# theta-agent configuration file
# Default location: /etc/theta42/agent.yml

server_url: "https://sso.example.com"

# Issued by the SSO when you enroll this host (Directory -> Install Agent, or
# POST /api/agent/enroll). The server records only its hash and rejects any
# token it did not issue, so a value invented locally will not connect.
auth_token: "REPLACE_WITH_ISSUED_AGENT_TOKEN"

# Base64 of the SSO's RAW 32-byte Ed25519 public key -- the `publicKey` value
# from enrollment or GET /api/agent/nodes. This is NOT a PEM body.
#
# Required for any high-risk command. Without it the agent still reports
# telemetry, but REFUSES reboot / service_restart / configure_ldap /
# arbitrary_bash / update_binary, because it has no way to verify them.
public_key: "REPLACE_WITH_SSO_PUBLIC_KEY"

location: "default" # Location identifier (e.g., site, datacenter) for naming

capabilities:
  # ---------------------------------------------------------
  # Basic Capabilities (Safe, read-only or infrastructure management)
  # ---------------------------------------------------------
  
  # Push CPU, RAM, GPU, and ZFS metrics to the SSO Manager
  telemetry: true
  
  # Allow the SSO Manager to push down SSSD and SSH keys configuration
  configure_ldap: true
  
  # ---------------------------------------------------------
  # Advanced Capabilities (High risk, remote operations)
  # ---------------------------------------------------------
  
  # Allow remote system reboots via the SSO Manager
  reboot: false
  
  # Allow restarting, starting, or stopping specific systemd services.
  # Must be an explicit list of allowed service names.
  # Example: ["gitea", "nginx", "docker"]
  # Setting to true or [] denies all.
  service_control: []
  
  # CRITICAL: Allow the execution of raw bash scripts sent from the SSO Manager.
  # Useful for GitOps deployments, but allows remote code execution.
  arbitrary_bash: false