diff --git a/DTaaS-version0.6.pdf b/DTaaS-version0.6.pdf index 781b253d6..b7d5c150e 100644 Binary files a/DTaaS-version0.6.pdf and b/DTaaS-version0.6.pdf differ diff --git a/client/test-results/.last-run.json b/client/test-results/.last-run.json new file mode 100644 index 000000000..cbcc1fbac --- /dev/null +++ b/client/test-results/.last-run.json @@ -0,0 +1,4 @@ +{ + "status": "passed", + "failedTests": [] +} \ No newline at end of file diff --git a/version0.6/admin/client/auth.html b/version0.6/admin/client/auth.html new file mode 100644 index 000000000..cbe1a43f6 --- /dev/null +++ b/version0.6/admin/client/auth.html @@ -0,0 +1,2865 @@ + + + + + + + + + + + + + + + + + + + + + + + Client - Digital Twin as a Service (DTaaS) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + + Skip to content + + +
+
+ +
+ + + + +
+ + +
+ +
+ + + + + + + + + +
+
+ + + +
+
+
+ + + + + + + +
+
+
+ + + +
+
+
+ + + +
+
+
+ + + +
+
+ + + + + + + +

OAuth for React Client

+

To enable user authorization on DTaaS React client website, you will use +the OAuth authorization protocol, specifically the PKCE authorization flow. +Here are the steps to get started:

+

1. Choose Your GitLab Server:

+ +

2. Determine Your Website's Hostname:

+
    +
  • Before setting up OAuth on GitLab, decide on the hostname for your website. + It's recommended to use a self-hosted GitLab instance, which you will use in + other parts of the DTaaS application.
    • +
+

3. Define Callback and Logout URLs:

+
    +
  • For the PKCE authorization flow to function correctly, you need two URLs: + a callback URL and a logout URL.
    • +
  • The callback URL informs the OAuth provider of the page where + signed-in users should be redirected. It's different from the landing + homepage of the DTaaS application.
    • +
  • The logout URL is where users will be directed after logging out.
    • +
+

4. OAuth Application Creation:

+
    +
  • During the creation of the OAuth application on GitLab, you need to specify + the scope. Choose openid, profile, read_user, read_repository, and api scopes.
    • +
+

Creation of Client OAuth Application

+

5. Application ID:

+
    +
  • After successfully creating the OAuth application, GitLab generates + an application ID. This is a long string of HEX values that you will need for + your configuration files.
    • +
+

Scopes for Client OAuth Application

+

6. Required Information from OAuth Application:

+
    +
  • You will need the following information from the OAuth application + registered on GitLab:
    • +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
GitLab Variable NameVariable Name in Client env.jsDefault Value
OAuth ProviderREACT_APP_AUTH_AUTHORITYhttps://gitlab.foo.com/
Application IDREACT_APP_CLIENT_ID
Callback URLREACT_APP_REDIRECT_URIhttps://foo.com/Library
ScopesREACT_APP_GITLAB_SCOPESopenid, profile, read_user, read_repository, api
+

Summary for Client OAuth Application

+

7. Create User Accounts:

+

Create user accounts in gitlab for all the usernames chosen during +installation. The trial installation script comes with two default +usernames - user1 and user2. For all other installation scenarios, +accounts with specific usernames need to be created on gitlab.

+ + + + + + + + + + + + + +
+
+ + + +
+ +
+ + + +
+
+
+
+ + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/version0.6/admin/client/client-oauth-id.png b/version0.6/admin/client/client-oauth-id.png new file mode 100644 index 000000000..a509b60c7 Binary files /dev/null and b/version0.6/admin/client/client-oauth-id.png differ diff --git a/version0.6/admin/client/client-oauth-name.png b/version0.6/admin/client/client-oauth-name.png new file mode 100644 index 000000000..fa9ed2698 Binary files /dev/null and b/version0.6/admin/client/client-oauth-name.png differ diff --git a/version0.6/admin/client/client-oauth-scopes.png b/version0.6/admin/client/client-oauth-scopes.png new file mode 100644 index 000000000..8c879da36 Binary files /dev/null and b/version0.6/admin/client/client-oauth-scopes.png differ diff --git a/version0.6/admin/client/config.html b/version0.6/admin/client/config.html new file mode 100644 index 000000000..62dfe68af --- /dev/null +++ b/version0.6/admin/client/config.html @@ -0,0 +1,3044 @@ + + + + + + + + + + + + + + + + + + + + + + + Client - Digital Twin as a Service (DTaaS) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + + Skip to content + + +
+
+ +
+ + + + +
+ + +
+ +
+ + + + + + + + + +
+
+ + + +
+
+
+ + + + + + + +
+
+
+ + + +
+
+
+ + + +
+
+
+ + + +
+
+ + + + + + + +

Configure Client Website

+

This page describes various configuration options for react website.

+
 1
+ 2
+ 3
+ 4
+ 5
+ 6
+ 7
+ 8
+ 9
+10
+11
+12
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63
+64
if (typeof window !== 'undefined') {
+  window.env = {
+    REACT_APP_ENVIRONMENT: "prod | dev | local | test",
+    REACT_APP_URL: "URL for the gateway",
+    REACT_APP_URL_BASENAME: "Base URL for the client website"(optional, can be null),
+    REACT_APP_URL_DTLINK: "Endpoint for the Digital Twin",
+    REACT_APP_URL_LIBLINK: "Endpoint for the Library Assets",
+    REACT_APP_WORKBENCHLINK_VNCDESKTOP: "Endpoint for the VNC Desktop link",
+    REACT_APP_WORKBENCHLINK_VSCODE: "Endpoint for the VS Code link",
+    REACT_APP_WORKBENCHLINK_JUPYTERLAB: "Endpoint for the Jupyter Lab link",
+    REACT_APP_WORKBENCHLINK_JUPYTERNOTEBOOK:
+      "Endpoint for the Jupyter Notebook link",
+    REACT_APP_WORKBENCHLINK_DT_PREVIEW: "Endpoint for the Digital Twins page preview",
+    REACT_APP_CLIENT_ID: 'AppID genereated by the gitlab OAuth provider',
+    REACT_APP_AUTH_AUTHORITY: 'URL of the private gitlab instance',
+    REACT_APP_REDIRECT_URI: 'URL of the homepage for the logged in users of the website',
+    REACT_APP_LOGOUT_REDIRECT_URI: 'URL of the homepage for the anonymous users of the website',
+    REACT_APP_GITLAB_SCOPES: 'OAuth scopes. These should match with the scopes set in gitlab OAuth provider',
+  };
+};
+
+// Example values with no base URL. Trailing and ending slashes are optional.
+if (typeof window !== 'undefined') {
+  window.env = {
+    REACT_APP_ENVIRONMENT: 'prod',
+    REACT_APP_URL: 'https://foo.com/',
+    REACT_APP_URL_BASENAME: '',
+    REACT_APP_URL_DTLINK: '/lab',
+    REACT_APP_URL_LIBLINK: '',
+    REACT_APP_WORKBENCHLINK_VNCDESKTOP: '/tools/vnc/?password=vncpassword',
+    REACT_APP_WORKBENCHLINK_VSCODE: '/tools/vscode/',
+    REACT_APP_WORKBENCHLINK_JUPYTERLAB: '/lab',
+    REACT_APP_WORKBENCHLINK_JUPYTERNOTEBOOK: '',
+    REACT_APP_WORKBENCHLINK_DT_PREVIEW: '/preview/digitaltwins',
+    REACT_APP_CLIENT_ID: '1be55736756190b3ace4c2c4fb19bde386d1dcc748d20b47ea8cfb5935b8446c',
+    REACT_APP_AUTH_AUTHORITY: 'https://gitlab.foo.com/',
+    REACT_APP_REDIRECT_URI: 'https://foo.com/Library',
+    REACT_APP_LOGOUT_REDIRECT_URI: 'https://foo.com/',
+    REACT_APP_GITLAB_SCOPES: 'openid profile read_user read_repository api',
+  };
+};
+
+
+// Example values with "bar" as basename URL.
+//Trailing and ending slashes are optional.
+if (typeof window !== 'undefined') {
+  window.env = {
+    REACT_APP_ENVIRONMENT: "dev",
+    REACT_APP_URL: 'http://localhost:4000/',
+    REACT_APP_URL_BASENAME: 'bar',
+    REACT_APP_URL_DTLINK: '/lab',
+    REACT_APP_URL_LIBLINK: '',
+    REACT_APP_WORKBENCHLINK_VNCDESKTOP: '/tools/vnc/?password=vncpassword',
+    REACT_APP_WORKBENCHLINK_VSCODE: '/tools/vscode/',
+    REACT_APP_WORKBENCHLINK_JUPYTERLAB: '/lab',
+    REACT_APP_WORKBENCHLINK_JUPYTERNOTEBOOK: '',
+    REACT_APP_WORKBENCHLINK_DT_PREVIEW: '/preview/digitaltwins',
+    REACT_APP_CLIENT_ID: '1be55736756190b3ace4c2c4fb19bde386d1dcc748d20b47ea8cfb5935b8446c',
+    REACT_APP_AUTH_AUTHORITY: 'https://gitlab.foo.com/',
+    REACT_APP_REDIRECT_URI: 'http://localhost:4000/bar/Library',
+    REACT_APP_LOGOUT_REDIRECT_URI: 'http://localhost:4000/bar',
+    REACT_APP_GITLAB_SCOPES: 'openid profile read_user read_repository api',
+  };
+};
+
+

Multiple DTaaS applications

+ + +
+

Warning

+

This is not a regular installation scenario and is only +recommended for experts. +This installation setup requires significant modifications +to the docker compose files.

