Components
tiCrypt ships as a set of RPM packages from the tiCrypt repository. This page is the reference for what each one is. Every package listed here is in the repository and installable; the Version Guide shows the version and release date of each.
Every package name is lowercase and hyphenated: ticrypt-sftp, not tiCrypt-SFTP. tiAudit is
the single exception, and it is camelCase in the repository. Use the exact name when installing,
since dnf is case-sensitive.
Two names are easy to get wrong: ticrypt-driveimport has no hyphen before import, and
ticrypt-vmhost has none before host, while ticrypt-vmc-manager does.
Backend
The backend is a modular set of ten services that communicate over TCP, so they can be distributed across hosts. Install the metapackage and you get all of them.
ticrypt-backend
The metapackage for the whole backend. Installing it pulls the ten services below along with
ticrypt-common, which is what makes an upgrade a single command.
sudo dnf install ticrypt-backend
The ten services
Each has its own configuration file in /etc/ticrypt/. Configuration is covered in
Backend Services.
| Package | What it does |
|---|---|
ticrypt-auth | Authentication, authorization, and user management. Manages users, groups and sessions, and supervises the other services |
ticrypt-rest | The REST interface. Exposes the system over HTTP, validates client payloads. See the REST API |
ticrypt-file-manager | Encrypted file and directory operations. Tracks file metadata and chunked storage |
ticrypt-batch | Slurm batch integration. Coordinates jobs between Global Slurm and ticrypt-host-controller |
ticrypt-vm | VM and drive lifecycle: creation, scheduling, cost functions, realm coordination |
ticrypt-proxy | Proxies network connections from outside into running VMs |
ticrypt-logger | Centralized logging. Records actions performed by the other services, with file and TCP output |
ticrypt-stats | Collects operational statistics and usage metrics |
ticrypt-notifications | Historical and real-time notification delivery |
ticrypt-maintenance | Automated maintenance, including disabling inactive accounts |
ticrypt-common
Shared files and requirements: creates the service accounts and common prerequisites every backend service depends on. Pulled automatically by each of the ten, so it is rarely installed directly.
Data ingress
Both ingress services are deployed outside the secure perimeter, with a one-way path to
ticrypt-rest and no access to the internal network or compute nodes.
ticrypt-sftp
The SFTP frontend. Accepts data transfers into tiCrypt over SFTP on port 2022, serving both administrator-provisioned SFTP accounts and user-created Inboxes.
sudo dnf install ticrypt-sftp
Configured through /etc/ticrypt/ticrypt-sftp.toml. See
SFTP Configuration.
ticrypt-mailbox
The mailbox server. Gives external collaborators a web form to submit files without an account. Uploads are encrypted on arrival with the recipient's public key, so only the recipient can decrypt them. Needs its own Nginx virtual host and TLS certificate. See Mailbox.
sudo dnf install ticrypt-mailbox
Compute and VM hosts
ticrypt-host-controller
Runs on each compute node. Coordinates Slurm jobs on that node: it starts a secure VM for each allocated job and notifies the backend so the VM can be handed to the VM Controller for provisioning. Maintains the local job-tracking database.
sudo dnf install ticrypt-host-controller
ticrypt-vmhost
Tools for configuring and deploying tiCrypt VM hosts.
sudo dnf install ticrypt-vmhost
ticrypt-vm-controller
The VM Controller orchestration service: downloads, verifies, executes and restarts the VM Controller software that runs inside VMs.
Do not install this package with dnf. The VM Controller is distributed exclusively through the
VM Installer channel, which is what the Version Guide tracks.
A copy exists in the RPM repository, but it is not the distribution path and will lag behind the
installer. Installing it from dnf gives you an older VM Controller than your deployment expects.
ticrypt-vmc-manager
A utility for managing VM Controller deployments across hosts.
sudo dnf install ticrypt-vmc-manager
Network control
These govern what running VMs can reach. Unless a specific IP-and-port mapping is configured, all outbound VM traffic stays blocked.
ticrypt-allowedlist
Restricts VM internet access by manipulating firewall rules and DNS replies on the backend host, allowing traffic only to configured external licensing servers. Configuration requires Super-Admin authorization.
sudo dnf install ticrypt-allowedlist
ticrypt-allowedlist-ipset
The raw ipset variant of the same service, for deployments driving iptables through ipset directly.
Ships at the same version as ticrypt-allowedlist. Install one or the other, not both.
sudo dnf install ticrypt-allowedlist-ipset
ticrypt-nft
The nftables bridge, manipulating nftables rules for tiCrypt VMs, proxies and licensing servers. The nftables-based alternative to the iptables approach above.
sudo dnf install ticrypt-nft
Audit
tiAudit
The tiCrypt log viewer and auditing tool. Extracts information from tiCrypt's secure logs, generates reports, and can forward entries to a SIEM. See Audit.
The package name is camelCase, unlike every other package here. The binaries and configuration
it installs are lowercase: /usr/sbin/tiaudit, /etc/tiaudit/.
sudo dnf install tiAudit
The package ships three binaries: tiaudit (the interface and reporting engine), tiaudit-log-streamer
(receives log entries pushed from the backend and stores them in ClickHouse), and
tiaudit-log-uploader (backfills historical logs during deployment or recovery). These are programs
within the one package, not separate packages.
Utilities
ticrypt-driveimport
Supports the External Drive Builder workflow: an administrator populates a drive outside tiCrypt, seals it with a manifest that encrypts it and binds mount rights to a named user, then imports it. Built for migrations of 5 TB and larger.
sudo dnf install ticrypt-driveimport
Not RPM packages
Two components appear in tiCrypt documentation but are not packages in this repository:
| Component | What it is |
|---|---|
ticrypt-setup | The Ansible installer, and the only supported deployment method. Distributed separately. See the Install Guide |
ticrypt-host-manager | Bridges the Global Slurm scheduler and the backend for batch processing. Not currently published to the RPM repository |
The tiCrypt Frontend and the Connect application are also delivered through their own channels and are tracked on the Version Guide.