Packages

FAQ › EUZOS Server › Packages · Nederlands

What is it?

What an EUZOS Server does is decided by its packages. A package is either a role (code in the EUZOS Server kernel, switched on by a config file in \EOS\FW\) or an app (a signed package from the profile server's app catalogue, installed into apps/ on partition 2). All packages are in one list, euzos_install::server::PACKAGES; the installer and the packages command show that list automatically.

Finished today: Workplace management (werkplek), the local EUZOS workplace server managed with Server Admin; the Package cache (cache), which serves apps (such as Chromium) to the PCs in the network on top of it (Package cache); the File server (files): shared folders for the EUZOS PCs, see File server; the Web server (web): static sites and a reverse proxy with certificates from Let's Encrypt (see Web server); and Backup (backup): encrypted backups of the PCs to the server (Backup). A later package is shown as "Coming soon" until it is finished.

Id	Title	Kind	State
`werkplek`	Workplace management	role (`WORKPLC.TXT`)	available, on by default in the installer
`web`	Web server	role (`WEB.TXT`)	available, off by default; ports 80 and 443 (Web server)
`files`	File server	role (`FILES.TXT`, port 8447)	available, off by default in the installer; needs Workplace management (File server)
`backup`	Backup	role (`BACKUP.TXT`)	available, off by default in the installer; port 8448; see Backup
`dns`	DNS	role (`DNS.TXT`)	available, off by default; UDP and TCP 53, LAN only (DNS)
`cache`	Package cache	role (`CACHE.TXT`), needs Workplace management	available, on by default in the installer; see Package cache

How do I…?

How do I see which packages are on?

packages on the console, or Packages (serveradmin <server> packages) in Server Admin. The console shows each package with its kind and state: on (with the name), off (disabled with Server Admin), not set up, or coming soon.

How do I set up Workplace management after installation?

The installer does it if you chose the package. By hand: workplace setup [name] writes WORKPLC.TXT (role=workplace, the name) and creates the keys WPKEY.TXT and WPTLS.TXT; it never overwrites existing files. Then reboot, and register the workplace server on the profile server (workplace shows the public key to register; see Organisations).

How do I turn a package on or off?

With Server Admin on an EUZOS PC:

serveradmin <server> packages
serveradmin <server> package-on <id>
serveradmin <server> package-off <id>           shows what will happen
serveradmin <server> package-off <id> confirm   and does it

Turning off needs confirmation (the server refuses without it, confirmation_needed) and closes the package's ports in the firewall (Workplace management: the cache port 8445). A rule that also allows the admin protocol stays and is reported. Workplace management off means: no cache (the cache port refuses), but sign-in and management stay, so it can be turned on again. Stored as package=off in WORKPLC.TXT (legacy pakket=uit is still read).
Turning on does not open the firewall; the reply names the rule to open: firewall-open allow tcp 8445 lan.
Coming-soon packages cannot be turned on (pakket_binnenkort).
Every change goes into the server's log (log in Server Admin): who, from which PC, and what happened to the firewall.

workplace now on the console (or fill in Server Admin). Normally the server signs in at the profile server every 30 minutes and checks the catalogue for new app versions.

How do I see the state of the workplace server?

workplace (or workplace status): role, port and apps, whether the package is off, organisation or registration code from the installer, the public key and fingerprint, the TLS pin, the LAN address, the sign-in state, the last message, the cache contents and the traffic.

Why is a role "downloaded" only with a new release?

There is no module loader: loading role code at run time would enlarge the attack surface. A role arrives with a new signed EUZOS Server release (fetch/install). What needs no kernel rights can be an app from the catalogue, like Server Admin and Chromium, updated separately.

Details

Workplace management (the workplace server)

When \EOS\FW\WORKPLC.TXT says role=workplace (legacy rol=werkplek; the value werkplek is also accepted) and the server boots from its internal disk, crate::packages::start starts the role (crate::workplace::start): no login screen and no desktop, but the console, network, NTP and:

sign in at the profile server of PROFILE.TXT with the workplace key (WPKEY.TXT, Ed25519): a challenge, then a signed message (EUZOS-werkplek-aanmelden-v1); repeated every 30 minutes (sooner after an error). This gives a workplace token, the public download key and the organisation; the profile server learns the LAN address and the TLS pin.
fill the cache: each app from apps= in WORKPLC.TXT (default chromium) is fetched with the same code as on a PC into apps/ on partition 2 (signature, version, SHA-256, block hash), with a download token obtained via the workplace token. Not when Workplace management or the Package cache is off; quota, LRU and on-demand filling: Package cache.
an HTTPS server on the cache port (default 8445; TLS 1.3 with the P-256 key from WPTLS.TXT; the PC pins the key) serving GET|HEAD /<app>/<version>/<file> with the PC's download token and one Range. At most 16 connections at the same time, 4 per address.
the admin protocol on TCP 8446 for Server Admin (see Server Admin).

Secrets (keys, tokens) never go into the log. The log keeps the last 200 lines.