+
+ + +

The DTaaS is a regular web application. It is possible to host multiple DTaaS +applications on the same server. The only requirement is to have a distinct URLs. +You can have three DTaaS applications running at the following URLs.

+
1
+2
+3
https://foo.com/au
+https://foo.com/acme
+https://foo.com/bar
+
+

All of these instances can use the same gitlab instance for authorization.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
DTaaS application URLGitlab Instance URLCallback URLLogout URLApplication ID
https://foo.com/auhttps://foo.gitlab.comhttps://foo.com/au/Libraryhttps://foo.com/auautogenerated by gitlab
https://foo.com/acmehttps://foo.gitlab.comhttps://foo.com/au/Libraryhttps://foo.com/auautogenerated by gitlab
https://foo.com/barhttps://foo.gitlab.comhttps://foo.com/au/Libraryhttps://foo.com/auautogenerated by gitlab
+

If you are hosting multiple DTaaS instances on the same server, +do not install DTaaS with a null basename on the same server. +Even though it works well, the setup is confusing to setup +and may lead to maintenance issues.

+

If you choose to host your DTaaS application with a basename (say bar), then the +URLs in env.js change to:

+
1
+2
+3
+4
DTaaS application URL: https://foo.com/bar
+Gitlab instance URL: https://gitlab.foo.com
+Callback URL: https://foo.com/bar/Library
+Logout URL: https://foo.com/bar
+
+ + + + + + + + + + + + + +
+
+ + + +
+ +
+ + + +
+
+
+
+ + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/version0.6/developer/client/client.html b/version0.6/developer/client/client.html new file mode 100644 index 000000000..01b197353 --- /dev/null +++ b/version0.6/developer/client/client.html @@ -0,0 +1,2768 @@ + + + + + + + + + + + + + + + + + + + React Website - Digital Twin as a Service (DTaaS) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + + Skip to content + + +
+
+ +
+ + + + +
+ + +
+ +
+ + + + + + + + + +
+
+ + + +
+
+
+ + + + + + + +
+
+
+ + + +
+
+
+ + + +
+
+
+ + + +
+
+ + + + + + + +

React Website

+

The Website +is how the end-users interact with the software platform. The website is +being developed as a React single page web application.

+

A dependency graph for the entire codebase of the react application is:

+

Dependency Graphs

+

The figures are the dependency graphs generated from the code.

+

src directory

+

src dependency graph

+

test directory

+

test dependency graph

+ + + + + + + + + + + + + +
+
+ + + +
+ +
+ + + +
+
+
+
+ + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/version0.6/developer/system/architecture.html b/version0.6/developer/system/architecture.html index 8cf3dd930..d1715a8f3 100644 --- a/version0.6/developer/system/architecture.html +++ b/version0.6/developer/system/architecture.html @@ -2866,8 +2866,8 @@

System Components

If you are interested, please take a look at the C4 architectural diagram.

-

A mapping of the architectural components to related pages in -the documentation is available in the table.

+

A mapping of the architectural components to the implementation +components is available in the table.

@@ -2878,15 +2878,15 @@

System Components

- + - + - + @@ -2906,7 +2906,7 @@

System Components

- + diff --git a/version0.6/developer/system/current-status.html b/version0.6/developer/system/current-status.html index 33056ae8c..c32dae914 100644 --- a/version0.6/developer/system/current-status.html +++ b/version0.6/developer/system/current-status.html @@ -2855,7 +2855,7 @@

🧑‍💻library microservice which +There is also a library microservice which in the long-run will replace the file server.

Users can run DTs in their workspaces and also permit remote access to other users. There is already shared access to internal and diff --git a/version0.6/search/search_index.json b/version0.6/search/search_index.json index 6e2cb10a1..0cd65f4b7 100644 --- a/version0.6/search/search_index.json +++ b/version0.6/search/search_index.json @@ -1 +1 @@ -{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"]},"docs":[{"location":"index.html","title":"What is DTaaS?","text":"

The Digital Twin as a Service (DTaaS) software platform is useful to Build, Use and Share digital twins (DTs).

Build: DTs are built on DTaaS using reusable DT assets available on the platform.

Use: Run your DTs on DTaaS.

Share: Share ready-to-use DTs with other users. It is also possible to share the services offered by one DT with other users.

There is an overview of DTaaS available in the form of slides, video, and feature walkthrough.

"},{"location":"index.html#license","title":"License","text":"

This software is owned by The INTO-CPS Association and is available under the INTO-CPS License.

DTaaS software platform uses third-party open-source software. These software components have their own licenses.

"},{"location":"FAQ.html","title":"Frequently Asked Questions","text":""},{"location":"FAQ.html#abreviations","title":"Abreviations","text":"Term Full Form DT Digital Twin DTaaS Digital Twin as a Service PT Physical Twin"},{"location":"FAQ.html#general-questions","title":"General Questions","text":"What is DTaaS?

DTaaS is software platform on which you can create and run digital twins. Please see the features page to get a sense of the things you can do in DaaS.

What is the scope and current capabilities of DTaaS?
  1. DTaaS is a web based interface to allow you to invoke various tools related to work you want to perform with one or more DTs.
  2. DTaaS permits users to run DTs in their private workspaces. These user workspaces are based on Ubuntu 20.04 Operating system.
  3. DTaaS can help you create reusable DT assets only if DT asset authoring tools can work in Ubuntu 20.04 xfce desktop environment.
  4. DTs are just executables, as far as DTaaS is concerned. Users are not constrained to work with DTs in a certain way. The DTaaS suggests creation of DTs from reusable assets and provides a suggestive structure for DTs. The examples provide more insight into DTaaS way of working with DTs. But this suggested workflow is not binding on the users.
  5. DTs can be run as services with REST API from within user workspace which can help with service-level DT composition.
What can not be done inside DTaaS?
  1. DTaaS as such won't help you to install DTs that you get from elsewhere.
  2. The current user interface of DTaaS web application is heavily reliant on the use of Jupyter lab and notebook. The Digital Twins page has Create / Execute / Analyze sections but all point to Jupyter lab. Web interface. The functionality of these pages is still under development.
  3. DTaaS does not yet have DevOps like automation capabilities.
Is there any fundamental difference between commercial solutions like Ansys Twin Builder and DTaaS?

Commercial DT platforms like Ansys Twin Builder provide tight integration between models, simulation and sensors. This leads to fewer choices in DT design and implementation. In addition, there is a limitation of vendor lockin. On the other hand, DTaas lets users separate DT into reusable assets and combine these assets in a flexible way.

Do you provide licensed software like Matlab?

Proprietary and commercially licensed software is not available by default on the software platform. But users have private workspaces which are based on Linux-based xfce Desktop environment. Users can install proprietary and commercially licensed software in their workspaces. Please see a screencast of using Matlab Simulink within the DTaaS software. The licensed software installed by one user is not available to another user.

"},{"location":"FAQ.html#digital-twin-assets","title":"Digital Twin Assets","text":"Can DTaaS be used to create new DT assets?

The core feature of DTaaS software is to help users create DTs from assets already available in the library. However, it is possible for users to take advantage of services available in their workspace to install asset authoring tools in their own workspace. These authoring tools can then be used to create and publish new assets. User workspaces are private and are not shared with other users. Thus any licensed software tools installed in their workspace is only available to them.

"},{"location":"FAQ.html#digital-twin-models","title":"Digital Twin Models","text":"Can DTaaS create new DT models?

DTaaS is not a model creation tool. You can put model creation tool inside DTaaS and create new models. The DTaaS itself does not create digital twin models but it can help users create digital twin models. You can run Linux desktop / terminal tools inside the DTaaS. So you can create models inside DTaaS and run them using tools that can run in Linux. The Windows only tools can not run in DTaaS.

How can DTaaS help to design geometric model? Does it support 3D modeling and simulation?

Well, DTaaS by itself does not produce any models. DTaaS only provides a platform and an ecosystem of services to facilitate digital twins to be run as services. Since each user has a Linux OS at their disposal, they can also run digital twins that have graphical interface. In summary, DTaaS is neither a modeling nor simulation tool. If you need these kinds of tools, you need to bring them onto the platform. For example, if you need Matlab for your work, you need to bring he licensed Matlab software.

Can DTaaS support only the information models (or behavioral models) or some other kind of models?

The DTaaS as such is agnostic to the kind of models you use. DTaaS can run all kinds of models. This includes behavioral and data models. As long as you have models and the matching solvers that can run in Linux OS, you are good to go in DTaaS. In some cases, models and solvers (tools) are bundled together to form monolithic DTs. The DTaaS does not limit you from running such DTs as well. DTaaS does not provide dedicated solvers. But if you can install a solver in your workspace, then you don't need the platform to provide one.

Does it support XML-based representation and ontology representation?

Currently No. We are looking for users needing this capability. If you have concrete requirements and an example, we can discuss a way of realizing it in DTaaS.

"},{"location":"FAQ.html#communication-between-physical-twin-and-digital-twin","title":"Communication Between Physical Twin and Digital Twin","text":"How can DTaaS control the physical entity? Which technologies it uses for controlling the physical world?

At a very abstract level, there is a communication from physical entity to digital entity and back to physical entity. How this communication should happen is decided by the person designing the digital entity. The DTaaS can provide communication services that can help you do this communication with relative ease. You can use InfluxDB, RabbitMQ and Mosquitto services hosted on DTaaS for two communication between digital and physical entities.

How would you measure a physical entity like shape, size, weight, structure, chemical attributes etc. using DTaaS? Any specific technology used in this case?

