This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Reference

Quick lookups for configuring and operating SPEKTRA Edge OS.

In this section

Configuration reference — the device settings you can manage, grouped by area, with links to where each is documented.
Image settings — what you choose when creating an install image.
Persistent paths — locations on the device you may place files in.
Troubleshooting — playbooks for common problems.
Glossary — terms used throughout this guide.

1 -

Configuration reference

This is an index of the device settings you can manage, grouped by area. Most are set from the dashboard or the API once a device is online; a few are chosen at image creation. For exact API field names and types, see the Devices API reference.

Runtime settings (dashboard / API)

These are reconciled to the device while it is online — change them at any time.

Setting	Area	Documented in
OS version	Lifecycle	OS upgrades
Network configuration (and merge/replace mode)	Networking	Network configuration
Disable network configuration fallback	Networking	Connection fallback
Proxy (HTTP/HTTPS/no-proxy, interfaces)	Networking	Proxy configuration
SSH server enable/disable	Security	SSH access
SSH authentication (password/key) and authorized keys	Security	SSH access
SSH source allow / deny lists	Security	SSH access
SSH brute-force ban duration and ignore list	Security	SSH access
USB device control and allow rules	Security	USB device control
Attestation expectations	Security	TPM & device attestation
Logging (severity, components, container logs)	Operations	Logging
Health checks	Operations	Health checks
Device discovery (mDNS) on/off	Networking	Connectivity & ports
Location / placement metadata	Inventory	Manage devices

Image-creation settings

These are chosen when you create an install image; most can also be adjusted later through the runtime settings above.

Setting	Documented in
Device type (hardware + architecture)	Supported platforms
OS version to install	OS upgrades
Disk encryption (and recovery passphrase)	Disk encryption
Storage mapping	Storage
Network configuration	Network configuration
Time / NTP	Time synchronization
Proxy	Proxy configuration
Administrator password	User accounts
Provisioning credentials	Onboarding methods

On-device files

A few settings are provided as files on the device’s configuration storage — see Persistent paths.

2 -

Image settings

When you create an install image from the dashboard, you choose the device type, the OS version, and a set of defaults that are embedded in the image so a device is useful the moment it boots. This page summarizes those choices.

Setting	Purpose	More detail
Device type	Target hardware family and CPU architecture.	Supported platforms
OS version	The OS version installed by the image.	OS upgrades
Disk encryption	Encrypt the configuration and data areas.	Disk encryption
Recovery passphrase	Break-glass passphrase for encrypted devices.	Disk encryption
Storage mapping	Partitions and mounts to ensure on the device.	Storage
Network configuration	Initial network settings (the fallback baseline).	Networking
Time / NTP	Initial time sources.	Time synchronization
Proxy	Initial proxy settings.	Proxy configuration
Administrator password	Initial local administrator password.	User accounts
Provisioning credentials	Allow the device to onboard automatically.	Onboarding methods

Defaults, not limits

Image settings provide a device’s starting configuration. Once a device is online, almost everything can be changed from the dashboard — so a single image can serve a whole fleet, with per-device differences applied afterward.

3 -

Persistent paths

Most configuration is applied through the dashboard or API. A few things, however, are provided as files on the device’s configuration storage — the persistent area that survives reboots and OS upgrades. This page lists the file-based settings you may need to place on a device.

File-based settings

Purpose	What to place	Documented in
Storage mapping	A storage mapping document defining partitions and mounts.	Storage
Network configuration	A Netplan-format network configuration.	Networking
Time / NTP	A custom NTP configuration.	Time synchronization
Boot / shutdown hooks	Executable scripts run at boot, after the agent starts, and on shutdown.	Boot & shutdown hooks

Notes

Files on configuration storage persist across reboots and OS upgrades; this is why they are the right place for durable, file-based settings.
Do not place durable settings on the read-only system image — changes there do not survive a reboot. See how persistence works.
When disk encryption is enabled, files on configuration storage are protected at rest.

