Raylux Nexus

Appearance

First run ​

A freshly installed Nexus has no user accounts. Until you create the first administrator, it serves a one-time setup wizard and nothing else.

Open Nexus ​

From a browser:

http://<nexus-host>:8080/

or, if you prefer to start on HTTPS and accept the certificate warning:

https://<nexus-host>:8443/

Both are open by default. See Certificates and HTTPS for why, and how to turn cleartext off once you have a real certificate.

"Raylux Nexus is starting"

If you get a starting page instead of the wizard, Nexus is still coming up — it warms its files on first boot and that takes longer than later starts. The page refreshes itself when Nexus is ready.

Create the administrator ​

The wizard asks for a username and password.

From the Nexus machine itself, that is all it asks. Anyone who can open a connection from the machine can read its data directory anyway, so demanding a secret there protects nothing.

From any other machine, it also asks for a one-time token. Read it from the Nexus:

powershell
type C:\ProgramData\Raylux\raylux_first_boot.txt
bash
sudo cat /var/lib/raylux/raylux_first_boot.txt

The token authorises one request. It is not a password and it is not used again. Once an administrator exists the file is inert — delete it.

Behind a reverse proxy you will be asked for the token even locally

A proxy makes every request appear to come from Nexus itself. Nexus treats any request carrying an X-Forwarded-* header as remote, precisely so a proxy cannot hand the no-secret path to everyone who can reach it. This is working as intended; read the token and carry on.

Choose the password carefully ​

Nexus does not impose a minimum length. That is deliberate — it is your policy to set, not ours — but it means nothing will stop you choosing a weak one, and this is the most valuable credential in the installation:

  • It is the account that can create every other account.
  • Nexus listens on all network interfaces by default.
  • This window cannot be re-opened. There is currently no supported way to recover a Nexus instance whose only administrator password has been lost, short of editing the user file by hand on the server.

Use something long, store it in your password manager, and create a second administrator account as soon as you are signed in.

Commissioning over plain HTTP from another machine

If you complete this wizard over http:// from a remote machine, the password crosses the network in the clear. Nexus allows it — plant networks are commonly isolated at commissioning time and refusing would break the ordinary workflow — but it records the event in the audit log so the question "was that password ever exposed?" has an answer later.

If the network is not one you trust, use https:// on 8443 and accept the certificate warning. The warning is about the certificate being self-signed, not about the connection being unencrypted.

After commissioning ​

Sign in with the account you just created. You should land on Nexus's Overview page.

Next steps, in the order most sites do them:

  1. Install a real certificate so browsers stop warning and you can turn off plain HTTP.
  2. Work through the hardening checklist before the Nexus carries production traffic.
  3. Set up backups.
  4. Install Studio on an engineering workstation and connect it to this Nexus.