Skip to content

DEXR Outpost

Connecting an edge device to DEXR previously required Contextualize engineering time: managing credential distribution, writing device-side scripts, and configuring environment files for each new instrument or system. DEXR Outpost packages that work into a self-service application. Once a DEXR admin has provisioned credentials for a device, any researcher or facility IT staff member can install, configure, and operate the connection without involving Contextualize.

Two Ways to Use It

DEXR Outpost ships as a native desktop application and as a command-line tool. Both share the same configuration file and transfer history on disk — a transfer sent from the CLI appears in the GUI's History view, and vice versa.

Desktop application — Available as a signed installer (.pkg on macOS, .msi on Windows) from the GitLab release page. Intended for researchers and facility staff who prefer a visual interface. No terminal required.

Command-line tool — Installed via pipx install dexr-outpost. Intended for headless environments, HPC systems, automated pipelines, and users who prefer to script their transfers. Supports structured JSON output and a documented exit code taxonomy for use in larger workflows.

What It Does

A DEXR Outpost installation can be configured as a writer, a reader, or both — depending on which credentials the DEXR admin has provisioned for the device.

Upload (writer role) — Select a file, address it to a reader, set a sample ID, and upload. Outpost encrypts the payload using the reader's public key before it leaves the device. Files that exceed DEXR's payload limits are rejected before any network call is made.

Download (reader role) — Retrieve and decrypt a payload addressed to this device. Outpost handles the decryption locally using the private key stored in the device's configuration.

Config — View and edit connection settings, including setting and replacing writer, reader, or private keys safely. Outpost validates new key candidates against DEXR before writing anything to the configuration file — an invalid key leaves the existing config untouched.

History — A local log of past transfers: timestamp, direction, sample ID, status, and payload size. This history is shared between the desktop application and the CLI and is useful for debugging and auditing.

Security

DEXR Outpost stores credentials in a plaintext configuration file at a platform-specific location — ~/.config/dexr-outpost/env on POSIX systems, %APPDATA%\DEXR Outpost\env on Windows. File permissions are set to the OS user account only; no other user on the machine can read the file.

Additional safeguards:

  • Credentials never appear in log output, at any log level
  • The private key is never copied to the system clipboard
  • If the configuration file is detected inside a cloud-sync folder (OneDrive, iCloud Drive, Dropbox, and others), the application displays a persistent warning — syncing credentials to a cloud provider expands the exposure surface beyond the local machine
  • The transfer history database refuses to open if it resolves inside a cloud-sync directory, to prevent database corruption from concurrent sync access

Credential rotation is recommended when personnel change, when a device is decommissioned, or at your organization's standard key rotation cadence. See Security → for rotation steps.