tiCrypt 2.17.15

Components

tiCrypt ships as a set of RPM packages from the tiCrypt repository. This page is the reference for what each one is. Every package listed here is in the repository and installable; the Version Guide shows the version and release date of each.

Package names are lowercase

Every package name is lowercase and hyphenated: ticrypt-sftp, not tiCrypt-SFTP. tiAudit is the single exception, and it is camelCase in the repository. Use the exact name when installing, since dnf is case-sensitive.

Two names are easy to get wrong: ticrypt-driveimport has no hyphen before import, and ticrypt-vmhost has none before host, while ticrypt-vmc-manager does.

Backend

The backend is a modular set of ten services that communicate over TCP, so they can be distributed across hosts. Install the metapackage and you get all of them.

ticrypt-backend

The metapackage for the whole backend. Installing it pulls the ten services below along with ticrypt-common, which is what makes an upgrade a single command.

sudo dnf install ticrypt-backend

Java 21 from backend 3.15.0

Check two settings when upgrading to 3.15.0 or later

Since 3.15.0 the backend runs on Java 21; earlier versions ran on Java 8 (1.8). The packages now depend on java-21-openjdk-headless, so dnf installs Java 21 during the upgrade. It does not change either of the two settings below, and the services fail to start if either one is still set for Java 8.

1. The default java. Every service starts with /usr/bin/java, which points at whichever Java the system alternatives setting selects. A host that also has Java 8 installed can keep using it. Check the version, and if it does not report 21, select Java 21:

   java -version
   sudo alternatives --config java

2. -XX:MaxPermSize in the JVM options. Each service reads its JVM options from /etc/ticrypt/<service>.jvmopts, and those files have shipped with -XX:MaxPermSize=512m. Java 21 no longer recognizes that option and refuses to start the service. The 3.15.0 packages still ship it, and an upgrade keeps any copy you have edited, so check every file and remove the line.

   grep -l MaxPermSize /etc/ticrypt/*.jvmopts
   sudo sed -i '/MaxPermSize/d' /etc/ticrypt/*.jvmopts

Then restart the backend services on the host:

sudo systemctl restart ticrypt-auth ticrypt-rest ticrypt-file-manager \
  ticrypt-batch ticrypt-vm ticrypt-proxy ticrypt-logger \
  ticrypt-stats ticrypt-notifications ticrypt-maintenance

The ten services

Each has its own configuration file in /etc/ticrypt/. Configuration is covered in Backend Services.

Package	What it does
ticrypt-auth	Authentication, authorization, and user management. Manages users, groups and sessions, and supervises the other services
ticrypt-rest	The REST interface. Exposes the system over HTTP, validates client payloads. See the REST API
ticrypt-file-manager	Encrypted file and directory operations. Tracks file metadata and chunked storage
ticrypt-batch	Slurm batch integration. Coordinates jobs between Global Slurm and ticrypt-host-controller
ticrypt-vm	VM and drive lifecycle: creation, scheduling, cost functions, realm coordination
ticrypt-proxy	Proxies network connections from outside into running VMs
ticrypt-logger	Centralized logging. Records actions performed by the other services, with file and TCP output
ticrypt-stats	Collects operational statistics and usage metrics
ticrypt-notifications	Historical and real-time notification delivery
ticrypt-maintenance	Automated maintenance, including disabling inactive accounts

ticrypt-common

Shared files and requirements: creates the service accounts and common prerequisites every backend service depends on. Pulled automatically by each of the ten, so it is rarely installed directly.

Data ingress

Both ingress services are deployed outside the secure perimeter, with a one-way path to ticrypt-rest and no access to the internal network or compute nodes.

ticrypt-sftp

The SFTP frontend. Accepts data transfers into tiCrypt over SFTP on port 2020 (the shipped [sftp] listen_port) for the SFTP Inboxes that users create. It only receives files; sending files out over SFTP goes to External SFTP Servers that a Super-admin allowlists.

sudo dnf install ticrypt-sftp

Configured through /etc/ticrypt/ticrypt-sftp.toml. See SFTP Inbox Configuration.

ticrypt-mailbox

The mailbox server. Gives external collaborators a web form to submit files without an account. Uploads are encrypted on arrival with the recipient's public key, so only the recipient can decrypt them. Needs its own Nginx virtual host and TLS certificate. See Inboxes.

sudo dnf install ticrypt-mailbox

Compute and VM hosts

ticrypt-host-controller

Runs on each compute node. Coordinates Slurm jobs on that node: it starts a secure VM for each allocated job and notifies the backend so the VM can be handed to the VM Controller for provisioning. Maintains the local job-tracking database.

sudo dnf install ticrypt-host-controller

ticrypt-vmhost

Tools for configuring and deploying tiCrypt VM hosts.

sudo dnf install ticrypt-vmhost

ticrypt-vm-controller

The VM Controller orchestration service: downloads, verifies, executes and restarts the VM Controller software that runs inside VMs.

Install from the VM Installer channel only

Do not install this package with dnf. The VM Controller is distributed exclusively through the VM Installer channel, which is what the Version Guide tracks.

A copy exists in the RPM repository, but it is not the distribution path and will lag behind the installer. Installing it from dnf gives you an older VM Controller than your deployment expects.

ticrypt-vmc-manager

A utility for managing VM Controller deployments across hosts.

sudo dnf install ticrypt-vmc-manager

Network control

These govern what running VMs can reach. Unless a specific IP-and-port mapping is configured, all outbound VM traffic stays blocked.

ticrypt-allowedlist

Restricts VM internet access by manipulating firewall rules and DNS replies on the backend host, allowing traffic only to configured external licensing servers. Configuration requires Super-Admin authorization.

sudo dnf install ticrypt-allowedlist

ticrypt-allowedlist-ipset

The raw ipset variant of the same service, for deployments driving iptables through ipset directly. Ships at the same version as ticrypt-allowedlist. Install one or the other, not both.

sudo dnf install ticrypt-allowedlist-ipset

ticrypt-nft

The nftables bridge, manipulating nftables rules for tiCrypt VMs, proxies and licensing servers. The nftables-based alternative to the iptables approach above.

sudo dnf install ticrypt-nft

Audit

tiAudit

The tiCrypt log viewer and auditing tool. Extracts information from tiCrypt's secure logs, generates reports, and can forward entries to a SIEM. See Audit.

The package name is camelCase, unlike every other package here. The binaries and configuration it installs are lowercase: /usr/sbin/tiaudit, /etc/tiaudit/.

sudo dnf install tiAudit

The package ships three binaries: tiaudit (the interface and reporting engine), tiaudit-logger (listens on TCP port 25000 for log entries pushed from the backend and stores them in ClickHouse), and tiaudit-log-uploader (backfills historical logs during deployment or recovery). These are programs within the one package, not separate packages.

Utilities

ticrypt-driveimport

Supports the External Drive Builder workflow: an administrator populates a drive outside tiCrypt, seals it with a manifest that encrypts it and binds mount rights to a named user, then imports it. Built for migrations of 5 TB and larger.

sudo dnf install ticrypt-driveimport

Not RPM packages

Two components appear in tiCrypt documentation but are not packages in this repository:

Component	What it is
ticrypt-setup	The Ansible installer, and the only supported deployment method. Distributed separately. See the Install Guide
ticrypt-host-manager	Bridges the Global Slurm scheduler and the backend for batch processing. Not currently published to the RPM repository

The tiCrypt Frontend and the Connect application are also delivered through their own channels and are tracked on the Version Guide.