The real measurements are done at physical twin which are then communicated to the digital twin. Any digital twin platform like DTaaS can only facilitate this communication of these measurements from physical twin. The DTaaS provides InfluxDB, RabbitMQ and Mosquitto services for this purpose. These three are probably most widely used services for digital twin communication. Having said that, DTaaS allows you to utilize other communication technologies and services hosted elsewhere on the Internet.

How can real-time data differ from static data and what is the procedure to identify dynamic data? Is there any UI or specific tool used here?

DTaaS can not understand the static or dynamic nature of data. It can facilitate storing names, units and any other text description of interesting quantities (weight of batter, voltage output etc). It can also store the data being sent by the physical twin. The distinction between static and dynamic data needs to be made by the user. Only metadata of the data can reveal such more information about the nature of data. A tool can probably help in very specific cases, but you need metadata. If there is a human being making this distinction, then the need for metadata goes down but does not completely go away. In some of the DT platforms supported by manufacturers, there is a tight integration between data and model. In this case, the tool itself is taking care of the metadata. The DTaaS is a generic platform which can support execution of digital twins. If a tool can be executed on a Linux desktop / commandline, the tool can be supported within DTaaS. The tool (ex. Matlab) itself can take care of the metadata requirements.

"},{"location":"FAQ.html#data-management","title":"Data Management","text":"Can DTaaS collect data directly from sensors?

Yes via platform services.

Does DTaaS support data collection from different sources like hardware, software and network? Is there any user interface or any tracking instruments used for data collection?

The DTaaS provids InfluxDB, RabbitMQ, MQTT and MongoDB services. Both the physical twin and digital twin can utilize these protocols for communication. The IoT (time-series) data can be collected using InfluxDB and MQTT broker services. There is a user interface for InfluxDB which can be used to analyze the data collected. Users can also manually upload their data files into DTaaS.

Is DTaaS able to transmit data to cloud in real time?

Yes via platform services.

Which transmission protocol does DTaaS allow?

InfluxDB, RabbitMQ, MQTT and anything else that can be used from Cloud service providers.

Does DTaaS support multisource information and combined multi sensor input data? Can it provide analysis and decision-supporting inferences?

You can store information from multiple sources. The existing InfluxDB services hosted on DTaaS already has a dedicated Influx / Flux query language for doing sensor fusion, analysis and inferences.

Which kinds of visualization technologies DTaaS can support (e.g. graphical, geometry, image, VR/AR representation)?

Graphical, geometric and images. If you need specific licensed software for the visualization, you will have to bring the license for it. DTaaS does not support AR/VR.

"},{"location":"FAQ.html#platform-native-services-on-dtaas-platform","title":"Platform Native Services on DTaaS Platform","text":"Is DTaaS able to detect the anomalies about-to-fail components and prescribe solutions?

This is the job of a digital twin. If you have a ready to use digital twin that does the job, DTaaS allows others to use your solution.

"},{"location":"FAQ.html#comparison-with-other-dt-platforms","title":"Comparison with other DT Platforms","text":"All the DT platforms seem to provide different features. Is there a comparison chart?

Here is a qualitative comparison of different DT integration platforms:

Legend: high performance (H), mid performance (M) and low performance (L)

DT Platforms License DT Development Process Connectivity Security Processing power, performance and Scalability Data Storage Visualization Modeling and Simulation Microsoft Azure DT Commercial Cloud H H H M H H H AWS IOT Greengrass Open source commercial H H H M H H H Eclipse Ditto Open source M H M H H L L Asset Administration Shell Open source H H L H M L M PTC Thingworx Commercial H H H H H M M GE Predix Commercial M H H M L M L AU's DTaaS Open source H H L L M M M

Adopted by Tanusree Roy from Table 4 and 5 of the following paper.

Ref: Naseri, F., Gil, S., Barbu, C., Cetkin, E., Yarimca, G., Jensen, A. C., ... & Gomes, C. (2023). Digital twin of electric vehicle battery systems: Comprehensive review of the use cases, requirements, and platforms. Renewable and Sustainable Energy Reviews, 179, 113280.

All the comparisons between DT platforms seems so confusing. Why?

The fundamental confusion comes from the fact that different DT platforms (Azure DT, GE Predix) provide different kind of DT capabilities. You can run all kinds of models natively in GE Predix. In fact you can run models even next to (on) PTs using GE Predix. But you cannot natively do that in Azure DT service. You have to do the leg work of integrating with other Azure services or third-party services to get the kind of capabilities that GE Predix natively provides in one interface. The takeaway is that we pick horses for the courses.

"},{"location":"FAQ.html#gdpr-concerns","title":"GDPR Concerns","text":"Does your platform adhere to GDPR compliance standards? If so, how?

The DTaaS software platform does not store any personal information of users. It only stores username to identify users and these usernames do not contain enough information to deduce the true identify of users.

Which security measures are deployed? How is data encrypted (if exists)?

The default installation requires a HTTPS terminating reverse proxy server from user to the DTaaS software installation. The administrators of DTaaS software can also install HTTPS certificates into the application. The codebase can generate HTTPS application and the users also have the option of installing their own certificates obtained from certification agencies such as LetsEncrypt.

What security measures does your cloud provider offer?

The current installation of DTaaS software runs on Aarhus University servers. The university network offers firewall access control to servers so that only permitted user groups have access to the network and physical access to the server.

How is user access controlled and authenticated?

There is a two-level authorization mechanism in place in each default installation of DTaaS. The first-level is HTTP basic authorization over secure HTTPS connection. The second-level is the OAuth PKCE authorization flow for each user. The OAuth authorization is provider by a Gitlab instance. The DTaaS does not store the account and authorization information of users.

Does you platform manage personal data? How is data classified and tagged based on the sensitivity? Who has access to the critical data?

The platform does not store personal data of users.

How are identities and roles managed within the platform?

There are two roles for users on the platform. One is the administrator and the other one is user. The user roles are managed by the administrator.

"},{"location":"LICENSE.html","title":"License","text":"

--- Start of Definition of INTO-CPS Association Public License ---

/*

*/

--- End of INTO-CPS Association Public License Header ---

The ICAPL is a public license for the INTO-CPS tool suite with three modes/alternatives (GPL, ICA-Internal-EPL, ICA-External-EPL) for use and redistribution, in source and/or binary/object-code form:

Definitions of the INTO-CPS Association Public license modes:

[This has the consequence that an external party who wishes to use the INTO-CPS Association in source form together with its own proprietary software in all cases must be a member of the INTO-CPS Association].

In all cases of usage and redistribution by recipients, the following conditions also apply:

a) Redistributions of source code must retain the above copyright notice, all definitions, and conditions. It is sufficient if the ICAPL Header is present in each source file, if the full ICAPL is available in a prominent and easily located place in the redistribution.

b) Redistributions in binary/object-code form must reproduce the above copyright notice, all definitions, and conditions. It is sufficient if the ICAPL Header and the location in the redistribution of the full ICAPL are present in the documentation and/or other materials provided with the redistribution, if the full ICAPL is available in a prominent and easily located place in the redistribution.

c) A recipient must clearly indicate its chosen usage mode of ICAPL, in accompanying documentation and in a text file ICA-USAGE-MODE.txt, provided with the distribution.

d) Contributor(s) making a Contribution to the INTO-CPS Association thereby also makes a Transfer of Contribution Copyright. In return, upon the effective date of the transfer, ICA grants the Contributor(s) a Contribution License of the Contribution. ICA has the right to accept or refuse Contributions.

Definitions:

\"Subsidiary license conditions\" means:

The additional license conditions depending on the by the recipient chosen mode of ICAPL, defined by GPL version 3.0 for GPL, and by EPL for ICA-Internal-EPL and ICA-External-EPL.

\"ICAPL\" means:

INTO-CPS Association Public License version 1.0, i.e., the license defined here (the text between \"--- Start of Definition of INTO-CPS Association Public License ---\" and \"--- End of Definition of INTO-CPS Association Public License ---\", or later versions thereof.

\"ICAPL Header\" means:

INTO-CPS Association Public License Header version 1.2, i.e., the text between \"--- Start of Definition of INTO-CPS Association Public License ---\" and \"--- End of INTO-CPS Association Public License Header ---, or later versions thereof.

\"Contribution\" means:

a) in the case of the initial Contributor, the initial code and documentation distributed under ICAPL, and

b) in the case of each subsequent Contributor: i) changes to the INTO-CPS tool suite, and ii) additions to the INTO-CPS tool suite;

where such changes and/or additions to the INTO-CPS tool suite originate from and are distributed by that particular Contributor. A Contribution 'originates' from a Contributor if it was added to the INTO-CPS tool suite by such Contributor itself or anyone acting on such Contributor's behalf.

For Contributors licensing the INTO-CPS tool suite under ICA-Internal-EPL or ICA-External-EPL conditions, the following conditions also hold:

Contributions do not include additions to the distributed Program which: (i) are separate modules of software distributed in conjunction with the INTO-CPS tool suite under their own license agreement, (ii) are separate modules which are not derivative works of the INTO-CPS tool suite, and (iii) are separate modules of software distributed in conjunction with the INTO-CPS tool suite under their own license agreement where these separate modules are merged with (weaved together with) modules of The INTO-CPS tool suite to form new modules that are distributed as object code or source code under their own license agreement, as allowed under the Additional Condition of internal distribution according to ICA-Internal-EPL and/or Additional Condition for external distribution according to ICA-External-EPL.

