Prosys OPC UA Simulation Server - Headless (Docker) - 2026.2.0-38
========================================================================

A ready-to-run Linux container image of the headless Simulation Server, plus a launcher
script. Nothing to build - the launcher loads the included image tar and starts a container
named "simulation-server".

Use the archive that matches your Docker host: docker-amd64 or docker-arm64v8.
Requires Docker (Engine or Desktop).


Contents
--------
  docker-image/                       The image tar, plus its id, digest and manifest
  bin/simulation-server-docker.sh     Launcher (Linux/macOS)
  bin/simulation-server-docker.ps1    Launcher (Windows)
  doc/                                User manual (PDF)
  license/                            License agreement and third-party licenses
  sbom/                               Software Bill of Materials (CycloneDX)


Quick start
-----------
An Evaluation or Professional license is required, and the launcher reads its path from
SIMSERVER_LICENSE. A Project is optional: without one the server starts with the default
settings. Export a Project from the desktop application and set SIMSERVER_PROJECT to load it.

Linux/macOS:

         export SIMSERVER_LICENSE=/path/to/license.lic
         ./bin/simulation-server-docker.sh

Windows (PowerShell):

         $env:SIMSERVER_LICENSE = "C:\path\to\license.lic"
         powershell -ExecutionPolicy Bypass -File bin\simulation-server-docker.ps1

The launcher loads the image and runs the server in the foreground, publishes OPC UA port
53530, and prints what it is using as it starts. See "Launcher environment variables".


Setup
-----
The container takes a license, and optionally a Project and a certificate folder:

  License      --license <file>     Required. Read-only, read once at startup.
  Project      --project <file>     Optional, read-only. Read at every start, and not
                                    written unless --save-project is given.
  Certificates --pki-dir <dir>      Optional, and must be writable if given. Holds PKI/,
                                    the server's own certificate and the client application
                                    certificates it trusts, and USERS_PKI/, the certificates
                                    used for certificate-based user authentication. Without
                                    it the stores go to the data directory inside the
                                    container and are discarded with it.

Logs go to the container output.


Running it with docker run
--------------------------
The launcher is only an example - the image is an ordinary container image and runs directly.

Load the image:

         docker load -i docker-image/prosys-opc-ua-simulation-server-2026.2.0-38-image.tar

A test or CI run, keeping nothing between runs. Each run makes a new server certificate; leave
out --project to start with the default settings:

         docker run --rm \
             -p 53530:53530 \
             -v "$PWD/license.lic:/license/license.lic:ro" \
             -v "$PWD/project.uasim:/project/project.uasim:ro" \
             prosys-opc-ua-simulation-server:2026.2.0-38 \
             --headless --license /license/license.lic \
                --project /project/project.uasim

A deployment that keeps its server certificate when the container is replaced: a writable
--pki-dir and a fixed hostname (see "License and hostname").

         docker run -d --name simulation-server --stop-timeout 15 \
             --hostname simserver-1 \
             -p 53530:53530 \
             -v "$PWD/project.uasim:/project/project.uasim:ro" \
             -v "$PWD/license.lic:/license/license.lic:ro" \
             -v simserver-pki:/pki \
             prosys-opc-ua-simulation-server:2026.2.0-38 \
             --headless --project /project/project.uasim \
                --license /license/license.lic --pki-dir /pki

Stop the server with:

         docker stop -t 15 simulation-server

With --save-project the Project is written during the shutdown; a shorter timeout, or killing
the container, loses everything since the last autosave - up to a minute of changes.

For the full list of server options and exit codes:

         docker run --rm prosys-opc-ua-simulation-server:2026.2.0-38 --help


Saving changes to the Project
-----------------------------
By default the Project is read at every start and never written, so changes made while the
server runs are lost on restart. The Project file, and its mount, can be read-only.

To save changes instead, set SIMSERVER_SAVE_PROJECT=1 for the launcher, or pass --save-project
to docker run. The server then saves the Project while it runs, and again when it stops. It
saves into the Project's folder, so mount the FOLDER and allow writing to it, not just the
file:

         -v "$PWD/myproject:/project" ... --headless --project /project/project.uasim --save-project


License and hostname
--------------------
The license file is read once at startup from wherever --license points. It is never copied or
changed, so it can be read-only, and it is never included in the image.

A Professional license can be tied to the container hostname. With such a license, set
SIMSERVER_HOSTNAME (or docker run --hostname) to the licensed hostname.

A fixed hostname also keeps the server certificate stable when --pki-dir is reused: the
certificate is stored under a name that contains the hostname, so a different hostname always
means a new certificate, and the earlier one is used again if the hostname comes back.
Disposable runs do not need one. The trusted client and user certificates are unaffected.


Ports
-----
The server listens on a single OPC UA TCP port, 53530 by default, and the launcher publishes
it. If your Project uses another port, either change the -p option in the launcher or pass
--port to make the server use the published one.


Client certificates
-------------------
To trust client certificates headlessly, either:

  * Add the certificate yourself: mount a --pki-dir folder and move the certificate from
    PKI/CA/rejected into PKI/CA/certs.
  * Pass --trust-all-certificates (-T) to trust presented client application certificates
    without prior approval. The certificates are still validated, so an expired or otherwise
    invalid one is rejected.
  * Pass --accept-all-certificates (-A) to skip client certificate validation entirely, so
    expired, revoked and malformed certificates are accepted too. Overrides -T.

Neither changes user authentication.


Launcher environment variables
------------------------------
Only used by the launcher scripts.

  SIMSERVER_LICENSE           Required. Path to a license.lic. Mounted read-only at
                              /license/license.lic and passed with --license.
  SIMSERVER_PROJECT           Path to a .uasim Project file. Its folder is mounted at
                              /project, read-only, or writable with SIMSERVER_SAVE_PROJECT=1.
  SIMSERVER_PKI               Folder mounted at /pki for the certificate stores
                              (default: pki/ in the distribution root).
  SIMSERVER_HOSTNAME          Hostname to give the container (see "License and hostname").
  SIMSERVER_SAVE_PROJECT=1    Save changes back into the Project (see "Saving changes to the
                              Project").
