OPC UA Reverse Connect — PHP listener

Client-side listener for OPC UA Reverse Connect (Part 6 §7.1.2.3). Extension of php-opcua/opcua-client. The server dials out, the client accepts; everything after the opening ReverseHello frame is the standard UA-TCP protocol.

Reverse Connect inverts who initiates the underlying TCP connection. It is the pattern of choice when the server is behind NAT or a one-way firewall: the device dials outward, your PHP application listens for the incoming socket, validates the announced ServerUri, then proceeds with the normal UA-TCP handshake — secure channel, session, service calls — exactly as if you had connected the regular way.

What you can do with it:

• Bind a listener on any host/port and accept inbound RHE frames from one or many announcing servers
• Validate each frame against an explicit whitelist of trusted ServerUri values before letting the UA-TCP pipeline touch the socket
• Hand the live socket to the standard ClientBuilder via the v4.4.0 TcpTransport::fromConnectedSocket() seam, then use the resulting Client like any other
• Observe the flow with three PSR-14 events — ReverseHelloReceived, ReverseConnectAccepted, ReverseConnectRejected — and a PSR-3 logger
• Cover failure modes explicitly with four typed exceptions (parse, validation, timeout, plumbing) rooted in a single base class

Pure PHP, no native extensions, no event loop dependency.

Note: This package only ships the listener-side machinery. The OPC UA server you talk to must support Reverse Connect on its end and be told (via configuration, MQTT, an HTTPS callback — whatever fits your topology) to dial back to the listener's host and port. For integration testing the uanetstandard-test-suite v1.4.0+ exposes two Method nodes — StartReverseConnect and StopReverseConnect — that let a regular client trigger the outbound dial.

Quick Start

That's it. Bind, accept, build, use, disconnect — five calls and you are reading values through a socket the server opened.

See It in Action

Validate against a whitelist

An empty whitelist refuses every incoming frame — the validator is fail-secure by default.

React to events (PSR-14)

Zero overhead when no dispatcher is provided — events are not constructed at all.

Trigger the server from PHP (test suite flow)

In production the trigger is whatever you already have — HTTPS callback, MQTT push, a CLI on the gateway. The listener does not care how the server learned where to dial.

Connect with full security

Reverse Connect inverts the TCP direction; it does not change the OPC UA security model. Configure the builder inside the $configure closure the same way you would for a classic outbound client. Do not call setTransport() inside the closure — the factory has already wired one from the inherited socket.

Run the loop

Why This Package?

• Tiny, focused surface — six classes, four exceptions, three events. Everything else is php-opcua/opcua-client.
• No event loop dependency — bounded accept(timeoutSeconds) over stream_select(). Plug into your own loop or run a CLI worker.
• Fail-secure validator — empty whitelist refuses every frame; case-sensitive ServerUri match; opc.tcp:// scheme enforced on the announced endpoint.
• PSR everywhere — PSR-3 logger and PSR-14 dispatcher both optional. No global state. No service locator.
• Cross-platform — pure PHP streams API; no Unix domain sockets, no FFI, no native extensions. Tested on Linux, macOS, and Windows.
• Reuses the full core — same Client, same security stack, same modules, same DTOs as opcua-client. The transport seam is TcpTransport::fromConnectedSocket(); the rest of the pipeline is untouched.
• Thoroughly tested — 44 unit tests + 4 end-to-end integration tests against UA-.NETStandard via uanetstandard-test-suite v1.4.0+.

Documentation

The published version of the documentation lives at https://www.php-opcua.com/dev/components. The Markdown sources ship under docs/:

Testing

The integration suite expects the opcua-no-security service from uanetstandard-test-suite running on opc.tcp://localhost:4840 with extra_hosts: ["host.docker.internal:host-gateway"] configured (already the case in v1.4.0+).

Ecosystem

Community

Have questions, ideas, or want to share what you've built? Join the GitHub Discussions.

Contributing

Contributions welcome — see CONTRIBUTING.md in the core repository for the shared code style and workflow.

Changelog

See CHANGELOG.md.

License

MIT