\"Transfer of Contribution Copyright\" means that the Contributors of a Contribution transfer the ownership and the copyright of the Contribution to the INTO-CPS Association, the INTO-CPS Association Copyright owner, for inclusion in the INTO-CPS tool suite. The transfer takes place upon the effective date when the Contribution is made available on the INTO-CPS Association web site under ICAPL, by such Contributors themselves or anyone acting on such Contributors' behalf. The transfer is free of charge. If the Contributors or the INTO-CPS Association so wish, an optional Copyright transfer agreement can be signed between the INTO-CPS Association and the Contributors.

\"Contribution License\" means a license from the INTO-CPS Association to the Contributors of the Contribution, effective on the date of the Transfer of Contribution Copyright, where the INTO-CPS Association grants the Contributors a non-exclusive, world-wide, transferable, free of charge, perpetual license, including sublicensing rights, to use, have used, modify, have modified, reproduce and or have reproduced the contributed material, for business and other purposes, including but not limited to evaluation, development, testing, integration and merging with other software and distribution. The warranty and liability disclaimers of ICAPL apply to this license.

\"Contributor\" means any person or entity that distributes (part of) the INTO-CPS tool chain.

\"The Program\" means the Contributions distributed in accordance with ICAPL.

\"The INTO-CPS tool chain\" means the Contributions distributed in accordance with ICAPL.

\"Recipient\" means anyone who receives the INTO-CPS tool chain under ICAPL, including all Contributors.

\"Licensed Third Party Distributor\" means a reseller/distributor having signed a redistribution/resale agreement in accordance with ICAPL and the INTO-CPS Association Bylaws, with a Gold Level organizational member which is not an Affiliate of the reseller/distributor, for distributing a product containing part(s) of the INTO-CPS tool suite. The Licensed Third Party Distributor shall only be allowed further redistribution to other resellers if the Gold Level member is granting such a right to it in the redistribution/resale agreement between the Gold Level member and the Licensed Third Party Distributor.

\"Affiliate\" shall mean any legal entity, directly or indirectly, through one or more intermediaries, controlling or controlled by or under common control with any other legal entity, as the case may be. For purposes of this definition, the term \"control\" (including the terms \"controlling,\" \"controlled by\" and \"under common control with\") means the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of a legal entity, whether through the ownership of voting securities, by contract or otherwise.

NO WARRANTY

EXCEPT AS EXPRESSLY SET FORTH IN THE BY RECIPIENT SELECTED SUBSIDIARY LICENSE CONDITIONS OF ICAPL, THE INTO-CPS ASSOCIATION IS PROVIDED ON AN \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is solely responsible for determining the appropriateness of using and distributing the INTO-CPS tool suite and assumes all risks associated with its exercise of rights under ICAPL , including but not limited to the risks and costs of program errors, compliance with applicable laws, damage to or loss of data, programs or equipment, and unavailability or interruption of operations.

DISCLAIMER OF LIABILITY

EXCEPT AS EXPRESSLY SET FORTH IN THE BY RECIPIENT SELECTED SUBSIDIARY LICENSE CONDITIONS OF ICAPL, NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE INTO-CPS TOOL SUITE OR THE EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

A Contributor licensing the INTO-CPS tool suite under ICA-Internal-EPL or ICA-External-EPL may choose to distribute (parts of) the INTO-CPS tool suite in object code form under its own license agreement, provided that:

a) it complies with the terms and conditions of ICAPL; or for the case of redistribution of the INTO-CPS tool suite together with proprietary code it is a dual license where the INTO-CPS tool suite parts are distributed under ICAPL compatible conditions and the proprietary code is distributed under proprietary license conditions; and

b) its license agreement: i) effectively disclaims on behalf of all Contributors all warranties and conditions, express and implied, including warranties or conditions of title and non-infringement, and implied warranties or conditions of merchantability and fitness for a particular purpose; ii) effectively excludes on behalf of all Contributors all liability for damages, including direct, indirect, special, incidental and consequential damages, such as lost profits; iii) states that any provisions which differ from ICAPL are offered by that Contributor alone and not by any other party; and iv) states from where the source code for the INTO-CPS tool suite is available, and informs licensees how to obtain it in a reasonable manner on or through a medium customarily used for software exchange.

When the INTO-CPS tool suite is made available in source code form:

a) it must be made available under ICAPL; and

b) a copy of ICAPL must be included with each copy of the INTO-CPS tool suite.

c) a copy of the subsidiary license associated with the selected mode of ICAPL must be included with each copy of the INTO-CPS tool suite.

Contributors may not remove or alter any copyright notices contained within The INTO-CPS tool suite.

If there is a conflict between ICAPL and the subsidiary license conditions, ICAPL has priority.

This Agreement is governed by the laws of Denmark. The place of jurisdiction for all disagreements related to this Agreement, is Aarhus, Denmark.

The EPL 1.0 license definition has been obtained from: http://www.eclipse.org/legal/epl-v10.html. It is also reproduced in the INTO-CPS distribution.

The GPL Version 3 license definition has been obtained from http://www.gnu.org/copyleft/gpl.html. It is also reproduced in the INTO-CPS distribution.

--- End of Definition of INTO-CPS Association Public License ---

"},{"location":"PUBLISH.html","title":"Project Documentation","text":"

This file contains instructions for creation, compilation and publication of project documentation.

The documentation system is based on Material for Mkdocs. The documentation is generated based on the configuration files:

Install Mkdocs using the following command.

pip install -r docs/requirements.txt\n
"},{"location":"PUBLISH.html#fix-linting-errors","title":"Fix Linting Errors","text":"

This project uses markdownlint linter tool for identifying the formatting issues in markdown files. Run

mdl docs\n

from top-directory of the project and fix any identified issues. This needs to be done before committing changes to the documentation.

"},{"location":"PUBLISH.html#create-documentation","title":"Create documentation","text":"

The document generation pipeline can generate both html and pdf versions of documentation.

The generation of pdf version of documentation is controlled via a shell variable.

export MKDOCS_ENABLE_PDF_EXPORT=0 #disables generation of pdf document\nexport MKDOCS_ENABLE_PDF_EXPORT=1 #enables generation of pdf document\n

The mkdocs utility allows for live editing of documentation on the developer computer.

You can add, and edit the markdown files in docs/ directory to update the documentation. There is a facility to check the status of your documentation by using:

mkdocs serve --config-file mkdocs.yml\n
"},{"location":"PUBLISH.html#publish-documentation","title":"Publish documentation","text":"

You can compile and place the html version of documentation on the webpage-docs branch of the codebase.

export MKDOCS_ENABLE_PDF_EXPORT=1 #enable generation of pdf document\nsource script/docs.sh [version]\n

The command takes an optional version parameter. This version parameter is needed for making a release. Otherwise, the documentation gets published with the latest version tag. This command makes a new commit on webpage-docs branch. You need to push the branch to upstream.

git push webpage-docs\n

The github pages system serves the project documentation from this branch.

"},{"location":"bugs.html","title":"Few issues in the Software","text":"

If you find a bug, please open an issue

"},{"location":"bugs.html#third-party-software","title":"Third-Party Software","text":"

The explanation given below corresponds to the bugs you may face from third party software included in DTaaS. Known issues are listed below.

"},{"location":"bugs.html#ml-workspace","title":"ML Workspace","text":""},{"location":"bugs.html#gitlab","title":"Gitlab","text":""},{"location":"thanks.html","title":"Contributors","text":"

code contributors

"},{"location":"thanks.html#users","title":"Users","text":"

Cl\u00e1udio \u00c2ngelo Gon\u00e7alves Gomes, Dmitri Tcherniak, Elif Ecem Bas, Farshid Naseri, Giuseppe Abbiati, Hannes Iven, Hao Feng, Henrik Ejersbo, Lars Vosteen, Lei Zhao, Mirgita Frasheri, Morten Haahr Kristensen, Neena Goveas, Tanusree Roy, Santiago Gil Arboleda, Swarup Mahato, Valdemar Tang

"},{"location":"thanks.html#example-contributors","title":"Example Contributors","text":"Example Name Contributors Mass Spring Damper Prasad Talasila Water Tank Fault Injection Henrik Ejersbo and Mirgita Frasheri Water Tank Model Swap Henrik Ejersbo and Mirgita Frasheri Desktop Robotti with RabbitMQ Mirgita Frasheri Water Treatment Plant and OPC-UA Lucia Royo and Alejandro Labarias Three Water Tanks with DT Manager Framework Santiago Gil Arboleda Flex-Cell with Two Industrial Robots Santiago Gil Arboleda Incubator Morten Haahr Kristensen Firefighters in Emergency Environments Lars Vosteen and Hannes Iven Mass Spring Damper with NuRV Runtime Monitor Alberto Bonizzi Incubator with NuRV Runtime Monitor Alberto Bonizzi and Morten Haahr Kristensen Incubator with NuRV Runtime Monitor Service Valdemar Tang Water Tank Fault Injection with NuRV Runtime Monitor Alberto Bonizzi Incubator Co-Simulation with NuRV Runtime Monitor FMU Morten Haahr Kristensen Incubator with NuRV Runtime Monitor FMU as Service Valdemar Tang and Morten Haahr Kristensen Incubator with NuRV Runtime Monitor as Service Morten Haahr Kristensen and Valdemar Tang"},{"location":"thanks.html#documentation","title":"Documentation","text":"
  1. Talasila, P., Gomes, C., Mikkelsen, P. H., Arboleda, S. G., Kamburjan, E., & Larsen, P. G. (2023). Digital Twin as a Service (DTaaS): A Platform for Digital Twin Developers and Users arXiv preprint arXiv:2305.07244.
  2. Astitva Sehgal for developer and example documentation.
  3. Tanusree Roy and Farshid Naseri for asking interesting questions that ended up in FAQs.
"},{"location":"third-party.html","title":"Third Party Software","text":"

The DTaaS software platform uses many third-party software. These software components have their own licenses.

