> For the complete documentation index, see [llms.txt](https://decentralabs-2.gitbook.io/decentralabs-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://decentralabs-2.gitbook.io/decentralabs-docs/lab-gateway/getting-started-and-deployment/docs.md). # Documentation guide This guide is the navigation entry point for Lab Gateway. Read it before choosing a deployment or changing environment variables. The current source of truth is the repository configuration and implementation; this documentation explains how to use them without duplicating internal implementation details. The [documentation contract](https://github.com/DecentraLabsCom/lite-lab-gateway/tree/main/docs/documentation-contract.md) defines ownership and the conflict-resolution order for cross-project flows. Use it before editing a workflow, API reference, installation guide or translation. | Cross-project concern | Owning document | | ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | Documentation ownership and conflict resolution | [Documentation contract](https://github.com/DecentraLabsCom/lite-lab-gateway/tree/main/docs/documentation-contract.md) | ## Audiences and boundaries The repository has a public documentation path and a local maintainer path: | Audience | Entry point | What belongs there | | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | Operators and laboratory providers | [Gateway README](/decentralabs-docs/lab-gateway/readme.md), this guide and `docs/` | Installation, deployment modes, public workflows, screenshots and safe operational checks. | | Backend integrators and control-plane operators | [`blockchain-services` index](https://github.com/DecentraLabsCom/lite-lab-gateway/tree/main/blockchain-services/SUMMARY.md) | API, authentication, billing, persistence, security and backend recovery. | | Maintainers | `dev/` (ignored/local-only) | Test baselines and implementation notes that support maintenance but are not public protocol contracts. | Private notes may point to implementation details, but the public owning document remains authoritative. When they disagree, follow the [documentation contract](https://github.com/DecentraLabsCom/lite-lab-gateway/tree/main/docs/documentation-contract.md), then update the private note or remove the duplicated passage. ## Core concepts | Term | Meaning | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Full Gateway** | A gateway with the embedded `blockchain-services` backend running as the credential issuer and provider control plane. | | **Lite Gateway** | A local access plane that trusts a remote Full or standalone issuer. It still provides Guacamole, Ops Worker, and optional FMU access for its laboratories. | | **Standalone backend** | A separately deployed `blockchain-services` instance that can be the issuer and provider control plane, but has no local browser-access plane. | | **Control plane** | Credential issuance, provider administration, on-chain transactions, access-code storage, and session evidence authority. | | **Access plane** | OpenResty, Guacamole, Ops Worker, and optional FMU services that serve one laboratory network. | | **Lab Station** | The Windows-side operational and execution environment. It is private; it is not a public API. | `ISSUER` selects the control plane. The lab's on-chain `accessURI` selects the access plane. Do not assume that the two URLs are the same. ```mermaid flowchart TD Start{Who issues credentials\nand administers providers?} Start -->|This Gateway| Full[Full Gateway\nISSUER empty] Start -->|Remote Full or standalone backend| Lite[Lite Gateway\nISSUER=https://issuer.example/auth] Full --> Local[Use local accessURI for local labs] Lite --> Remote[Configure each local accessURI\nand its explicit remote provisioner route] Local --> Optional{Need FMU or AAS?} Remote --> Optional Optional -->|FMU production| Station[Enable fmu-runner\nand configure Lab Station] Optional -->|AAS| AAS[Enable aas profile or configure an external AAS] Optional -->|Neither| Ready[Operate base stack] ``` For the complete design and trust requirements, read [Deployment architectures](/decentralabs-docs/lab-gateway/getting-started-and-deployment/deployment-architectures.md). ## Start by task ### Install a new gateway 1. Choose **Full** or **Lite** using the decision above. 2. Choose an installation method: * [Setup script — English](/decentralabs-docs/lab-gateway/getting-started-and-deployment/installation/install-setup-script.md) / [Español](/decentralabs-docs/lab-gateway/getting-started-and-deployment/installation/instalar-setup-script.md) * [Manual Docker Compose — English](/decentralabs-docs/lab-gateway/getting-started-and-deployment/installation/install-manual-compose.md) / [Español](/decentralabs-docs/lab-gateway/getting-started-and-deployment/installation/instalar-compose-manual.md) * [NixOS — English](/decentralabs-docs/lab-gateway/getting-started-and-deployment/installation/install-nixos.md) / [Español](/decentralabs-docs/lab-gateway/getting-started-and-deployment/installation/instalar-nixos.md) 3. Apply the [configuration reference](/decentralabs-docs/lab-gateway/getting-started-and-deployment/configuration.md). 4. Verify the base stack using [operations and health](/decentralabs-docs/lab-gateway/operations-and-verification/operations-and-health.md). ### Publish and operate a physical laboratory 1. Plan public and private network paths in [Laboratory connectivity](/decentralabs-docs/lab-gateway/architecture-and-connectivity/laboratory-connectivity.md). 