Prefer the dashboard where possible

File-based configuration exists for cases the dashboard does not cover (such as hooks) and for baking defaults into images. For everything available in the dashboard or API, prefer that route so configuration is centrally tracked.

4 -

Troubleshooting

Playbooks for the problems you are most likely to hit. Each lists the usual causes in the order worth checking.

A device will not come online

Connectivity. Confirm outbound TCP 443 to the platform is allowed (directly or via proxy). See Connectivity & ports.
Time. A badly wrong clock breaks secure connections and attestation. Ensure the device can reach an NTP source — see Time synchronization.
Network configuration. A recent network change may have broken connectivity; the device should fall back to its image network settings unless fallback is disabled. See connection fallback.
Onboarding. Confirm the device has valid provisioning credentials or a working onboarding method.

A network change broke connectivity

If network configuration fallback is enabled, the device should revert to its image network settings after a failed change.
If fallback is disabled, push a corrected configuration, or recover the device on-site.
Configure a backup uplink (such as cellular) so a wired/Wi-Fi mistake does not isolate the device — see uplink fallback.

An encrypted device will not unlock

After a hardware change (motherboard/TPM), automatic unlock no longer matches. Use the recovery passphrase.
If the recovery passphrase is lost and automatic unlock is unavailable, the device must be re-imaged (encrypted data is not recoverable).

Locked out of SSH

Your management host may have been banned after failed logins. Add it to the SSH ignore list to prevent this.
Check the source allow/deny lists — your address may not be permitted.
Administer the device through remote access while you fix SSH settings.

A USB device is rejected

USB device control is enabled and the device does not match an allow rule. Add a rule for it, or confirm an existing rule matches its ID, port, or interface.

An OS upgrade did not complete

Confirm the device can download the new version (connectivity and any proxy).
A device that fails to start a new version can fall back to the retained previous version; you can also roll back explicitly.

The device is out of storage

Container images, workload data, and logs share the data area. Check storage usage in device metrics.
Lower logging severity if logs are consuming space.

A change I made on the device reverted

The change likely modified the read-only system image. Apply it through configuration instead — see how persistence works and persistent paths.

5 -

Glossary

Terms used throughout the SPEKTRA Edge OS guide.

Attestation: The process by which a device proves its identity and reports its integrity to the platform using its TPM, before receiving credentials. See TPM & device attestation.
Configuration storage: The persistent area that holds device settings, identity, the administrator password, and hooks. Survives reboots and OS upgrades. See how persistence works.
Data area: The persistent area that holds container images, workload data, and logs. Uses most of the disk. See Storage.
Device type: The combination of hardware family and CPU architecture that identifies a platform and determines image compatibility. See supported platforms.
Disk encryption: Encryption of the configuration and data areas at rest, unlocked automatically by the TPM. See Disk encryption.
Hook: A user-provided script run at a defined lifecycle point (boot, after the agent starts, or shutdown). See Boot & shutdown hooks.
Onboarding / provisioning: How a device obtains an identity and joins a project — via zero-touch provisioning, a provisioning policy, or pre-registered hardware. See Device setup & provisioning.
Provisioning policy: A rule that lets devices self-register into a project from a template, either unattended or with manual approval. See onboarding methods.
Recovery passphrase: A human-known break-glass passphrase that can unlock an encrypted device when automatic unlock is unavailable. See Disk encryption.
Secure Boot: A firmware feature that allows only signed, trusted boot software to run. See Secure Boot.
System image: The read-only operating system a device boots from. Replaced as a unit during upgrades; not meant to be modified in place. See how persistence works.
TPM (Trusted Platform Module): A hardware security module that provides device identity and protects keys, including the keys used for disk unlock. See TPM & device attestation.
Zero-touch provisioning: Onboarding in which unconfigured hardware automatically finds the platform, proves its identity, and receives credentials with no per-device setup. See onboarding methods.