Skip to content

Security and privacy

Connectors

A connector is the only part of Archipelago that touches a live system. This page is the contract every connector must meet, and it applies before any specific connector exists.

What a connector may do

  • Discover devices and points in a scope you set.
  • Read values on request.
  • Subscribe to changes, by change-of-value where the protocol supports it or by polling at a rate you set.
  • Pull stored histories and alarm records by a resumable cursor, so a restart or a WAN cut loses nothing.
  • Report its own health: connected, last seen, backlog, errors.

What a connector may not do

  • Write to a device, a point, or a configuration. Writing is a separate interface no early connector implements; the connector's descriptor declares write: false and the interface shows no write control.
  • Open arbitrary connections. A connector talks only to the addresses and ports you configured.
  • Accept inbound connections from outside the site. Where a vendor-side agent is involved, the agent dials out; nothing listens for the internet.
  • Read anything it was not asked to read. Discovery scope and subscription sets are explicit.

Specific connectors, as planned

BACnet/IP
Who-Is, ReadProperty, ReadPropertyMultiple, SubscribeCOV, ReadRange on Trend Logs. The WriteProperty service is not compiled into the default build. Planned, Phase 3.
Modbus TCP, RTU
Read registers per a map you supply; serial runs in a child process. No write function codes in the default build. Planned, Phase 4.
Niagara station
First through documented, read-only station services (BACnet server export, oBIX, Haystack); a signed module of our own only if those cannot deliver histories and alarm records, and only after legal review. If a module ships: outbound only, allowlisted message types, no write actions, bounded memory and queues, status visible in the station, uninstall leaves nothing but its own component. Planned; timing pending legal review.

Permissions it needs

The least that reads: a read-only network position for BACnet and Modbus; for a vendor station, a user or role with read permission only, documented per connector when it exists. No connector will ever ask for an administrator account.

How to remove one

Disable it in the edge; it closes its connections. Delete it; its configuration is gone. For a vendor-side agent, the vendor's own uninstall removes it and the page for that agent will list exactly what it leaves behind.

Status: this is a design contract. No connector is released. The first, BACnet/IP, is scheduled for Phase 3 on the roadmap.