Introduction
The tiCrypt server consists of two major components: the tiCrypt backend and the tiCrypt VM Controller service.
The backend is installed via the Ansible playbook. See the Installation Guide for deployment instructions. This section covers post-deployment configuration only.
For a high-level overview of tiCrypt's security architecture, see the Security Architecture Whitepaper.
Backend Services
The backend uses a modular architecture of 10 independent services. Each service communicates with other services via TCP connections (Akka framework), allowing distribution across multiple servers if needed.
| Service | Description |
|---|---|
ticrypt-auth | Authentication, authorization, and user management. Supervises all other services. |
ticrypt-rest | HTTP REST API gateway. Handles client requests and validates JSON payloads. |
ticrypt-file-manager | Encrypted file and directory operations with chunked storage. |
ticrypt-batch | Slurm batch job integration. Submits and tracks jobs against the Slurm controller. |
ticrypt-vm | VM lifecycle management, scheduling, cost functions, and realm coordination. |
ticrypt-proxy | Secure connection proxy between clients and running VMs. |
ticrypt-logger | Centralized logging with file and TCP output drivers. |
ticrypt-stats | System statistics and usage metrics collection. |
ticrypt-notifications | User and system notification delivery. |
ticrypt-maintenance | Automated maintenance tasks including inactive account locking. |
All service configuration files use HOCON format and are located in /etc/ticrypt/. Each service has its own file (e.g., ticrypt-auth.conf, ticrypt-vm.conf). See Service Configuration for shared sections that apply to all services.
Two services have extensive options and are documented on their own pages:
- Auth Service (ticrypt-auth): User management, sessions, MFA, key escrow, and split credentials
- VM Service (ticrypt-vm): Realms, cost functions, hardware profiles, and VM scheduling
For token-based programmatic access to the backend, see the REST API reference.
Services Outside the Core Ten
These ship and run alongside the backend but are not part of the ten services ticrypt-services.sh manages. Several sit deliberately outside the security perimeter. For every package in the repository, including these, see Components.
| Service | What it does |
|---|---|
ticrypt-sftp | SFTP data ingestion on port 2022, deployed outside the secure perimeter. Serves both administrator-provisioned SFTP and user-created Inbox access points. Needs a network path to ticrypt-rest and nothing else: it has no access to the internal network or compute nodes |
ticrypt-mailbox | Web-based file submission for external collaborators, also outside the perimeter, with a one-way path to ticrypt-rest. Uploads are encrypted with the recipient's public key, so only they can decrypt them. Auto-locks on suspected impersonation or malicious file patterns. Requires its own Nginx virtual domain and TLS certificate |
ticrypt-allowedlist | Controls VM outbound access to external licensing servers by manipulating iptables/ipset rules and DNS replies on the backend host. Unless a specific IP-and-port mapping is configured, all outgoing VM traffic stays blocked. Configuration requires Super-Admin authorization |
ticrypt-host-controller | Runs on each compute node. Receives Global Slurm jobs and starts a secure VM for each allocated job, then notifies the backend so the VM can be handed to the VM Controller for provisioning. Maintains the local job-tracking database |
ticrypt-host-manager | Bridges the Global Slurm scheduler and the tiCrypt backend for batch processing. Global Slurm allocates cluster-wide resources and enforces quotas but never sees job content; this component connects it to the Local Slurm instances that actually run jobs inside the enclave |
ticrypt-driveimport | Supports the External Drive Builder workflow: an administrator populates a drive outside tiCrypt, seals it with a manifest that encrypts it and binds mount rights to a named user, then imports it. Built for 5 TB and larger migrations |
ticrypt-setup | The Ansible installer, and the only supported deployment method. See the Backend Installation Guide |
tiAudit | Hosts the tiCrypt Audit interface, reporting engine, and query functionality |
tiaudit-logger | Listens on TCP port 25000 for log entries pushed from the backend and stores them in ClickHouse |
tiaudit-log-uploader | Backfills historical audit logs into ClickHouse during initial deployment or recovery |
VM Controller Service
The VM Controller is an Nginx-based service that delivers signed controller scripts and guest agents to running VMs. It operates independently of the backend services listed above.