2. Configure the Lab Station and the operations path in [Gateway and Lab Station operations](/decentralabs-docs/lab-gateway/architecture-and-connectivity/gateway-lab-station-operations.md). 3. Register the local power controllers and configure the laboratory policy in [Lab Manager energy operations](/decentralabs-docs/lab-gateway/architecture-and-connectivity/lab-manager-energy-operations.md). 4. Create the local Guacamole connection and retain its `guac:id:` access key with [Guacamole connections](/decentralabs-docs/lab-gateway/architecture-and-connectivity/guacamole-connections.md). 5. Follow the [first lab session tutorial](/decentralabs-docs/lab-gateway/institutional-workflows/tutorial-first-lab-session.md) or its [Spanish version](/decentralabs-docs/lab-gateway/institutional-workflows/tutorial-primera-sesion-laboratorio.md). ### Operate Lab Manager * Start with the [Lab Manager operator guide](/decentralabs-docs/lab-gateway/architecture-and-connectivity/lab-manager-operator-guide.md) for tabs, permissions, Full/Lite boundaries, identifiers, and recommended order. * Use [Labs and Operations](/decentralabs-docs/lab-gateway/architecture-and-connectivity/lab-manager-labs-and-operations.md) for publication, host provisioning, WinRM, reservations, and timeline diagnosis. * Use [Notifications](/decentralabs-docs/lab-gateway/architecture-and-connectivity/lab-manager-notifications.md) for Gateway-scoped reservation email settings. * Use [Energy operations](/decentralabs-docs/lab-gateway/architecture-and-connectivity/lab-manager-energy-operations.md) for controllers, credentials, outlets, policies, and power tests. ### Integrate an institutional access flow * [eduGAIN federation](/decentralabs-docs/lab-gateway/institutional-workflows/edugain-federation.md) explains the Full/control-plane SAML boundary. * [Institutional reservation workflow](/decentralabs-docs/lab-gateway/institutional-workflows/institutional-reservation-workflow.md) explains reservations and intent authorization. * [Check-in, access, and session workflow](/decentralabs-docs/lab-gateway/institutional-workflows/institutional-check-in-access-sessions.md) explains the opaque-code hand-off and session evidence lifecycle. * [Guacamole session policy](/decentralabs-docs/lab-gateway/architecture-and-connectivity/guacamole-session-policy.md) defines the distinct administrator, manual, and reservation-session rules. ### Offer an FMU or AAS resource * [FMI/FMU support](/decentralabs-docs/lab-gateway/digital-twins/fmi-fmu-support.md) is the public execution and proxy guide. * [AAS support](/decentralabs-docs/lab-gateway/digital-twins/aas-support.md) describes Asset Administration Shell metadata. * Component details live in [FMU Runner](/decentralabs-docs/lab-gateway/digital-twins/fmu-runner.md), [FMU data layout](/decentralabs-docs/lab-gateway/digital-twins/fmu-data.md), and [FMU proxy runtime](/decentralabs-docs/lab-gateway/digital-twins/fmu-proxy-runtime.md). ### Diagnose or verify a deployment * [Operations and health](/decentralabs-docs/lab-gateway/operations-and-verification/operations-and-health.md) — safe public checks, protected diagnostics, log locations, backups, and triage. * [OpenResty tests](/decentralabs-docs/lab-gateway/operations-and-verification/tests.md) and [integration tests](/decentralabs-docs/lab-gateway/operations-and-verification/integration.md) — test entry points. ## Documentation ownership | Subject | Primary document | | ------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Deployment topology and remote-Gateway trust | [Deployment architectures](/decentralabs-docs/lab-gateway/getting-started-and-deployment/deployment-architectures.md) | | Environment values and Compose profiles | [Configuration reference](/decentralabs-docs/lab-gateway/getting-started-and-deployment/configuration.md) and `.env.example` | | Browser/session access rules | [Check-in, access, and session workflow](/decentralabs-docs/lab-gateway/institutional-workflows/institutional-check-in-access-sessions.md) | | Guacamole timeouts and session semantics | [Guacamole session policy](/decentralabs-docs/lab-gateway/architecture-and-connectivity/guacamole-session-policy.md) | | Station networking and lifecycle | [Laboratory connectivity](/decentralabs-docs/lab-gateway/architecture-and-connectivity/laboratory-connectivity.md) and [Gateway and Lab Station operations](/decentralabs-docs/lab-gateway/architecture-and-connectivity/gateway-lab-station-operations.md) | | Lab Manager operator workflows | [Lab Manager operator guide](/decentralabs-docs/lab-gateway/architecture-and-connectivity/lab-manager-operator-guide.md), [Labs and Operations](/decentralabs-docs/lab-gateway/architecture-and-connectivity/lab-manager-labs-and-operations.md), and [Notifications](/decentralabs-docs/lab-gateway/architecture-and-connectivity/lab-manager-notifications.md) | | Energy credentials, controllers, outlets, and Lab Manager policies | [Lab Manager energy operations](/decentralabs-docs/lab-gateway/architecture-and-connectivity/lab-manager-energy-operations.md) and [Ops Worker README](/decentralabs-docs/lab-gateway/operations-and-verification/ops-worker.md) | | Backend APIs and security | [`blockchain-services` documentation](https://github.com/DecentraLabsCom/lite-lab-gateway/tree/main/blockchain-services/SUMMARY.md) | The backend documentation and implementation are under `blockchain-services/`. Its standalone and Gateway-integrated deployment modes are described in the backend deployment guide.