"},{"location":"third-party.html#user-installations","title":"User Installations","text":"

The list of software included with DTaaS installation scripts are:

Software Package Usage License docker v24.0 mandatory Apache 2.0 ml-workspace-minimal v0.13 mandatory Apache 2.0 nodejs v20.10 mandatory Custom - Modified MIT npm v10.2 mandatory Artistic License 2.0 serve mandatory MIT Tr\u00e6fik v2.10 mandatory MIT yarn v1.22 mandatory BSD 2-Clause eclipse-mosquitto v2 optional Eclipse Public License-2.0 gitlab-ce v16.4 optional MIT Grafana v10.1 optional GNU Affero General Public (AGPL) License v3.0 InfluxDB v2.7 optional Apache2, MIT Mongodb v7.0 optional AGPL License and Server Side Public License (SSPL) v1 Tabbitmq v3-management optional Mozilla Public License Telegraf v1.28 optional MIT"},{"location":"third-party.html#development-environments","title":"Development Environments","text":"

Inaddition to all the software included in user installations, the DTaaS development environments may use the following additional software packages.

Software Package Usage License Material for mkdocs mandatory MIT Docker-compose v2.20 optional Apache 2.0 Jupyter Lab optional 3-Clause BSD Microk8s v1.27 optional Apache 2.0 Openssl optional Custom License"},{"location":"third-party.html#package-dependencies","title":"Package Dependencies","text":"

There are specific software packages included in the development of client, library microservice and runner microservice. These packages can be seen in the package.json file of the matching directories.

The plugins of material for mkdocs might have their own licenses. The list of plugins used are in requirements.txt file.

"},{"location":"admin/cli.html","title":"DTaaS Command Line Interface","text":"

This is a command line tool for the INTO-CPS-Association Digital Twins as a Service.

"},{"location":"admin/cli.html#prerequisite","title":"Prerequisite","text":"

The DTaaS application with base users and essential containers should be up and running before using the CLI.

"},{"location":"admin/cli.html#installation","title":"Installation","text":"

Simply install using:

We recommend installing this in a virutal environment.

Steps to install:

cd <DTaaS-directory>/cli\n
pip install dtaas\n
"},{"location":"admin/cli.html#usage","title":"Usage","text":""},{"location":"admin/cli.html#setup","title":"Setup","text":"

The base DTaaS system should be up and running before adding/deleting users with the CLI.

Additionally, Setup the dtaas.toml file in the cli directory:

[common]\n# absolute path to the DTaaS application directory\nserver-dns = \"localhost\"\npath = \"/home/Desktop/DTaaS\"\n
"},{"location":"admin/cli.html#select-template","title":"Select Template","text":"

The cli uses YAML templates provided in this directory to create new user workspaces. The templates are:

  1. user.local.yml: localhost installation
  2. User.server.yml: multi-user web application application over HTTP
  3. user.server.secure.yml: multi-user web application application over HTTPS

Please note that the cli is not capable of detecting the difference between HTTP and HTTPS modes of web application. Thus if you are serving web application over HTTPS, please do one extra step.

cp user.server.secure.yml user.server.yml\n

This will change the user template from insecure to secure.

"},{"location":"admin/cli.html#add-users","title":"Add users","text":"

To add new users using the CLI, fill in the users.add list in dtaas.toml with the Gitlab instance usernames of the users to be added

[users]\n# matching user info must present in this config file\nadd = [\"username1\",\"username2\", \"username3\"]\n

Make sure you are in the cli directory.

Then simply:

dtaas admin user add\n

The command checks for the existence of files/<username> directory. If it does not exist, a new directory with correct file structure is created. The directory, if it exists, must be owned by the user executing dtaas command on the host operating system. If the files do not have the expected ownership rights, the command fails.

"},{"location":"admin/cli.html#caveats","title":"Caveats","text":"

This brings up the containers, without the AuthMS authentication.

cd <DTaaS>/deploy/docker\n
rule.onlyu3.action=auth\nrule.onlyu3.rule=PathPrefix(`/user3`)\nrule.onlyu3.whitelist = user3@emailservice.com\n
docker compose -f compose.server.yml --env-file .env up -d --force-recreate traefik-forward-auth\n

The new users are now added to the DTaaS instance, with authorization enabled.

"},{"location":"admin/cli.html#delete-users","title":"Delete users","text":" 
[users]\n# matching user info must present in this config file\ndelete = [\"username1\",\"username2\", \"username3\"]\n

Then simply:

dtaas admin user delete\n
"},{"location":"admin/cli.html#additional-points-to-remember","title":"Additional Points to Remember","text":""},{"location":"admin/host.html","title":"Install DTaaS on a Production Server","text":"

The installation instructions provided in this README are ideal for hosting the DTaaS as web application for multiple users.

"},{"location":"admin/host.html#design","title":"Design","text":"

An illustration of the docker containers used and the authorization setup is shown here.

In the new application configuration, there are two OAuth2 applications.

"},{"location":"admin/host.html#requirements","title":"Requirements","text":"

The installation requirements to run this docker version of the DTaaS are:

"},{"location":"admin/host.html#docker-with-compose-plugin","title":"Docker with Compose Plugin","text":"

It is mandatory to have Docker installed on your computer. We highly recommend using Docker Desktop.

"},{"location":"admin/host.html#domain-name","title":"Domain name","text":"

The DTaaS software is a web application and is preferably hosted on a server with a domain name like foo.com. It is also possible to use an IP address in place of domain name.

"},{"location":"admin/host.html#tls-https-certificate-optional","title":"TLS / HTTPS Certificate (Optional)","text":"

It is possible to add HTTPS option to the DTaaS software installation. Creation of the required TLS certificates is possible through certbot.

"},{"location":"admin/host.html#oauth-provider","title":"OAuth Provider","text":"

Gitlab Instance - The DTaaS uses Gitlab OAuth2.0 authorization for user authorization. You can either have an on-premise instance of gitlab, or use gitlab.com itself.

"},{"location":"admin/host.html#user-accounts","title":"User Accounts","text":"

Create user accounts in a linked gitlab instance for all the users.

The default docker compose file contains two - user1 and user2. These names need to be changed to suitable usernames.

"},{"location":"admin/host.html#oauth2-application-registration","title":"OAuth2 Application Registration","text":"

The multi-user installation setup requires dedicated authorization setup for both frontend website and backend services. Both these authorization requirements are satisfied using OAuth2 protocol.

It is possible to use https://gitlab.com or a local installation of Gitlab can be used for this purpose. Based on your selection of gitlab instance, it is necessary to register these two OAuth2 applications and link them to your intended DTaaS installation.

Please see gitlab oauth provider documentation for further help with creating these two OAuth applications.

"},{"location":"admin/host.html#download-release-package","title":"Download Release Package","text":"

The software is available for as zip package. Please download and unzip the same. A new DTaaS-v0.6.0 folder gets created. The rest of the installation instructions assume that you are using Windows/Linux/MacOS terminal in DTaaS-v0.6.0 folder.

Tip

  1. The filepaths shown here follow Linux OS. The installation procedures also work with Windows OS.
  2. The description below refers to filenames. All the file paths mentioned below are relatively to the top-level DTaaS directory.
"},{"location":"admin/host.html#configuration","title":"Configuration","text":"

Three following configuration files need to be updated.

"},{"location":"admin/host.html#docker-compose","title":"Docker Compose","text":"

The docker compose configuration is in deploy/docker/.env.server. it is a sample file. It contains environment variables that are used by the docker compose files. It can be updated to suit your local installation scenario. It contains the following environment variables.

Edit all the fields according to your specific case.

URL Path Example Value Explanation DTAAS_DIR '/Users/username/DTaaS' Full path to the DTaaS directory. This is an absolute path with no trailing slash. SERVER_DNS foo.com The server DNS, if you are deploying with a dedicated server. Remember not use http(s) at the beginning of the DNS string OAUTH_URL gitlab.foo.com The URL of your Gitlab instance. It can be gitlab.com if you are planning to use it for authorization. OAUTH_CLIENT_ID 'xx' The ID of your server OAuth application OAUTH_CLIENT_SECRET 'xx' The Secret of your server OAuth application OAUTH_SECRET 'random-secret-string' Any private random string. This is a password you choose for local installation. username1 'user1' The gitlab instance username of a user of DTaaS username2 'user2' The gitlab instance username of a user of DTaaS

Tip

Important points to note:

  1. The path examples given here are for Linux OS. These paths can be Windows OS compatible paths as well.
  2. The client configuration file is located at deploy/config/client/env.js.
  3. The Server DNS can also be an IP address. However, for proper working it is neccessary to use the same convention (IP/DNS) in the client configuration file as well.
"},{"location":"admin/host.html#website-client","title":"Website Client","text":"

The frontend React website requires configuration which is specified in the client configuration file (deploy/config/client/env.js).

Further explanation on the client configuration is available in client config.

Tip

There is a default OAuth application registered on https://gitlab.com for client. The corresponding OAuth application details are:

REACT_APP_CLIENT_ID: '1be55736756190b3ace4c2c4fb19bde386d1dcc748d20b47ea8cfb5935b8446c',\nREACT_APP_AUTH_AUTHORITY: 'https://gitlab.com/',\n

This can be used for test purposes. Please use your own OAuth application for secure production deployments.

"},{"location":"admin/host.html#create-user-workspace","title":"Create User Workspace","text":"

The existing filesystem for installation is setup for files/user1. A new filesystem directory needs to be created for the selected user.

