Edge configuration¶

Use an Edge's Config tab to choose its template, set its variables, override settings for this Edge only, and check the configuration it will receive.

Owners and Admins can save changes.

How settings combine¶

Each Edge receives one configuration, built from these layers. A later layer wins when two layers set the same field.

Order	Layer	Where you edit it
1	Organization	Watchtower API only
2	Template	Templates page. See Templates.
3	Site	Watchtower API only
4	Group	Sites page, Config on the group. See Sites and groups.
5	Edge	Edge page, Config tab

The template is the one chosen on the Edge's Config tab, or else the one chosen on its group. A section that no layer sets gets a default, for example log level info and an empty LAN Reach list.

Edit the Edge's override¶

Open Edges, open the Edge and choose the Config tab.

Set the fields:

Field	What it does
Template	The template for this Edge. None uses the group's template.
Version (blank is latest published)	Leave blank to follow the latest published version. Enter a number to pin a version, for example to test a draft on this Edge.
Variables, one name=value per line	Variable values for this Edge.
Overrides JSON	A JSON object applied on top of all other layers.

Click Save layer. The change goes to this Edge at once.

Override rules¶

Objects combine field by field. Set only the fields you want to change.
null removes an inherited field.
Plain values and lists replace what is inherited, except these lists, which combine by id: assets by asset_id, an asset's metrics by name, and LAN Reach entries by id.

Change one inherited metric without repeating the rest of the asset:

{
  "assets": {
    "assets": [
      { "asset_id": "tank-plc", "metrics": [ { "name": "tank_level", "unit": "mm" } ] }
    ]
  }
}

Remove an inherited LAN Reach entry by writing the list as an object keyed by id:

{ "lan_reach": { "whitelist": { "old-hmi": null } } }

Warning

If no layer sets the agent section, an override such as {"agent":{"log_level":"debug"}} fails, because the section is then incomplete. Set the whole agent section, or set it on the template's Agent tab.

Set variables¶

Enter one name=value per line. A value that is valid JSON is read as JSON, otherwise as text.

plc_ip=192.0.2.20
plc_port=502

Watchtower uses the Edge's value first, then the group's value, then the template default. If a required variable has no value, the Edge keeps its current configuration and the error variable <name> is not set for edge <id> appears on the Sync cell.

Use secrets¶

Configuration never contains plain-text passwords. Wherever a field takes a password, enter a secret reference:

{ "password": { "secret": { "ref": "sec_4fK2pQ9xLm7Rt1Vb" } } }

Create secrets with the Watchtower API (POST /api/v1/secrets with name, scope_kind, scope_id and plaintext) using an API token. See Settings and API tokens. Watchtower never shows a secret value again, and encrypts it for each Edge that uses it.

Preview the result¶

Click Preview render. The preview uses the saved layer, so save first. It shows:

Overrides against inherited: the lines your override changes.
Problems, each as a field path and a message. Fix them before you expect the Edge to update.
Effective document: the complete configuration the Edge will receive. Secrets appear as references.

Check that the Edge applied it¶

Open Edges and read the Sync column. Hover the cell to see an error message.

Sync	Meaning	What to do
In sync	The Edge confirmed the latest configuration.	Nothing. If the cell shows an error on hover, your latest change was not delivered; fix it and save again.
Pending	Waiting for the Edge to apply and confirm.	Wait. A rollout can take longer.
Failed	The Edge refused the configuration and kept its current one.	Read the error, fix the setting, save again.
Rolled back	The Edge applied the change, could not confirm it, and returned to the previous configuration.	See below.
Offline	The Edge is not connected. It receives the newest configuration when it reconnects.	Check the Edge's network.

What a rollback means¶

After applying a change, the Edge waits for Confirm timeout seconds (default 120). It keeps the change only if it is still connected to Watchtower at the end and, when Roll back when a connector fails is on, every asset the change restarted has connected. Otherwise it returns to its previous configuration and keeps running. A wrong IP address or a network change that cuts the Edge off is a typical cause. Correct the change and save again. On slow links, raise Confirm timeout seconds on the template's Agent tab.