Reference

Console commands

Command	Arguments	What it does
`packages`	–	the server packages, kind (role/app), description and state. Legacy aliases: `pakketten`, `pakket-lijst`
`workplace`	– or `status`	the state of the workplace server (`status_text`)
`workplace setup`	`[name]`	write `WORKPLC.TXT` and create `WPKEY.TXT` / `WPTLS.TXT` (existing ones stay); in a test build with sshd running also `dev-ssh=yes`. Legacy alias: `inrichten`
`workplace now`	–	sign in and check the cache shortly (only when the role runs). Legacy alias: `nu`

werkplek is the legacy alias of workplace. On the desktop, workplace and packages answer "only in EUZOS Server".

Functions and modules

Item	Role
`euzos_install::server::PACKAGES`, `Package`, `Kind::{Role, App}`	the package list; `can_enable`, `ports`, `default_on`
`euzos_install::server::files`	the files of the chosen packages for the installer (role files with `role=<id>`, `PACKAGES.TXT` for apps)
`crate::packages::start`	at boot from the SSD: start the set-up roles
`crate::packages::state`	`aan`, `uit`, `niet-ingericht`, `binnenkort`
`crate::packages::text`	the list for Server Admin
`crate::packages::set`	turn on/off from Server Admin; closes ports via `crate::net::firewall::close_ports`
`crate::packages::command`	the `packages` console command
`crate::workplace::{role, start, command, set_package, package_on, cache_port}`	the Workplace management role
`crate::workplace::sign_in`, `fill`, `listen`, `serve`, `respond`	sign-in, cache filling, the HTTPS server
`euzos_workplace::role::{read, write, Role}`	read/write `WORKPLC.TXT`
`euzos_workplace::login::Login`	the signed sign-in message
`euzos_workplace::token::check`	check a download token on the cache port

Config files

File	Key	Values	Meaning
`\EOS\FW\WORKPLC.TXT` (legacy name `WERKPLEK.TXT`, still read)	`role` (legacy `rol`)	`workplace` (legacy `werkplek`)	without it the machine is an ordinary PC
	`name` (legacy `naam`)	text ≤ 64 characters	the name (default `EUZOS Server`)
	`port` (legacy `poort`)	≥ 1024	the cache port (default 8445)
	`apps`	comma list, ≤ 4 names (a–z, 0–9, `-`, 1–8 characters)	apps kept in the cache (default `chromium`)
	`address` (legacy `adres`)	IPv4	the LAN address for the PCs (default: the server's own address)
	`dev-ssh` (legacy `ontwikkel-ssh`)	`yes` (legacy `ja`)	test build only: SSH during development
	`organization` (legacy `organisatie`)	text	the organisation entered in the installer (a hint; the profile server decides)
	`registration-code` (legacy `registratiecode`)	4–32 letters, digits, `-`	registration code from the installer (pairing with a code is planned)
	`package` (legacy `pakket`)	`off` (legacy `uit`)	the package was turned off with Server Admin
`\EOS\FW\WPKEY.TXT`	–	64 hex	Ed25519 seed of the workplace key (secret)
`\EOS\FW\WPTLS.TXT`	–	64 hex	P-256 key for TLS (secret)
`\EOS\FW\PACKAGES.TXT` (written before 27-10-2026 as `PAKKETTEN.TXT`)	`apps`	comma list	app packages to fetch after the first boot; nothing reads it yet (no app package exists for the server yet: planned)

EUZOS writes the English keys and values and still reads the legacy Dutch ones (a Dutch key and its English one count as the same key).

API endpoints

Called by the workplace server on the profile server (details in API); the kernel uses the legacy paths:

Method	English path	Legacy path (used now)	Purpose
POST	`/api/workplace/v1/challenge`	`/api/werkplek/v1/uitdaging`	get a challenge (`sleutel=<public key>`)
POST	`/api/workplace/v1/sign-in`	`/api/werkplek/v1/aanmelden`	the signed sign-in message
POST	`/api/workplace/v1/download-token`	`/api/werkplek/v1/downloadtoken`	a download token for filling the cache

Served by the workplace server on the cache port (default 8445):

Method	Path	Request	Reply
GET, HEAD	`/<app>/<version>/<APP>.APP`	`Authorization: Bearer <download token>`, optional `Range`	the app descriptor (`text/plain`)
GET, HEAD	`/<app>/<version>/<APP>.APP.sig`	same	the signature
GET, HEAD	`/<app>/<version>/<package file>`	same	the package; 200, 206 (range) or 416

Errors: 404 not_in_cache (not that version in the cache), 404 pad (unknown file), 503 klok (no clock), and the token errors of euzos_workplace::token.

Protocol messages and formats

Sign-in message (EUZOS-werkplek-aanmelden-v1), lines omgeving=, server=, sleutel=, uitdaging=, tijd=, lan= (https://<IPv4>:<port>/), tls= (SHA-256 of the SPKI), naam=, then handtekening= (Ed25519 over <kind>\0 + everything before that line).
Download token: ezdl1.<kid>.<app>.<version>.<exp>.<jti>.<account>.<signature>, Ed25519 over EUZOS-downloadtoken-v1\0 + everything before the last dot; valid at most 2 hours (+5 minutes slack).
Package list for Server Admin (packages::text): one line per package pakket=<id>\t<title>\t<state>\t<description>, state aan, uit, niet-ingericht or binnenkort.
Reason codes of packages::set: pakket_onbekend, pakket_binnenkort, confirmation_needed, package_not_installed, geen_rol.

These field names, states and codes are wire format and stay Dutch.