Please execute the following commands from the top-level directory of the DTaaS project.

cp -R files/user1 files/username\n

where username is one of the selected usernames. This command needs to be repeated for all the selected users.

"},{"location":"admin/host.html#configure-authorization-rules-for-backend-authorization","title":"Configure Authorization Rules for Backend Authorization","text":"

The Traefik forward-auth microservices requires configuration rules to manage authorization for different URL paths. The deploy/docker/conf.server file can be used to configure the authorization for user workspaces.

rule.onlyu1.action=auth\nrule.onlyu1.rule=Path(`/user1`)\nrule.onlyu1.whitelist = user1@localhost\n\nrule.onlyu1.action=auth\nrule.onlyu1.rule=Path(`/user2`)\nrule.onlyu1.whitelist = user2@localhost\n

Please change the usernames and email addresses to the matching user accounts on the OAuth provider (either https://gitlab.foo.com or https://gitlab.com).

"},{"location":"admin/host.html#caveat","title":"Caveat","text":"

The usernames in the deploy/docker/.env.server file need to match those in the deploy/docker/conf.server file.

Traefik routes are controlled by the deploy/docker/.env.server file. Authorization on these routes is controlled by the deploy/docker/conf.server file. If a route is not specified in deploy/docker/conf.server file but an authorisation is requested by traefik for this unknown route, the default behavior of traefik forward-auth kicks in. This default behavior is to enable endpoint being available to any signed in user.

If there are extra routes in deploy/docker/conf.server file but these are not in deploy/docker/.env.server file, such routes are not served by traefik; it will give 404 server response.

"},{"location":"admin/host.html#access-rights-over-files","title":"Access Rights Over Files","text":"

Warning

The default setting in docker compose file exposes all user files at http://foo.com/lib/files. All files of all the users are readable-writable by all logged in users. The compose.server.yml / compose.server.secure.yml file needs to be updated to expose another directory like common assets directory.

If you wish to reduce this scope to only common assets, please change,

  libms:\n    image: intocps/libms:latest\n    restart: unless-stopped\n    volumes:\n      - ${DTAAS_DIR}/deploy/config/lib.env:/dtaas/libms/.env\n      - ${DTAAS_DIR}/files/common:/dtaas/libms/files\n

The change in the last line. The ${DTAAS_DIR}/files got replaced by ${DTAAS_DIR}/files/common. With this change, only common files are readable-writable by all logged in users.

"},{"location":"admin/host.html#add-tls-certificates-optional","title":"Add TLS Certificates (Optional)","text":"

The application can be served on HTTPS connection for which TLS certificates are needed. The certificates need to be issued for foo.com or *.foo.com. The names of the certificates must be fullchain.pem and privkey.pem. Copy these two certificate files into:

Traefik will run with self-issued certificates if the above two certificates are either not found or found invalid.

Remember to update dynamic/tls.yml with correct path matching your DNS name. For example, if your DNS name is www.foo.com, then copy the TLS certificates of www.foo.com to certs/ directory and update dynamic/tls.yml as follows.

tls:\n  certificates:\n    - certFile: /etc/traefik-certs/www.foo.com/fullchain.pem\n      keyFile: /etc/traefik-certs/www.foo.com/privkey.pem\n      stores:\n        - default\n
"},{"location":"admin/host.html#run","title":"Run","text":""},{"location":"admin/host.html#over-http","title":"Over HTTP","text":"

This docker compose file serves application over HTTP.

The commands to start and stop the appliation are:

docker compose -f compose.server.yml --env-file .env.server up -d\ndocker compose -f compose.server.yml --env-file .env.server down\n

To restart only a specific container, for example `client``

docker compose -f compose.server.yml --env-file .env.server up -d --force-recreate client\n
"},{"location":"admin/host.html#over-https","title":"Over HTTPS","text":"

This docker compose file serves application over HTTP.

The commands to start and stop the appliation are:

docker compose -f compose.server.secure.yml --env-file .env.server up -d\ndocker compose -f compose.server.secure.yml --env-file .env.server down\n

To restart only a specific container, for example `client``

docker compose -f compose.server.secure.yml --env-file .env.server up -d --force-recreate client\n
"},{"location":"admin/host.html#use","title":"Use","text":"

The application will be accessible at: from web browser. Sign in using your account linked to either gitlab.com or your local gitlab instance.

All the functionality of DTaaS should be available to your users through the single page client now.

You may have to click Sign in to Gitlab on the Client page and authorize access to the shown application.

"},{"location":"admin/host.html#adding-a-new-user","title":"Adding a new user","text":"

Please see the add new user to add new users.

"},{"location":"admin/host.html#references","title":"References","text":"

Image sources: Traefik logo, ml-workspace, reactjs, gitlab

"},{"location":"admin/localhost-secure.html","title":"Install DTaaS on localhost with Gitlab Integration","text":"

This installation is ideal for single users intending to use DTaaS on their own computers.

The installation instructions provided in this README are ideal for running the DTaaS on localhost served over HTTPS connection. The intention is to integrate Gitlab into DTaaS so that both are running on localhost.

If you do not need gitlab running on localhost, please use the simpler localhost setup.

"},{"location":"admin/localhost-secure.html#design","title":"Design","text":"

An illustration of the docker containers used and the authorization setup is shown here.

"},{"location":"admin/localhost-secure.html#requirements","title":"Requirements","text":"

The installation requirements to run this docker version of the DTaaS are:

"},{"location":"admin/localhost-secure.html#download-release-package","title":"Download Release Package","text":"

The software is available for as zip package. Please download and unzip the same. A new DTaaS-v0.6.0 folder gets created. The rest of the installation instructions assume that you are using Windows/Linux/MacOS terminal in DTaaS-v0.6.0 folder.

file pathnames

  1. The filepaths shown here follow POSIX convention. The installation procedures also work with Windows paths.
  2. The description below refers to filenames. All the file paths mentioned below are relatively to the top-level DTaaS directory.
"},{"location":"admin/localhost-secure.html#configure-and-run","title":"Configure and Run","text":""},{"location":"admin/localhost-secure.html#create-user-workspace","title":"Create User Workspace","text":"

The existing filesystem for installation is setup for user1. A new filesystem directory needs to be created for the selected user.

Please execute the following commands from the top-level directory of the DTaaS project.

cp -R files/user1 files/username\n

where username is the selected username to be created (in next steps) on Gitlab running at https://localhost/gitlab.

"},{"location":"admin/localhost-secure.html#obtain-tls-https-certificate","title":"Obtain TLS / HTTPS Certificate","text":"

Use mkcert to generate TLS certificates using this guide. The certificates need to be generated for localhost.

The names of the certificates must be fullchain.pem and privkey.pem. The fullchain.pem corresponds to public certificate and the privkey.pem corresponds to private key.

"},{"location":"admin/localhost-secure.html#add-tls-certificates-to-traefik","title":"Add TLS Certificates to Traefik","text":"

Copy the two certificate files into:

Traefik will run with self-issued certificates if the above two certificates are either not found or found invalid.

"},{"location":"admin/localhost-secure.html#configure-docker-compose","title":"Configure Docker Compose","text":"

The docker compose configuration is in deploy/docker/.env.local; it is a sample file. It contains environment variables that are used by the docker compose files. It can be updated to suit your local installation scenario. It contains the following environment variables.

Edit all the fields according to your specific case.

URL Path Example Value Explanation DTAAS_DIR '/home/Desktop/DTaaS' Full path to the DTaaS directory. This is an absolute path with no trailing slash. username1 'user1' Your gitlab username

Important points to note:

  1. The path examples given here are for Linux OS. These paths can be Windows OS compatible paths as well.
  2. The client configuration file is located at deploy/config/client/env.local.js. Edit the URLs in this file by replacing http with https. Beyond this, it is not necessary to modify this file.
"},{"location":"admin/localhost-secure.html#start-dtaas-to-integrate-gitlab","title":"Start DTaaS to Integrate Gitlab","text":"

Start the appliation with

docker compose -f compose.local.secure.yml --env-file .env.local up -d\n
"},{"location":"admin/localhost-secure.html#start-gitlab","title":"Start Gitlab","text":"

Use the instructions provided in gitlab integration to bring up Gitlab on localhost and the Gitlab service will be available at https://localhost/gitlab

"},{"location":"admin/localhost-secure.html#register-oauth2-application","title":"Register OAuth2 Application","text":"

The frontend website requires OAuth2 application registration on the integrated Gitlab. The details of Oauth2 app for the frontend website are in client docs.

The default OAuth client application provided in env.local.js works. However, if you intend to run an integrated gitlab instance, then this application needs to be created on gitlab running at https://localhost/gitlab.

Remember to use https://localhost/Library as the Callback URL (REACT_APP_REDIRECT_URI).

Please see gitlab oauth provider documentation for further help with creating this OAuth application.

