[{"_1":2,"_104":-5,"_105":-5},"loaderData",{"_3":4,"_18":19,"_26":27,"_100":101},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16,"_17":11},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","dockerRebrandTour","routes/_layout",{"_20":-5,"_21":22,"_23":22,"_24":11,"_25":22},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_28":29,"_30":-5,"_31":11,"_32":11,"_33":34,"_35":36,"_37":-5,"_38":11,"_39":40,"_85":-5,"_86":87,"_88":-5,"_89":22,"_90":22,"_91":11,"_92":11,"_93":-5,"_94":11,"_95":-5,"_96":97,"_98":-7,"_99":-7},"canonicalUrl","https://hub.docker.com/r/devantisolutions/secureaccess-deployment","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","devantisolutions","reponame","secureaccess-deployment","cloudBuildSource","isAutobuildsAvailable","repo",{"_41":42,"_43":44,"_45":46,"_47":48,"_49":11,"_50":46,"_51":52,"_53":54,"_55":36,"_33":34,"_56":57,"_58":59,"_60":61,"_62":57,"_63":64,"_65":-5,"_66":57,"_67":68,"_69":11,"_70":34,"_71":72,"_77":11,"_78":79,"_83":34,"_84":-5},"categories",[],"content_types",[],"date_registered","2026-05-22T04:20:15.280741Z","description","Devanti SecureAccess deployment templates, Docker Compose, onboarding, and infra guides.","is_private","last_updated","last_modified","2026-05-27T17:08:22.897933Z","media_types",[],"name","pull_count",0,"repository_type","image","star_count",2,"status","status_description","initialized","source","collaborator_count","full_description","# Devanti SecureAccess Connector Deployment\n\n

