Cloud enrolment — before the device goes out¶
A robot that has never spoken to the cloud can report nothing, be updated by nobody, and found again by no one. Enrolment happens in our building, on our network, before the device is packed.
What enrolment consists of¶
1. The device makes itself a key pair. Private part stays on the device, readable only by the service, file permissions 0600. It never leaves the device — not to us, not to the cloud, not into a backup.
2. It reads its serial number from the chassis. That number is the identity throughout the whole system: in the fleet, in the log, in the cloud, on the delivery note. It is not invented and not entered by hand.
3. It sends a certificate request. Together with a joining code that a technician gets from the console and that is valid once. The joining code is the only moment a human is involved.
4. The cloud issues a certificate and notes the device under a node of the
customer tree — for example urg/p-nord/k-klinik-sued/s-haus-3. From then on
every message from this device is signed and can be attributed.
5. The reset secret is issued. With it, and only with it, a forgotten technician password can be reset. It belongs in the password manager, never in a repository, a chat or a delivery note.
What must never happen
A private key, a joining code, a reset secret or a fleet key must not appear
in a log, in a report, in an export, in a chat or in a ticket. Export
Config JSON of the u-IoT module contains passwords in clear text — that
file is not an attachment.
Assignment to the customer tree¶
Enrolment is only complete once the device hangs under the right node. The
tree carries the path urg/p-…/k-…/s-…: partner, customer, site. Whoever sees
a node sees everything below it and nothing beside it.
A device that is enrolled but assigned nowhere shows up in the console under "not assigned". That is a valid intermediate state for exactly as long as the technician needs to correct it — not a state a device is delivered in.
What is checked before packing¶
| Check | Expected |
|---|---|
| Certificate present and valid | yes, with expiry date noted |
| Device visible in the console | under the correct customer node |
| A test message arrives | state, within seconds |
| Fleet key set | only if the site runs more than one device |
| Technician password set | yes — the page says so itself if not |
| Reset secret stored | in the password manager, tied to the serial number |
| Maps on the device | only those of this customer |
| Map archive | no foreign customers |
The last two lines are not pedantry. A map carries floor plans of a building that does not belong to the receiving customer.