Install HotLoop Edge 4.18.10

HotLoop Edge first shipped in 4.18.10. The image is ghcr.io/hotloop-io/hotloop-edge:4.18.10, built for amd64, arm64 and arm/v7, and the chart is hotloop-edge in the same Helm repository as the rest of the lineup. Both pull with no login. There is no Docker or Compose path, on purpose, and a bare podman run from a shell that dies with the session isn’t an install.

A cluster gets Helm. An industrial PC or a Pi with no cluster gets Podman Quadlet. The database is a choice you make once: TimescaleDB (the default), plain PostgreSQL, or a SQLite file with no database container at all.

Helm

helm repo add hotloop https://hotloop.io/hotloop
helm repo update
helm install hotloop hotloop/hotloop-edge --version 4.18.10 \
  --namespace hotloop --create-namespace

Call the release hotloop whichever product it is. The release name is what the database’s volume, the Secrets and the Service are named after, and keeping it is what lets a site move up a product later.

That deploys Edge plus TimescaleDB 2.30.1 beside it on a 20 Gi volume, keeping 90 days of history. The chart generates the database password, the MCP token and an admin password into the release Secret, and reuses them on every upgrade. It generates <release>-secret-key too, the key that encrypts every device password HotLoop keeps. That key is part of your data, and the Gateway install page says why and how to back it up. It is the same key.

For plain PostgreSQL or a SQLite file, set database.type to postgresql or sqlite when you install. A SQLite file is one writer on one local disk, so it is one replica and never NFS. Moving between databases later is a backup and a restore, because the new database starts empty. Backups has the restore.

Sign in

The user is admin. The install notes print the command that reads the password back:

kubectl -n hotloop get secret hotloop \
  -o jsonpath='{.data.admin-password}' | base64 -d
kubectl -n hotloop port-forward svc/hotloop 8080:8080

Open http://localhost:8080. Writes ship off: every tag is read-only until somebody arms it, and safety.allowWrites stays false until you decide this box gets to move machinery. The write gate has every check, in order.

What Edge adds, and how to turn it on

Both are off by default, because opening a listener or an uplink on a plant network is something a deployment does on purpose.

The OPC UA server is opcuaServer.enabled: true, on port 4840. Set opcuaServer.endpointHost to the name a client reaches the box at, so the certificate matches it. The OPC UA server has the security model, and it is read-only.

Sparkplug publishing is edgePublish.enabled: true, with edgePublish.broker and edgePublish.group required. Set edgePublish.node too, or the node id is the release name. The forward queue lives on a 1 Gi volume, edgePublish.queueMaxBytes defaults to 64 MiB (about two and three quarter minutes at 2,000 readings a second, at about 180 bytes a reading), and past it the oldest readings are dropped and counted. 0 is unbounded, and a long enough outage then fills the volume. Edge publishing needs replicaCount 1, and the chart refuses to render otherwise. Edge publish and store-and-forward has what it does when the uplink dies.

What to set before a real plant sees it

Value	Default	Why you’d touch it
plant.name, plant.siteId	HotLoop, empty	What the plant is called on screens, in pages, and to other sites.
global.timezone	America/New_York	Schedules and shift changes run on it. It has to be a real zone name.
publicUrl	empty	The address a phone on the plant Wi-Fi reaches HotLoop at. Without it, notifications have no link back.
safety.allowWrites	false	The master switch. Off, nothing writes to a machine, from anywhere.
historian.retentionDays	90	Days of history kept.
database.postgresql.persistence.size	20Gi	Your history lives here. Size it for your tag count and the retention above.
opcuaClient.persistence.enabled	false	Turn it on before you add a secured OPC UA device, so the client’s certificates survive a restart.
secretKey.existingSecret	empty	A Secret you manage holding the device password key. Set it if you render the chart with helm template.

Podman Quadlet

Quadlet turns the containers into real systemd services: they start on boot with nobody logged in, restart when they die, and log to the journal. It needs Podman 5.0 or newer. Raspberry Pi OS Bookworm ships 4.3, which has no Quadlet at all, so a Pi wants Trixie or newer. Put the database volume on a USB SSD and not the SD card.

The units are in the edge/ directory of the HotLoop repository, under deploy/quadlet/, and they have the same names as IoT’s and the Gateway’s. Podman Quadlet explains each file.

sudo cp hotloop.network hotloop.container hotloop-db.container \
  hotloop-db.volume hotloop-data.volume /etc/containers/systemd/

openssl rand -hex 24 | sudo podman secret create hotloop-db-password -
sudo podman run --rm ghcr.io/hotloop-io/hotloop-edge:stable gen-secret-key \
  | sudo podman secret create hotloop-secret-key -
printf '%s' 'a long admin password' \
  | sudo podman run --rm -i ghcr.io/hotloop-io/hotloop-edge:stable hash-password \
  | sudo podman secret create hotloop-admin-password-hash -

sudo systemctl daemon-reload
sudo systemctl start hotloop.service
sudo systemctl status hotloop.service hotloop-db.service
curl -s localhost:8080/api/status

Then open http://<this box>:8080 and log in as admin. Keep a copy of the key somewhere that isn’t this box, because losing it means typing every device password in again.

The unit publishes only port 8080. When you switch the OPC UA server (4840) or the embedded MQTT broker (1883) on, add a PublishPort= line for it to hotloop.container. The Quadlet unit keeps 90 days of history by default, the same as the chart.

Want plain PostgreSQL on Edge? It is the TimescaleDB unit with Environment=HOTLOOP_HISTORIAN_TIMESCALE=false added to hotloop.container. Want a SQLite file? Use the files in edge/sqlite/ and nothing from the directory above, because they share unit names: it is hotloop.container and hotloop-data.volume, and two secrets, hotloop-secret-key and hotloop-admin-password-hash.

The unit follows :stable, and Podman moves it once the timer is on:

sudo systemctl enable --now podman-auto-update.timer

A new image migrates the database on its way up, and if it can’t start, Podman puts the previous one back. The database container does not follow :stable, on purpose. The :stable auto-update says what an update does, what a rollback cannot undo, and how to hold updates until you say. Take a backup before you turn updates on.

Moving up a product

IoT to Edge to the Gateway keeps every device, tag, entity, automation, alarm, user and hour of history. On Quadlet it is copying the bigger product’s hotloop.container and hotloop-db.container over yours, and the lineup has the Helm form. The Quadlet move has been run, IoT then Edge then the Gateway on one database volume. The same move as a helm upgrade on a real cluster, and going back down a product, have not been run, so don’t take a box you care about down a product.

What has and hasn’t been run

The Edge Quadlet units are generated from the Gateway’s, which were run for real, rootless under systemd, including an update that migrates and then can’t start and gets rolled back. The Edge units themselves were compared to the Gateway’s, not started under systemd on their own. A real Pi under systemd as root, and the 32-bit arm images on real hardware, haven’t been done yet. This page will say so when they are.

License

HotLoop Edge is under HotLoop’s Business Source License 1.1. Home and lab use is free, and business use is free through EmberNET. See the License page and Using HotLoop in a business.