Appliances
This page is for vendors who sell Exponential inside a box: a hardware device, or a virtual machine the customer does not administer. An appliance is the bundle with the longest life and the least visible software, so its obligations need the most care.
Contents
- What makes an appliance different
- The GPL and a box
- First start
- Updates over the appliance's life
- Backups and data ownership
- Appliance checklist
What makes an appliance different
| Aspect | Appliance |
|---|---|
| Who administers the system | you, through your update channel |
| Who administers the site | the customer, in the Exponential administration |
| How long it runs | years |
| Network | sometimes none (Offline bundles) |
| Database | usually on the box: SQLite 3 for one machine (SQLite bundles) |
| Web server | Velocity, with its own TLS (Velocity in a bundle) |
The GPL and a box
An appliance distributes the GPL software on it. The customer must receive the license texts, the notices and the corresponding source, and you may add no restrictions the GPL forbids (GPL obligations). In practice:
- put the notices on the box's documentation and in its web interface (Info > Copyright stays reachable);
- publish or offer the source of the exact software image, for each image you ship;
- be careful with measures that stop an owner from changing the GPL software on a device they own; ask counsel which license versions of your components set rules for that.
This is not legal advice. OEM resale through the partner program is described on OEM and the partner program for bundlers.
First start
A setup screen of yours collects what the installer needs and calls it once (First boot and install once):
- the site's address, or the box's address if it has none yet;
- the administrator's e-mail;
- the administrator password: generated (shown once) or typed by the owner, at least
MinPasswordLength(10) and not well known; - then
exp:installwith those values, and the setup screen disables itself.
Updates over the appliance's life
- Security fixes for Exponential come "on the
mainbranch ... and published with the next 6.0.x release" (SECURITY.md). Your channel must deliver new releases, not patch old tags. - Every update has a code half and a database half (Updates and upgrade paths).
- After every update: caches, autoloads, Velocity restart;
exp:velocity deploy"runs every step a PHP change needs, in order" (Velocity engines). - State in your terms how long you deliver updates for each model.
Backups and data ownership
The site's content is the customer's. Give them a way to back it up and take it with them: the database and
var/storage, settings/override, settings/siteaccess
(Backups: what to back up). Content exports and packages let them
move to another installation (Moving a site between hosts).
Appliance checklist
- To do: License notices, third-party list and source offer for each image.
- To do: No shared default password; first start generates or asks.
- To do: HTTPS, security headers and hardening applied (Security defaults).
- To do: An update channel with a documented support period.
- To do: Backup and export available to the owner.
- To do: Offline install tested if the box may have no network.
- To do: Support boundaries written down (Support boundaries).
Related pages
- OEM and reselling
- Server and virtual machine images
- Protecting customer data
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.