\n \n

\n\n

\n Deployment and onboarding guide for the Devanti SecureAccess Connector\n

\n\n---\n\n# Overview\n\nThe Devanti SecureAccess Connector is a lightweight outbound-only secure connector used to establish encrypted tunnels between customer/private environments and the Devanti SecureAccess Zero Trust platform.\n\nThe connector enables secure access to private applications without opening inbound firewall ports.\n\nNew dynamic connector deployments use token-authenticated onboarding with secure encrypted tunnel connectivity to the Devanti Gateway.\n\nLegacy mTLS connector deployments remain supported for enterprise deployments.\n\n---\n\n# Key Features\n\n* Outbound-only secure connectivity\n* No inbound firewall exposure required\n* Secure encrypted tunnel communication\n* Token-authenticated onboarding\n* Connector-specific identity validation\n* HTTPS local management UI\n* Docker-based deployment\n* VMware OVA appliance support\n* MSP / MSSP multi-site deployment support\n* Identity-aware Zero Trust access\n* Secure HTTP / HTTPS / RDP / SSH publishing\n* Centralized cloud management\n* Connector auto-update support\n\n---\n\n# Supported Deployment Models\n\n* VMware OVA Appliance\n* Docker Deployment\n* Ubuntu VM Deployment\n* Bare-metal Linux Deployment\n* MSP / MSSP Multi-site Deployment\n* Cloud VM Deployment\n\n---\n\n# Supported Platforms\n\n* VMware ESXi\n* Proxmox\n* Hyper-V\n* KVM\n* Nutanix AHV\n* AWS EC2\n* Microsoft Azure VM\n* Google Cloud VM\n* Bare-metal Ubuntu Server\n\n---\n\n# Minimum System Requirements\n\n## Recommended VM Resources\n\n| Category | Details |\n|---|---|\n| Operating System | Ubuntu Server 22.04 LTS |\n| vCPU | 2 |\n| Memory (RAM) | 4 GB |\n| Storage | 40 GB |\n| Network Interface | 1 NIC |\n| Internet Connectivity | Required |\n\n---\n\n## Recommended Production Sizing\n\n| Environment Type | Recommended vCPU | Recommended RAM | Recommended Storage |\n|---|---|---|---|\n| Small Lab / POC | 2 vCPU | 4 GB | 40 GB |\n| Medium Production | 4 vCPU | 8 GB | 80 GB |\n| Large Enterprise | 8+ vCPU | 16+ GB | 160+ GB |\n\n---\n\n# Architecture Overview\n\nThe connector is installed inside the customer/private network and establishes an outbound encrypted tunnel to the Devanti Gateway.\n\nNo inbound firewall ports are required from the internet to the customer environment.\n\n```text\n+-------------------+\n| Customer Network |\n| Private Apps |\n+---------+---------+\n |\n |\n+---------v---------+\n| Devanti Connector |\n| Secure Tunnel |\n+---------+---------+\n |\n | Secure Outbound Connection\n |\n+---------v---------+\n| Devanti Gateway |\n| Zero Trust Access |\n+---------+---------+\n |\n |\n+---------v---------+\n| End Users |\n| Browser / RDP |\n| SSH / HTTPS |\n+-------------------+\n```\n\n---\n\n# Customer Connector Flow\n\n1. Admin creates a connector record.\n2. Admin generates a one-time onboarding token.\n3. Customer deploys Connector OVA or Docker container.\n4. Customer configures:\n\n * Static IP\n * Subnet / CIDR\n * Default Gateway\n * DNS\n * Gateway URL\n * Connector Token\n\n5. Connector securely registers with Devanti Control Plane.\n6. Control Plane validates the onboarding token and establishes connector identity.\n7. Connector establishes encrypted secure tunnel connectivity.\n8. Admin verifies connector online status and active tunnel.\n\n---\n\n# Connector Certificate Lifecycle\n\n## Certificate Components\n\n| Certificate / Component | Purpose |\n|---|---|\n| Platform TLS Certificate | Secure platform communication |\n| Connector Identity Certificate | Secure connector authentication |\n| Local UI Certificate | HTTPS local management UI |\n\n---\n\n## Certificate Usage Flow\n\n| Stage | Action |\n|---|---|\n| Initial Deployment | Connector starts using onboarding token |\n| First Registration | Control Plane validates onboarding token |\n| Certificate Issuance | Connector identity certificates are generated |\n| Secure Storage | Certificates stored securely inside connector |\n| Future Connections | Connector automatically uses secure authentication |\n| Tunnel Establishment | Secure encrypted tunnel established |\n\n---\n\n# First Registration Flow\n\nExpected first registration process:\n\n1. Admin creates connector record.\n2. Admin generates onboarding token.\n3. Connector starts using onboarding configuration.\n4. Connector registers securely with Control Plane.\n5. Control Plane validates onboarding token and establishes connector identity.\n6. Connector securely stores issued identity materials locally.\n7. Connector automatically enables secure authentication for future connections.\n8. Connector establishes encrypted secure tunnel connectivity.\n\n---\n\n# Network Requirements\n\nThe connector requires outbound internet access only.\n\n## Required Outbound Firewall Rules\n\n| Protocol | Port | Purpose |\n|---|---|---|\n| TCP | 443 | Secure platform connectivity |\n| TCP | 443 | Secure encrypted tunnel communication |\n| TCP | 443 | Docker image download |\n| UDP/TCP | 53 | DNS resolution |\n| UDP | 123 | NTP synchronization |\n\n---\n\n## Important Notes\n\n| Item | Details |\n|---|---|\n| Inbound Firewall Rules | No inbound firewall rules from Devanti are required |\n| Local Management UI | HTTPS UI accessible only from management network |\n| Tunnel Direction | Outbound-only secure encrypted connectivity |\n| Internet Requirement | Outbound internet connectivity required |\n\n---\n\n# Install Docker on Ubuntu\n\n## Update the System\n\n```bash\nsudo apt update && sudo apt upgrade -y\n```\n\n---\n\n## Install Required Packages\n\n```bash\nsudo apt install -y ca-certificates curl gnupg lsb-release\n```\n\n---\n\n## Add Docker Repository\n\n```bash\ncurl -fsSL https://download.docker.com/linux/ubuntu/gpg | \\\nsudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg\n```\n\n```bash\necho \\\n\"deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] \\\nhttps://download.docker.com/linux/ubuntu \\\n$(lsb_release -cs) stable\" | \\\nsudo tee /etc/apt/sources.list.d/docker.list > /dev/null\n```\n\n---\n\n## Install Docker Engine\n\n```bash\nsudo apt update\n\nsudo apt install -y \\\ndocker-ce \\\ndocker-ce-cli \\\ncontainerd.io \\\ndocker-buildx-plugin \\\ndocker-compose-plugin\n```\n\n---\n\n## Enable Docker\n\n```bash\nsudo systemctl enable --now docker\n```\n\n---\n\n## Verify Docker Installation\n\n```bash\ndocker version\n```\n\n---\n\n# Public Docker Hub Image\n\nCustomer deployments use the public Docker Hub image:\n\n```bash\ndocker pull devantisolutions/secureaccess-connector:latest\n```\n\n---\n\n# Create Connector Configuration Directory\n\n```bash\nsudo mkdir -p /etc/devanti/connector\n```\n\n---\n\n# First-Boot Runtime Configuration\n\n## Example config.yaml\n\n```yaml\nconnector_id: \"connector-branch-office-01\"\n\ngateway_url: \"https://\"\n\ngateway_ws_url: \"wss:///\"\n\nlog_level: \"info\"\n\nreconnect_interval: \"5s\"\n\nmtls:\n enabled: false\n\ntls:\n mode: \"strict\"\n```\n\n---\n\n## Example connector.env\n\n```env\nCONNECTOR_CONFIG_FILE=/etc/devanti/connector/config.yaml\n\nCONNECTOR_MTLS_ENABLED=false\n\nCONNECTOR_TOKEN=\n\nGATEWAY_URL=https://\n\nGATEWAY_WS_URL=wss:///\n\nCONTROL_PLANE_URL=https://\n\nCONNECTOR_ID=connector-branch-office-01\n\nCONNECTOR_ORG_NAME=\"\"\n\nCONNECTOR_TLS_MODE=strict\n\nCONNECTOR_SERVER_NAME=\n```\n\n---\n\n# Important Notes\n\n## Initial Registration\n\nUse:\n\n```text\nCONNECTOR_MTLS_ENABLED=false\n```\n\nONLY during first registration when connector identity certificates are not yet issued.\n\nAfter successful enrollment, the connector automatically enables secure authentication for future connections.\n\n---\n\n## Connector Identity\n\nEach connector maintains a unique secure identity.\n\nDo NOT copy or reuse connector identity materials between multiple connectors.\n\nReusing identity materials may cause:\n\n* Connector conflicts\n* Offline status\n* Tunnel authentication failures\n\n---\n\n## Control Plane URL\n\nUse the dedicated secure gateway or platform hostname provided during onboarding.\n\nDo not use unrelated management portal hostnames.\n\n---\n\n# Run Connector Container\n\n## Recommended Production Deployment\n\n```bash\ndocker run -d \\\n --name devanti-connector \\\n --restart unless-stopped \\\n --env-file /etc/devanti/connector/connector.env \\\n -p 443:443 \\\n -v /etc/devanti/connector:/etc/devanti/connector:rw \\\n -v /etc/ssl/certs:/etc/ssl/certs:ro \\\n devantisolutions/secureaccess-connector:latest\n```\n\n---\n\n# Local HTTPS Management UI\n\nThe connector includes a local HTTPS management UI.\n\nAccess:\n\n```text\nhttps://\n```\n\nAccept the self-signed certificate warning during first login.\n\n---\n\n# Local UI Features\n\nThe local connector UI provides:\n\n* Appliance configuration\n* Connector onboarding\n* Network settings\n* DNS settings\n* Gateway configuration\n* Tunnel status\n* Connector logs\n* Update management\n* Health diagnostics\n* Error summaries\n* Certificate status\n\n---\n\n# Local UI Repository Settings\n\nPublic customer deployments should use:\n\n```text\nRepository Server: docker.io\nConnector Image: devantisolutions/secureaccess-connector:latest\n```\n\nUse this exact image:\n\n```text\ndevantisolutions/secureaccess-connector:latest\n```\n\n---\n\n# Installer Template\n\nExample customer-side installer:\n\n```bash\nsudo ./scripts/install-connector.sh \\\n --image devantisolutions/secureaccess-connector:latest \\\n --gateway-url https:// \\\n --connector-id connector-branch-office-01 \\\n --token '' \\\n --config-dir /etc/devanti/connector \\\n --systemd\n```\n\n---\n\n# Enable Connector Service\n\n```bash\nsudo systemctl daemon-reload\n\nsudo systemctl enable --now devanti-connector\n\nsudo journalctl -u devanti-connector -f\n```\n\n---\n\n# Validation\n\n## Check Service Status\n\n```bash\nsystemctl status devanti-connector\n```\n\n---\n\n## Check Logs\n\n```bash\njournalctl -u devanti-connector -f\n```\n\n---\n\n## Check Docker Container\n\n```bash\ndocker ps\n```\n\n---\n\n## Check Connector Logs\n\n```bash\ndocker logs devanti-connector --tail=100\n```\n\n---\n\n## Verify Docker Hub Pull\n\n```bash\ndocker pull devantisolutions/secureaccess-connector:latest\n```\n\n---\n\n# Expected Successful Logs\n\nExpected connector logs include:\n\n* connector registered\n* connector authentication successful\n* connector tunnel connected\n\n---\n\n# Admin Portal Validation\n\nAdmin Portal should display:\n\n* Connector online status\n* Heartbeat updates\n* Active tunnel status\n* Last seen timestamp\n* Connected gateway\n* Accessible mapped resources\n\n---\n\n# OVA Deployment\n\nFor enterprise VMware deployments, Devanti Solutions also provides a prebuilt Connector OVA appliance for simplified onboarding.\n\nThe OVA deployment wizard includes:\n\n* Static IP configuration\n* DNS configuration\n* Gateway URL configuration\n* Connector token onboarding\n* Automatic connector registration\n\n---\n\n# SaaS Platform\n\nCustomers securely access private applications through the Devanti SecureAccess cloud platform without exposing internal infrastructure to the internet.\n\n---\n\n# Product Website\n\nhttps://devantisolutions.com/devanti-secure-access\n\n---\n\n# Company\n\nDevanti Solutions \nSmart Infra Intelligence\n\n---\n\n# Support\n\nhttps://devantisolutions.com/support\n\n---\n\n# License\n\nCopyright © Devanti Solutions. \nAll Rights Reserved.","has_starred","hub_user","immutable_tags_settings",{"_73":11,"_74":75},"enabled","rules",[76],".*","is_automated","permissions",{"_80":22,"_81":11,"_82":11},"read","write","admin","user","storage_size","orgData","recentTags",[],"sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxRunInCloud","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame._index",{"_102":-5,"_103":-5,"_37":-5},"org","repoPullsData","actionData","errors"]

devantisolutions/secureaccess-deployment

devantisolutions/secureaccess-deployment repository overview

Tag Summary