The full software capabilities form the dedicated hosted environment can be be deployed into an isolated network managed entirely by the customer. In the onprem deployment all of the customer data and intra-service communication remains inside the isolated network. Additionally usage of the isolated network is usually granted to users on the corporate LAN with a network address translation (NAT) from the customer LAN to the isolated network.
The onprem deployments comes with additional tools and hardware to make deployment, maintanance, and security of devices more seamless. The HeadSpin technologies specific to on-premise environment are below.
The HeadSpin hardware and devices can be racked in an RF-neutral, data-center safe tray, or deployed inside a PIN-lock box that audits access and device removal.
Software updates are delivered in a self-contained installer that runs on the unifiedcontroller inside the isolated network. The ease of installation allows customers to patch their on-premise deployments with the latest updates from the hosted platform.
Isolated Network
The hosts in the on-premise deployment should be connected to a LAN that has no packet route from inside the LAN to outside. The isolated LAN must have a DHCP server and DNS server, and allow packets from any IP in the LAN to reach any other IP in the LAN. Users on one or more separate networks should be granted access to the isolated LAN via a NAT. The separate networks must add DNS entries that refer to the translated address of hosts inside the isolated network.
While there are cell or wifi devices connected to proxy hosts inside the isolated network, no communication that originates inside the isolated network leaves the isolated network via a connected device. There may be man-in-the-middle captures for performance where packets from a device are routed to a host that intercepts all packets and retransmits them back out via a cell or wifi device; however, the information sent from the man-in-the-middle translation is a function of the packets originating from the device.
If you have questions or encounter obstacles in setting up your isolated network, please reach out to your HeadSpin administrators.
Management Tools
The on-premise unifiedcontroller comes with a number of command line tools to manage accounts, deploy new hosts, and perform security maintenance. A brief description of the tools is below, followed by the usage information for each tool.
Tool
Description
hsops
Manage users, auth, teams, and orgs.
hssecurity
Manage host access.
hsbootstrap
Wipe and prepare hosts for setup.
hssetup
Setup a host for normal operation.
<code class="dcode">hsops</code>
Usage:
hsops org ls [--json]
hsops org inspect <org_id>
hsops org create-headspin-org
hsops org create --name=<org_name> [--support_email=<support_email>]
[--domains=<domains>] [--new_ui]
hsops org modify <org_id> [--name=<name>] [--add_permissions=<permission>]
[--rm_permissions=<permission>] [--recursive]
hsops org delete <org_id>
hsops org-hosts modify <org_id> [--add_hosts=<hostnames>] [--rm_hosts=<hostnames>]
hsops org-admin add <org_id> (--user_id=<user_id> | --email=<email>)
hsops org-admin delete <org_id> --user_id=<user_id>
hsops permission ls
hsops feature-role create <role_id> --name=<name> --extra_permissions=<permissions>
hsops user ls [--with_permissions=<permissions>]
hsops user create --email=<email> --name=<name> --org_id=<org_id>
hsops user create-with-auth-link --email=<email> --name=<name> --org_id=<org_id> --role_id=<role_id>
hsops user inspect <user_id>
hsops user modify <user_id> [--email=<email>] [--name=<name>] [--org_id=<org_id>]
hsops team inspect <team_id>
hsops team create --name=<name> --description=<description> --org_id=<org_id>
hsops team modify <team_id> [--name=<new_name>]
[--add_permissions=<permission>] [--rm_permissions=<permission>]
[--description=<new_description>] [--recursive]
hsops team delete <team_id>
hsops team-user add <team_id> (--user_id=<user_id> | --email=<email>) [--role_name=<role_name>]
hsops team-user delete <team_id> --user_id=<user_id>
hsops team-hosts modify <team_id> [--add_hosts=<hostnames>] [--rm_hosts=<hostnames>]
hsops host inspect <hostnames>
hsops role create --name=<role_name> --add_permissions=<permissions> --org_id=<org_id> [--role_id=<role_id>]
hsops role inspect <role_id>
hsops role delete <role_id>
hsops role modify <role_id> [--enable|--disable] [--name=<name>]
[--add_permissions=<permission>] [--rm_permissions=<permission>]
[--add_pools=<pool_keys>] [--rm_pools=<pool_keys>] [--team_id=<team_id>] [--org_id=<org_id>]
hsops pool ls
hsops pool reachability
hsops pool create --key=<pool_key> --name=<pool_name> [--hosts=<hostnames>]
hsops pool inspect <pool_key>
hsops pool delete <pool_key>
hsops pool modify <pool_key> [--name=<new_name>]
[--add_hosts=<hostnames>] [--rm_hosts=<hostnames>]
hsops lease ls [--with_permissions=<permissions>] [--email=<email>]
hsops lease create --user_id=<user_id> --role_id=<role_id>
hsops lease delete --user_i
hssetup [options] host1 host2...
options:
--no-restart-vpn: Do not modify the machine to automatically restart the vpn
Physical Layout and Physical Security
Hosts on the isolated network are physically deployed into either a rack-mountable tray or PIN-lock enabled box. Auditing can be enabled to track user open of the box followed by device removal.
When the geo location of a tray or box changes, the hosts must be boostrapped to reflect the new location. For example if a host moves from us-sf to us-la, the host name would change from {env}-us-sf-0-proxy-0 to {env}-us-la-0-proxy-0. The boostrap process is designed to reset the host from scratch, so that a host can be shipped to the destination location in a wiped state.
Keys
When an on-premise unit is delivered, HeadSpin will securely send two configuration directories: keys-{env} and keys-{env}-red. These are the configuration and security configuration of the unit, respectively. They should be stored on a secure drive.
When an update installer is delivered, it will internally have the latest known keys-{env} and keys-{env}-red packaged. The customer may replace these with their copy of the keys. The installer will merge the in-place configuration with the packaged configuration according to the rules in the on-prem upgrade guide.
Updates
Changes to a customer environment are tracked by a cryptographically signed version file, shown below. Only a signed version of the softare may be deployed to a customer env.
Platform upgrades must be done from the unifiedcontroller using the on-premise installer. HeadSpon will provide a signed installer image that must be mounted on the unifiedcontroller. The on-premise upgrade guide covers usage of the on-premise installer.
File System Layout
Teams managing the on-premise environment may want to set up their own dev ops practive for SSH key management, SSL certificates, OS patches, and more. The file system layout document describes the file system layout of each host type - unifiedcontroller, proxy, display - so that the customer can automate the management of individual files if needed.
iOS Provisioning
Remote control and Appium execution on iOS devices in the environment require a provisioning profile provided by Apple. The environment comes set up with a profile provided by HeadSpin for a set of demo devices. However, the customer will need to move to a profile managed by the customer to use more devices beyond the initial set of demo devices. The iOS provisioning document describes the process for a customer to create a new provisioning profile and install it into the environment.
Components
There is one geo component per physcial location, for example us-nyc. The geo and host names are set by the customer using the host bootstrap tools. The geo component must be on the isolated network.
