PVA gateway¶

The pvAccess (PVA) gateway is a program that acts as gateway, which enables pvAccess clients from a network to access pvAccess IOCs on another network.

Setting up a PVA gateway also enables you to add extra access security rules on top of IOCs.

For more details and documentation about the PVA PV gateway, you can examine the PVA Gateway documentation.

Important

Make sure to follow the NixOS Prerequisites.

Enabling the gateway¶

To enable the gateway, add this to your configuration:

pva-gateway.nix — Basic configuration¶

{
  services.pva-gateway = {
    enable = true;
    settings = {
      clients = [
        { name = "client"; }
      ];
      servers = [
        { name = "server"; }
      ];
    };
  };

  environment.epics.openPVAFirewall = true;
  # Since this configuration uses an "auto address list" which sends broadcasts,
  # the firewall must be configured to allow broadcast replies.
  # Remove if none of your PVA gateway clients use an "auto address list"
  # nor a manual broadcast address.
  environment.epics.allowPVABroadcastDiscovery = true;
}

In this configuration, the PVA gateway starts a pva-gateway.service systemd service, which listens on all interface, and forwards all pvAccess requests by broadcasting on all interfaces.

Restricting clients and servers¶

To restrict where the PVA gateway listens for pvAccess requests, use the interface option:

pva-gateway.nix — Restricting the server¶

{
  servers.pva-gateway = {
    enable = true;
    settings = {
      clients = [
        # ...
      ];
      servers = [
        {
          name = "server10";
          # Listen only for requests addressed to 10.1.1.4
          interface = [ "10.1.1.4" ];
        }
      ];
    };
  };

  # ...
}

To restrict where the PVA gateway forward pvAccess requests, use the services.pva-gateway.settings.clients.*.addrlist option:

pva-gateway.nix — Restricting the client¶

{
  servers.pva-gateway = {
    enable = true;
    settings = {
      clients = [
        {
          name = "client192";
          # Forward pvAccess requests by broadcasting to 192.168.1.*
          addrlist = [ "192.168.1.255" ];
          autoaddrlist = false;
        }
      ];
      servers = [
        # ...
      ];
    };
  };

  # ...
}

Status PVs¶

The PVA gateway can provide status and statistics PVs. To enable them, set the services.pva-gateway.settings.servers.*.statusprefix option, for example:

pva-gateway.nix — Enabling status PVs¶

{
  servers.pva-gateway = {
    enable = true;
    settings = {
      clients = [
        # ...
      ];
      servers = [
        {
          name = "server10";
          # ...
          statusprefix = "GW:STS:";
        }
      ];
    };
  };

  # ...
}

Restricting PVs¶

By using the services.pva-gateway.settings.servers.*.pvlist option, you can filter which PVs get exposed by the gateway.

This option takes a file in the gateway pvlist format. See PVList File in the P4P documentation.

In the configuration¶

For example:

pva-gateway.nix — Adding a PV list inline¶

{ pkgs, ... }:
{
  services.pva-gateway = {
    enable = true;
    settings = {
      clients = [
        # ...
      ];
      servers = [
        {
          name = "myserver";
          # ...
          # These PVs get exposed by the gateway
          # This list implements a "blocklist":
          # ALLOW by default, some PVs explicitly DENY.
          # Note that the PVA gateway doesn't currently supports "EVALUATION ORDER DENY, ALLOW"
          pvlist = pkgs.writeText "gateway.pvlist" ''
            EVALUATION ORDER ALLOW, DENY

            .* ALLOW

            MY_PV1 DENY
            MY_PV2 DENY

            # Or:

            MY_PV[0-9]+ DENY
          '';
        }
      ];
    };
  };
}

In a separate file¶

For long lists, it can be better to put it in a separate file. You can do this by adding a gateway.pvlist in the same directory as your configuration, and set:

pva-gateway.nix — Adding a PV list as a separate file¶

{
  services.pva-gateway = {
    enable = true;
    settings = {
      clients = [
        # ...
      ];
      servers = [
        {
          name = "myserver";
          # ...
          # Make sure that the value is *not* quoted,
          # and make sure to `git add` the file.
          pvlist = ./gateway.pvlist;
        }
      ];
    };
  };
}