"},{"location":"admin/localhost-secure.html#update-client-website-configuration","title":"Update Client Website Configuration","text":"

Replace the contents of deploy/config/client/env.local.js with the following.

if (typeof window !== 'undefined') {\n  window.env = {\n    REACT_APP_ENVIRONMENT: 'local',\n    REACT_APP_URL: 'https://localhost/',\n    REACT_APP_URL_BASENAME: '',\n    REACT_APP_URL_DTLINK: '/lab',\n    REACT_APP_URL_LIBLINK: '',\n    REACT_APP_WORKBENCHLINK_VNCDESKTOP: '/tools/vnc/?password=vncpassword',\n    REACT_APP_WORKBENCHLINK_VSCODE: '/tools/vscode/',\n    REACT_APP_WORKBENCHLINK_JUPYTERLAB: '/lab',\n    REACT_APP_WORKBENCHLINK_JUPYTERNOTEBOOK: '',\n\n    REACT_APP_CLIENT_ID: 'xxxxxx',\n    REACT_APP_AUTH_AUTHORITY: 'https://localhost/gitlab/',\n    REACT_APP_REDIRECT_URI: 'https://localhost/Library',\n    REACT_APP_LOGOUT_REDIRECT_URI: 'https://localhost/',\n    REACT_APP_GITLAB_SCOPES: 'openid profile read_user read_repository api',\n  };\n};\n

And then update OAuth2 client application ID (REACT_APP_CLIENT_ID) with that of the newly registered OAuth2 application.

"},{"location":"admin/localhost-secure.html#restart-dtaas-client-website","title":"Restart DTaaS Client Website","text":"

To update the client website configuration, run

docker compose -f compose.local.secure.yml --env-file .env.local up -d --force-recreate client\n
"},{"location":"admin/localhost-secure.html#use","title":"Use","text":"

The application will be accessible at: https://localhost from web browser. Sign in using your https://localhost/gitlab account.

All the functionality of DTaaS should be available to you through the single page client now.

"},{"location":"admin/localhost-secure.html#limitations","title":"Limitations","text":"

The library microservice is not included in the localhost installation scenario.

"},{"location":"admin/localhost-secure.html#docker-help","title":"Docker Help","text":"

The commands to start and stop the appliation are:

docker compose -f compose.local.secure.yml --env-file .env.local up -d\ndocker compose -f compose.local.secure.yml --env-file .env.local down\n

To restart only a specific container, for example client

docker compose -f compose.local.secure.yml --env-file .env.local up -d --force-recreate client\n
"},{"location":"admin/localhost-secure.html#references","title":"References","text":"

Image sources: Traefik logo, ml-workspace, reactjs, gitlab

"},{"location":"admin/localhost.html","title":"Install DTaaS on localhost","text":"

The installation instructions provided in this README are ideal for running the DTaaS on both localhost. This installation is ideal for single users intending to use DTaaS on their own computers.

"},{"location":"admin/localhost.html#design","title":"Design","text":"

An illustration of the docker containers used and the authorization setup is shown here.

"},{"location":"admin/localhost.html#requirements","title":"Requirements","text":"

The installation requirements to run this docker version of the DTaaS are:

Tip

The frontend website requires authorization. The default authorization configuration works for gitlab.com. If you desire to use locally hosted gitlab instance, please see the client docs.

"},{"location":"admin/localhost.html#download-release-package","title":"Download Release Package","text":"

The software is available for as zip package. Please download and unzip the same. A new DTaaS-v0.6.0 folder gets created. The rest of the installation instructions assume that you are using Windows/Linux/MacOS terminal in DTaaS-v0.6.0 folder.

Tip

  1. The filepaths shown here follow POSIX convention. The installation procedures also work with Windows paths.
  2. The description below refers to filenames. All the file paths mentioned below are relatively to the top-level DTaaS directory.
"},{"location":"admin/localhost.html#configuration","title":"Configuration","text":""},{"location":"admin/localhost.html#docker-compose","title":"Docker Compose","text":"

The docker compose configuration is in deploy/docker/.env.local; it is a sample file. It contains environment variables that are used by the docker compose files. It can be updated to suit your local installation scenario. It contains the following environment variables.

Edit all the fields according to your specific case.

URL Path Example Value Explanation DTAAS_DIR '/home/Desktop/DTaaS' Full path to the DTaaS directory. This is an absolute path with no trailing slash. username1 'user1' Your gitlab username

Tip

Important points to note:

  1. The path examples given here are for Linux OS. These paths can be Windows OS compatible paths as well.
  2. The client configuration file is located at deploy/config/client/env.local.js. If you are following the guide to use HTTPS on localhost, edit the URLs in this file by replacing http with https. Beyond this, it is not necessary to modify this file.
"},{"location":"admin/localhost.html#create-user-workspace","title":"Create User Workspace","text":"

The existing filesystem for installation is setup for user1. A new filesystem directory needs to be created for the selected user.

Please execute the following commands from the top-level directory of the DTaaS project.

cp -R files/user1 files/username\n

where username is the selected username registered on https://gitlab.com.

"},{"location":"admin/localhost.html#run","title":"Run","text":"

The commands to start and stop the appliation are:

docker compose -f compose.local.yml --env-file .env.local up -d\ndocker compose -f compose.local.yml --env-file .env.local down\n

To restart only a specific container, for example `client``

docker compose -f compose.local.yml --env-file .env.local up -d --force-recreate client\n
"},{"location":"admin/localhost.html#use","title":"Use","text":"

The application will be accessible at: http://localhost from web browser. Sign in using your https://gitlab.com account.

All the functionality of DTaaS should be available to you through the single page client now.

"},{"location":"admin/localhost.html#limitations","title":"Limitations","text":"

The library microservice is not included in the localhost installation scenario.

"},{"location":"admin/localhost.html#references","title":"References","text":"

Image sources: Traefik logo, ml-workspace, reactjs, gitlab

"},{"location":"admin/overview.html","title":"Overview","text":""},{"location":"admin/overview.html#install","title":"Install","text":"

The goal is to install and administer the DTaaS application for users.

The DTaaS can be installed in different ways. Each version serves a different purpose.

Easy Setup on Localhost

The localhost installation is easy for first time users. Please give it a try.

Otherwise, use the installation setup that fits your needs.

Installation Setup Purpose localhost Install DTaaS on your computer for a single user; does not need a web server. This setup does not require domain name. secure localhost Install DTaaS on your computer for a single user over HTTPS with integrated gitlab installation; does not need a web server. This setup does not require domain name. Server Install DTaaS on server for multiple users. Please check the requirements. It is also possible to host the application over HTTPS with integrated gitlab installation One vagrant machine Install DTaaS on a virtual machine; can be used for single or multiple users. Two vagrant machines Install DTaaS on two virtual machines; can be used for single or multiple users. The core DTaaS application is installed on the first virtual machine and all the services (RabbitMQ, MQTT, InfluxDB, Grafana and MongoDB) are installed on second virtual machine. Independent Packages Can be used independently; do not need full installation of DTaaS.

The installation steps is a good place to start the installation process.

"},{"location":"admin/overview.html#administer","title":"Administer","text":"

There is a CLI to add and delete users of a running application.

"},{"location":"admin/packages.html","title":"Independent Packages","text":"

The DTaaS development team publishes reusable packages which are then put together to form the complete DTaaS application.

The packages are published on github, npmjs, and docker hub repositories.

The packages on github are published more frequently but are not user tested. The packages on npmjs and docker hub are published at least once per release. The regular users are encouraged to use the packages from npm and docker hub.

A brief explanation of the packages is given below.

Package Name Description Documentation for Availability dtaas-web React web application Not useful as standalone package docker hub and github libms Library microservice npm package npmjs and github container image docker hub and github runner REST API wrapper for multiple scripts/programs npm package npmjs and github ml-workspace-minimal (fork of ml-workspace) User workspace not available docker hub. Please note that this package is highly experimental and only v0.15.0-b2 is usable now."},{"location":"admin/requirements.html","title":"Requirements","text":"

Tip

These optional requirements are not needed for localhost installation. They are only required for installation of the DTaaS on a production web server.

There are two optional requirements for installing the DTaaS.

"},{"location":"admin/requirements.html#oauth-provider","title":"OAuth Provider","text":"

The DTaaS software is uses OAuth for user authorization. It is possible to use either gitlab.com or your own OAuth service provider.

"},{"location":"admin/requirements.html#domain-name","title":"Domain name","text":"

The DTaaS software is a web application and is preferably hosted on a server with a domain name like foo.com. However, it is possible to install the software on your computer and use access it at localhost.

"},{"location":"admin/services.html","title":"Third-party Services","text":"

The DTaaS software platform uses third-party software services to provide enhanced value to users.

InfluxDB, Grafana, RabbitMQ and Mosquitto are default services integrated into the DTaaS software platform.

"},{"location":"admin/services.html#pre-requisites","title":"Pre-requisites","text":"

All these services run on raw TCP/UDP ports. Thus a direct network access to these services is required for both the DTs running inside the DTaaS software and the PT located outside the DTaaS software.

There are two possible choices here:

Unless you are an informed user of Traefik, we recommend bypassing traefik and provide raw TCP/UDP access to these services from the Internet.

The InfluxDB service requires a dedicated hostname. The management interface of RabbitMQ service requires a dedicated hostname as well.

Grafana service can run well behind Traefik gateway. The default Traefik configuration makes permits access to Grafana at URL: http(s): foo.com/vis.

"},{"location":"admin/services.html#configure-and-install","title":"Configure and Install","text":"

The software is available for as zip package. Please download and unzip the same. A new DTaaS-v0.6.0 folder gets created. The rest of the installation instructions assume that you are using Windows/Linux/MacOS terminal in DTaaS-v0.6.0 folder.

The next step in installation is to specify the config of the services. There are two configuration files. The services.yml contains most of configuration settings. The mqtt-default.conf file contains the MQTT listening port. Update these two config files before proceeding with the installation of the services.

Now continue with the installation of services.

yarn install\nnode services.js\n
"},{"location":"admin/services.html#use","title":"Use","text":"

After the installation is complete, you can see the following services active at the following ports / URLs.

service external url Influx services.foo.com Grafana services.foo.com:3000 RabbitMQ Broker services.foo.com:5672 RabbitMQ Broker Management Website services.foo.com:15672 MQTT Broker services.foo.com:1883 MongoDB database services.foo.com:27017

The firewall and network access settings of corporate / cloud network need to be configured to allow external access to the services. Otherwise the users of DTaaS will not be able to utilize these services from their user workspaces.

