. Save your changes before pruning.
| Field | What is deleted | Default |
|---|---|---|
| Alarm history (days) | Cleared alarms older than this. Active alarms are always kept | 730 |
| Report files (days) | Generated PDF and HTML report files, and their History entries | 180 |
| Delivered store & forward rows (days) | Buffered rows already delivered to InfluxDB or a remote database | 7 |
| Store & forward buffer limit (rows) | When the InfluxDB buffer is full: delivered rows first, then quarantined rows, then the oldest undelivered readings. Each drop of undelivered data is written to the audit log. 0 means no limit | 1,000,000 |
| Hourly history rollups (days) | Hourly min/max/average/count/last summaries of historized tags. Charts over 14 to 60 days are drawn from them | 730 |
| Daily history rollups (days) | The same per day. Charts over 60 days are drawn from them | 3,650 |
InfluxDB history retention shows how long InfluxDB keeps tag history and lets you change it. Apply to InfluxDB asks you to confirm, because InfluxDB then permanently deletes older points within about 30 minutes. See Historian Storage.
Changes are recorded in the audit log. SQL historian retention is set separately on Data Infrastructure → Historian, and a single tag's raw-history retention with Keep (days) in the History page's Configure Tags panel; the hourly pass applies those too. Rollups are explained in Historian Storage.
| Method | Endpoint | Purpose |
|---|---|---|
| GET | /api/retention | Settings, defaults, InfluxDB's current retention and the last pruning pass (admin) |
| PUT | /api/retention | Change any of alarmHistoryDays, reportFileDays, sfSentDays, sfBufferMaxRows, rollupHourlyDays, rollupDailyDays (admin) |
| POST | /api/retention/prune | Prune now (admin) |
| PUT | /api/retention/influx | { days } — set InfluxDB's retention; 0 keeps forever (admin) |
SMTP Email
Outgoing mail server for alarm pipelines, scheduled reports and workflow email. See Email (SMTP) Settings — read its caveats before relying on it.
Where settings live
Everything on this page is stored as key/value rows in the configuration database and is included in backups. Keys starting with feature. and license. are managed only through the License and Feature Toggles cards and are ignored if sent to the settings API. Keys starting with security. (the password policy and per-role timeouts) are likewise written only through /api/admin/security, and are not returned by GET /api/admin/config.
| Method | Endpoint | Purpose |
|---|---|---|
| GET | /api/admin/config | All settings except feature.* and license.* |
| PUT | /api/admin/config | Upsert key/value pairs |
| GET | /api/settings | All settings (admin) |
| PUT | /api/settings | Upsert key/value pairs (admin) |
| GET | /api/settings/kiosk | Kiosk target; no sign-in needed |
| GET | /api/settings/locale/default | Default language; no sign-in needed |
| GET | /api/settings/nav | Hidden sidebar pages; any signed-in user |
| GET | /api/opcua/settings | OPC-UA server settings (admin) |
| PUT | /api/opcua/settings | Save and apply the OPC-UA server settings (admin) |
| GET | /api/opcua/certificates | Pending and trusted client certificates (admin) |
| POST | /api/opcua/certificates/:thumbprint/trust | Trust a pending client certificate (admin) |
| POST | /api/opcua/certificates/:thumbprint/untrust | Move a trusted certificate back to pending (admin) |
| DELETE | /api/opcua/certificates/:thumbprint | Delete a pending client certificate (admin) |
Note:
GET /api/admin/configandGET /api/settingsmask the SMTP password and the OPC-UA server password as••••••••if either was typed in directly — a save that sends the placeholder back unchanged keeps the stored value. A secret reference such as${secret:SMTP_PASS}is shown as-is, since it's a name rather than the credential itself.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Users are not signed out after the session timeout | Someone is still using that browser, or the session began before the timeout was changed | The new value applies at the session's next refresh or sign-in |
| A wall screen returns to the sign-in page | Nobody touches it, so the session timeout ends it | Use a public dashboard, page or the TV Display, or raise the timeout (up to 1440) |
| A page disappeared from everyone's sidebar | Hidden under Navigation | Toggle it back on and Save Settings |
/tv shows nothing on the wall monitor | Public TV access is off | Turn on Allow public access to TV Display |
/api/data/tags.json returns 403/404 | Data API disabled | Turn on Enable Public Data API |
| Settings saved but server reload failed: … | The OPC-UA server could not start (port in use, missing package) | Check the port; see the API log |