wmantly
0a5011cd42
Installing the agent with one key is now all it takes to add a host. New `join_key` config field, presented while auth_token is empty. The SSO exchanges it for this agent's own token and the public key it must pin, both delivered in the config frame; the agent persists them and blanks the join key. Nothing has to be copied between two machines by hand. PersistEnrollment rewrites only the credential lines -- line-based rather than a YAML round-trip -- so operator comments, the capability matrix and formatting survive. It re-reads afterwards so the credential is live without a restart, and keeps the file 0600. The connect URL carries ?hostname= so a self-enrolling host is named after itself, and the agent refuses to connect at all (with a long back-off) when it has no credential rather than presenting an empty one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
56 lines
2.2 KiB
Plaintext
56 lines
2.2 KiB
Plaintext
# theta-agent configuration file
|
|
# Default location: /etc/theta42/agent.yml
|
|
|
|
server_url: "https://sso.example.com"
|
|
|
|
# This agent's own token. Leave EMPTY when installing with a join key -- the
|
|
# agent fills it in itself once the SSO enrolls it. The server records only a
|
|
# hash and rejects any token it did not issue, so a locally invented value will
|
|
# never connect.
|
|
auth_token: ""
|
|
|
|
# The one credential you need to add a host. Used only while auth_token is
|
|
# empty: the SSO exchanges it for this agent's own token + public key on first
|
|
# connect, and the agent then blanks this line. Get one from the SSO
|
|
# (Directory -> Install Agent, or POST /api/agent/join-keys).
|
|
join_key: ""
|
|
|
|
# Base64 of the SSO's RAW 32-byte Ed25519 public key (NOT a PEM body). Filled in
|
|
# automatically when enrolling with a join key; set it by hand only if you
|
|
# pre-registered this host.
|
|
#
|
|
# Required for any high-risk command. Without it the agent still reports
|
|
# telemetry, but REFUSES reboot / service_restart / configure_ldap /
|
|
# arbitrary_bash / update_binary, because it has no way to verify them.
|
|
public_key: ""
|
|
|
|
location: "default" # Location identifier (e.g., site, datacenter) for naming
|
|
|
|
capabilities:
|
|
# ---------------------------------------------------------
|
|
# Basic Capabilities (Safe, read-only or infrastructure management)
|
|
# ---------------------------------------------------------
|
|
|
|
# Push CPU, RAM, GPU, and ZFS metrics to the SSO Manager
|
|
telemetry: true
|
|
|
|
# Allow the SSO Manager to push down SSSD and SSH keys configuration
|
|
configure_ldap: true
|
|
|
|
# ---------------------------------------------------------
|
|
# Advanced Capabilities (High risk, remote operations)
|
|
# ---------------------------------------------------------
|
|
|
|
# Allow remote system reboots via the SSO Manager
|
|
reboot: false
|
|
|
|
# Allow restarting, starting, or stopping specific systemd services.
|
|
# Must be an explicit list of allowed service names.
|
|
# Example: ["gitea", "nginx", "docker"]
|
|
# Setting to true or [] denies all.
|
|
service_control: []
|
|
|
|
# CRITICAL: Allow the execution of raw bash scripts sent from the SSO Manager.
|
|
# Useful for GitOps deployments, but allows remote code execution.
|
|
arbitrary_bash: false
|