"},{"location":"admin/steps.html","title":"Installation Steps","text":""},{"location":"admin/steps.html#complete-dtaas-application","title":"Complete DTaaS Application","text":"

DTaaS application is available in two flavors. One is localhost which is suitable for single-user, local usage. Another is production server which is suitable for multi-user setup.

In both cases, the installation is a three step process.

"},{"location":"admin/steps.html#setup-authorization","title":"Setup Authorization","text":"

DTaaS provides security using OAuth authorization for both react client frontend and backend services.

There is a default frontend authorization application setup for all localhost and backend authorization is not required for localhost installation.

The production server installation requires both react client frontend and backend services applications.

"},{"location":"admin/steps.html#configure-components","title":"Configure Components","text":"

DTaaS is available as docker compose application. There are four docker compose files

  1. compose.local.yml for localhost installation served over HTTP connection.
  2. compose.local.secure.yml for secure localhost installation served over HTTPS connection.
  3. compose.server.yml for production server installation served over HTTP connection.
  4. compose.server.secure.yml for production server installation served over HTTPS connection.

These four compose files require environment configuration files. The explanation of this configuration file is available directly on the installation pages.

In addition, react client frontend requires configuration which is explained on this page.

"},{"location":"admin/steps.html#install","title":"Install","text":"

Follow installation instructions given on either localhost or production server pages.

"},{"location":"admin/steps.html#independent-packages","title":"Independent Packages","text":"

Each release of DTaaS also comes with release of three reusable packages. These packages have dedicated documentation.

"},{"location":"admin/client/auth.html","title":"OAuth for React Client","text":"

To enable user authorization on DTaaS React client website, you will use the OAuth authorization protocol, specifically the PKCE authorization flow. Here are the steps to get started:

1. Choose Your GitLab Server:

2. Determine Your Website's Hostname:

3. Define Callback and Logout URLs:

4. OAuth Application Creation:

5. Application ID:

6. Required Information from OAuth Application:

GitLab Variable Name Variable Name in Client env.js Default Value OAuth Provider REACT_APP_AUTH_AUTHORITY https://gitlab.foo.com/ Application ID REACT_APP_CLIENT_ID Callback URL REACT_APP_REDIRECT_URI https://foo.com/Library Scopes REACT_APP_GITLAB_SCOPES openid, profile, read_user, read_repository, api

7. Create User Accounts:

Create user accounts in gitlab for all the usernames chosen during installation. The trial installation script comes with two default usernames - user1 and user2. For all other installation scenarios, accounts with specific usernames need to be created on gitlab.

"},{"location":"admin/client/config.html","title":"Configure Client Website","text":"

This page describes various configuration options for react website.

if (typeof window !== 'undefined') {\n  window.env = {\n    REACT_APP_ENVIRONMENT: \"prod | dev | local | test\",\n    REACT_APP_URL: \"URL for the gateway\",\n    REACT_APP_URL_BASENAME: \"Base URL for the client website\"(optional, can be null),\n    REACT_APP_URL_DTLINK: \"Endpoint for the Digital Twin\",\n    REACT_APP_URL_LIBLINK: \"Endpoint for the Library Assets\",\n    REACT_APP_WORKBENCHLINK_VNCDESKTOP: \"Endpoint for the VNC Desktop link\",\n    REACT_APP_WORKBENCHLINK_VSCODE: \"Endpoint for the VS Code link\",\n    REACT_APP_WORKBENCHLINK_JUPYTERLAB: \"Endpoint for the Jupyter Lab link\",\n    REACT_APP_WORKBENCHLINK_JUPYTERNOTEBOOK:\n      \"Endpoint for the Jupyter Notebook link\",\n    REACT_APP_WORKBENCHLINK_DT_PREVIEW: \"Endpoint for the Digital Twins page preview\",\n    REACT_APP_CLIENT_ID: 'AppID genereated by the gitlab OAuth provider',\n    REACT_APP_AUTH_AUTHORITY: 'URL of the private gitlab instance',\n    REACT_APP_REDIRECT_URI: 'URL of the homepage for the logged in users of the website',\n    REACT_APP_LOGOUT_REDIRECT_URI: 'URL of the homepage for the anonymous users of the website',\n    REACT_APP_GITLAB_SCOPES: 'OAuth scopes. These should match with the scopes set in gitlab OAuth provider',\n  };\n};\n\n// Example values with no base URL. Trailing and ending slashes are optional.\nif (typeof window !== 'undefined') {\n  window.env = {\n    REACT_APP_ENVIRONMENT: 'prod',\n    REACT_APP_URL: 'https://foo.com/',\n    REACT_APP_URL_BASENAME: '',\n    REACT_APP_URL_DTLINK: '/lab',\n    REACT_APP_URL_LIBLINK: '',\n    REACT_APP_WORKBENCHLINK_VNCDESKTOP: '/tools/vnc/?password=vncpassword',\n    REACT_APP_WORKBENCHLINK_VSCODE: '/tools/vscode/',\n    REACT_APP_WORKBENCHLINK_JUPYTERLAB: '/lab',\n    REACT_APP_WORKBENCHLINK_JUPYTERNOTEBOOK: '',\n    REACT_APP_WORKBENCHLINK_DT_PREVIEW: '/preview/digitaltwins',\n    REACT_APP_CLIENT_ID: '1be55736756190b3ace4c2c4fb19bde386d1dcc748d20b47ea8cfb5935b8446c',\n    REACT_APP_AUTH_AUTHORITY: 'https://gitlab.foo.com/',\n    REACT_APP_REDIRECT_URI: 'https://foo.com/Library',\n    REACT_APP_LOGOUT_REDIRECT_URI: 'https://foo.com/',\n    REACT_APP_GITLAB_SCOPES: 'openid profile read_user read_repository api',\n  };\n};\n\n\n// Example values with \"bar\" as basename URL.\n//Trailing and ending slashes are optional.\nif (typeof window !== 'undefined') {\n  window.env = {\n    REACT_APP_ENVIRONMENT: \"dev\",\n    REACT_APP_URL: 'http://localhost:4000/',\n    REACT_APP_URL_BASENAME: 'bar',\n    REACT_APP_URL_DTLINK: '/lab',\n    REACT_APP_URL_LIBLINK: '',\n    REACT_APP_WORKBENCHLINK_VNCDESKTOP: '/tools/vnc/?password=vncpassword',\n    REACT_APP_WORKBENCHLINK_VSCODE: '/tools/vscode/',\n    REACT_APP_WORKBENCHLINK_JUPYTERLAB: '/lab',\n    REACT_APP_WORKBENCHLINK_JUPYTERNOTEBOOK: '',\n    REACT_APP_WORKBENCHLINK_DT_PREVIEW: '/preview/digitaltwins',\n    REACT_APP_CLIENT_ID: '1be55736756190b3ace4c2c4fb19bde386d1dcc748d20b47ea8cfb5935b8446c',\n    REACT_APP_AUTH_AUTHORITY: 'https://gitlab.foo.com/',\n    REACT_APP_REDIRECT_URI: 'http://localhost:4000/bar/Library',\n    REACT_APP_LOGOUT_REDIRECT_URI: 'http://localhost:4000/bar',\n    REACT_APP_GITLAB_SCOPES: 'openid profile read_user read_repository api',\n  };\n};\n
"},{"location":"admin/client/config.html#multiple-dtaas-applications","title":"Multiple DTaaS applications","text":"

Warning

This is not a regular installation scenario and is only recommended for experts. This installation setup requires significant modifications to the docker compose files.

The DTaaS is a regular web application. It is possible to host multiple DTaaS applications on the same server. The only requirement is to have a distinct URLs. You can have three DTaaS applications running at the following URLs.

https://foo.com/au\nhttps://foo.com/acme\nhttps://foo.com/bar\n

All of these instances can use the same gitlab instance for authorization.

DTaaS application URL Gitlab Instance URL Callback URL Logout URL Application ID https://foo.com/au https://foo.gitlab.com https://foo.com/au/Library https://foo.com/au autogenerated by gitlab https://foo.com/acme https://foo.gitlab.com https://foo.com/au/Library https://foo.com/au autogenerated by gitlab https://foo.com/bar https://foo.gitlab.com https://foo.com/au/Library https://foo.com/au autogenerated by gitlab

If you are hosting multiple DTaaS instances on the same server, do not install DTaaS with a null basename on the same server. Even though it works well, the setup is confusing to setup and may lead to maintenance issues.

If you choose to host your DTaaS application with a basename (say bar), then the URLs in env.js change to:

DTaaS application URL: https://foo.com/bar\nGitlab instance URL: https://gitlab.foo.com\nCallback URL: https://foo.com/bar/Library\nLogout URL: https://foo.com/bar\n
"},{"location":"admin/gitlab/index.html","title":"Install Gitlab","text":"

This guide helps with installation of a dedicated Gitlab service. This Gitlab installation can be used as OAuth2 authorization provider to the DTaaS software. In addition, it is also possible to use the integrated Gitlab for enabling the digital twin DevOps experimental features of the DTaaS.

There are two possible ways you can install Gitlab:
Service RouterTraefik GatewayTraefik Gateway
Web ApplicationReact WebapplicationReact Webapplication
Reusable AssetsLibrary MicroserviceLibrary Microservice
Digital Twins and DevOps
Digital Twins as ServicesDT RunnerDT Runner
Accounting