Pico MES Infrastructure Documentation

Deployment Model

For customers who prefer to host Pico MES on their own infrastructure, the system can be deployed on customer-owned virtual machines or server racks.

Key Characteristics

• Pico MES runs on customer-provided VM or physical server
• Ubuntu Server operating system required
• Customer manages hardware/VM infrastructure
• Pico manages software and application updates
• Maintains connection to Pico cloud services (configurable)
• All standard Pico MES features available
• Suitable for Level 1 "Convenience Air-Gap" security posture

Compliance

• SOC 2 Type 2 certified application
• ITAR-compliant deployment options available
• Customer infrastructure subject to own audits

Virtual Machine Specifications

Minimum Requirements:

• 4 vCPUs
• 8GB RAM
• 256GB storage (SSD recommended)
• Ubuntu Server 20.04 LTS or newer
• Virtualization platform: VMware ESXi, Hyper-V, KVM, Proxmox, or equivalent

Recommended Configuration:

• 8 vCPUs
• 16GB RAM
• 512GB storage (SSD)
• Dedicated network interface
• VM snapshot capability for backups

Network Requirements

Required Internal Connectivity:

• Static IP address on customer network
• Access to all Pico Hubs (bidirectional)
• DNS resolution for internal resources
• NTP server access (customer or internet)

Required External Connectivity:

• Outbound HTTPS (443) to account.picomes.io
• Outbound VPN (443 or 1194) to vpn2.picomes.com
• Outbound HTTPS to GCP for backups (optional)
• Inbound HTTPS from user workstations

Access Control Configuration

Level 2 "Access Control" deployment provides enhanced security while maintaining manageable operational procedures.

Key Characteristics

• VPN access can be completely disabled
• Manual software updates only
• Internet egress allowed for specific functions
• Mixed authentication models (cloud + local)
• Self-managed backups and data replication
• On-site troubleshooting required

Security Posture

• No persistent remote access by Pico personnel
• Customer controls when/if VPN is enabled
• Reduced cloud dependencies
• Enhanced audit and control capabilities
• Suitable for ITAR Level 2 requirements

Required Domains and Addresses

For Level 2 deployments with limited internet access, the following domains and addresses must be whitelisted:

Authentication Services (Optional - if using cloud authentication)

Microsoft SSO:

• login.microsoftonline.com (HTTPS/443)
• login.microsoft.com (HTTPS/443)
• graph.microsoft.com (HTTPS/443)

Google SSO:

• accounts.google.com (HTTPS/443)
• oauth2.googleapis.com (HTTPS/443)

Pico Account Services:

• account.picomes.io (HTTPS/443)

VPN Access (Optional - if enabled temporarily)

• vpn2.picomes.com (Port 443 primary, Port 1194 alternate)

Operating System Updates

• archive.ubuntu.com (HTTPS/443)
• security.ubuntu.com (HTTPS/443)
• *.ubuntu.com (HTTPS/443) - for full Ubuntu repository access

Time Synchronization (Critical)

• pool.ntp.org (NTP/123) - or customer-provided NTP server
• 0.pool.ntp.org (NTP/123)
• 1.pool.ntp.org (NTP/123)
• 2.pool.ntp.org (NTP/123)
• 3.pool.ntp.org (NTP/123)

Certificate Validation

• ocsp.digicert.com (HTTP/80, HTTPS/443)
• crl.microsoft.com (HTTP/80)
• *.globalsign.com (HTTP/80, HTTPS/443)

Backup Services (Optional)

Pico Cloud Backup:

• storage.googleapis.com (HTTPS/443)
• *.googleapis.com (HTTPS/443)

AWS S3:

• s3.amazonaws.com (HTTPS/443)
• *.s3.amazonaws.com (HTTPS/443)

Google Cloud Storage:

• storage.googleapis.com (HTTPS/443)
• *.storage.googleapis.com (HTTPS/443)

Azure Blob Storage:

• *.blob.core.windows.net (HTTPS/443)

Minimum Configuration (Most Restricted)

For customers wanting absolute minimum internet access:

• Local NTP server (customer-provided) - Port 123
• No authentication cloud services (use LDAP/AD or local auth)
• No VPN access (on-site support only)
• Local backup destination only
• Manual OS updates via secure media

Microsoft Azure GCC High SSO Integration

For government customers using GCC High tenants, Pico MES can integrate with Azure Entra ID (formerly Azure AD) for seamless Single Sign-On authentication.

Overview

Pico MES integrates with your GCC High tenant for Azure Entra ID SSO by setting up an application registration in your tenant that points to Pico's account services. This provides limited information to Pico - only enough to identify operators and managers for proper system permissions.

Required Information

• Application (client) ID
• Client Secret Value
• Client Secret ID

Setup Process

Step 1: Create App Registration

1. Navigate to Azure Portal and search for "App registrations"
2. Click "New registration"
3. Configure the application:
   • Name: PicoMES
   • Supported account types: Select "Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts"
   • Redirect URI: Select "Web" and enter: https://account.picomes.io/auth/azuregcchigh/callback
4. Click "Register"

Step 2: Copy Application (Client) ID

• After registration, copy the Application (client) ID GUID
• Save this securely - you'll provide it to Pico

Step 3: Create Client Secret

1. Click "Add a certificate or secret" link
2. Click "New client secret"
3. Configure the secret:
   • Description: PicoAppSecret (or your preferred name)
   • Expires: Recommended 12 months (1 year)
4. Click "Add"
5. Copy BOTH the Value and Secret ID immediately (The Value will only be shown once)

Step 4: Configure API Permissions

1. Click "API permissions" in the left navigation
2. Click "Add a permission"
3. Select "Microsoft Graph"
4. Select "Delegated permissions"
5. Add the following permissions:
   • email (View users' email address)
   • openid (Sign users in)
   • profile (View users' basic profile)
6. Click "Add permissions"

Network Requirements for GCC High

Ensure the following domains are whitelisted:

• login.microsoftonline.com (HTTPS/443)
• graph.microsoft.com (HTTPS/443)
• account.picomes.io (HTTPS/443)

Annual Maintenance

• Client secrets expire after one year (recommended setting)
• Generate new secret before expiration
• Provide new credentials to Pico
• Old secret can be deleted after Pico confirms new credentials working