SENTRA GUARD
Datasheet for the multi-tenant orchestrator that runs SENTRA as a service (version 1.25).
Version: 1.25 · Layer: Orchestrate · Type: multi-tenant control plane
SENTRA GUARD runs SENTRA as a service. It onboards customers, provisions a firewall for each on the operator's nodes, watches node health and bandwidth live, moves customers between nodes, and handles licences, billing, alerts and access. GUARDs are named OTG-OR-01, OTG-OR-02, ….
Key capabilities#
| Area | Capabilities |
|---|---|
| Dashboard | Live radar cockpit with the hierarchy of nodes and firewalls; hover bandwidth for a bandwidth and latency graph; uplink, live threats and fleet health |
| Customers | Onboard customers with plan, contacts and KYC; one firewall per customer — Web App · ATS (website or API) or Internet · NTS (internet line / IP block); suspend, resume, close; customer self-service portal (My firewall, support tickets) |
| Instances | Every provisioned engine with state, mode (Monitor / Enforce) and node; move a firewall between nodes |
| Nodes | Register servers and VMs (one-time install command and agent token), live health, CPU, memory, uplink bandwidth and latency, capacity, drain, remove; per-node update policy and roll back |
| Security | Threats stopped across every firewall |
| NTS policies | Ready policies and templates with revisions, pushed to chosen NTS nodes |
| Licensing | This GUARD's licence and every box licence; acts as a signing authority certified by the SENTRA Licensing Authority, licensing its boxes automatically within its limits |
| Approvals | Maker-checker: sensitive actions need a second master admin; no self-approval |
| Billing | Plans and prices (or the price book pushed from VIEW), monthly billing run, invoices, payments, void; currency; Billing on this GUARD or Billing from VIEW |
| Reports | Build, save and schedule reports; print, PDF or CSV |
| Console | Run commands on a node (master admin only) |
| Users & roles | Fully customisable roles (35 permissions in 12 groups; built-in Master Admin), two-factor sign-in, password policy; who may sign in to each ATS / NTS box and with which role |
| Settings | Organisation, notifications and alerts (webhook, risk threshold, node-down alerts, daily digest), security policy, firewalls (dashboard addresses, GUARD public address, automatic firewall updates), integrations, billing defaults, SENTRA VIEW link, software updates, backups, system |
Working with and without VIEW#
- On its own a GUARD is a complete system: customers, nodes, billing, users and licensing.
- Linked to VIEW, it sends VIEW a snapshot every 2 seconds and carries out VIEW's changes through its own rules. If VIEW is unavailable the GUARD keeps working and catches VIEW up when it returns.
- Prices become read-only once VIEW pushes a fleet price book; with Billing from VIEW only VIEW bills its customers.
Deployment#
| Option | Description |
|---|---|
| From SENTRA VIEW | Deploy new orchestrator prepares the GUARD, with the billing mode chosen at deployment |
| Stand-alone | Installed on its own server, licensed by the SENTRA Licensing Authority |
Requirements#
| Item | Requirement |
|---|---|
| Operating system | Linux with systemd; Debian/Ubuntu (apt) for the installer |
| Runtime | Python 3.8 or newer with venv (installed by the installer) |
| Database | SQLite by default; PostgreSQL for production (SENTRA_PANEL_DB) |
| CPU / RAM / disk | Sized per deployment — contact SENTRA |
| Network | Reachable by its nodes at its public address; outbound to its VIEW when linked |
Ports and protocols#
| Port | Use |
|---|---|
| 8000 (TCP, HTTP) | Console and API; node agents (configurable, OTG_PORT) |
| 8443 (TCP, HTTPS) | Built-in HTTPS for the console, self-signed or your own certificate (OTG_HTTPS_PORT) |
| Outbound to VIEW | Link to SENTRA VIEW (GUARD connects out) |
Node agents connect to the GUARD (polling every 10 seconds by default); the GUARD never needs to reach into a node.
Licensing#
A GUARD licence carries seats and a tier. With an authority certificate from the Licensing Authority (or from its VIEW), the GUARD issues chained keys for its ATS and NTS boxes within its limits and reports them back.
Management and security#
Two-factor sign-in, customisable roles, maker-checker approvals, audit log of every action, nightly backups of the GUARD and every node under it (sent to VIEW and/or an extra S3, SFTP or folder destination, sealed with the GUARD's backup key), signed releases from VIEW (can be locked to signed releases only), and per-node control over updates.