feat(server): server-owned agent config pushed at enrollment and on connect (VS-67) #88
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/VS-67-server-pushes-agent-config"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The .vagent seed file removed by token-bootstrapped mTLS enrollment (VS-63) was the only source of agent-side config: group id, connection tunables (backoff floor/ceiling/multiplier, idle timeout), the mDNS toggle, and the self-update policy flags. The server now owns these and pushes them to the agent.
Add
AgentConfig(crates/vervain-web/src/agent_config.rs): an all-optional payload that serializes with unset knobs omitted, so the agent keeps its env-var fallback for any knob the operator has not set.AgentConfig::buildsources tunables and flags from the per-domain config block; the group id is the server's authoritative assignment for the node.Surface the tunables/flags as typed
Domainfields in vervain-config (agentbackoffinitialms, agentbackoffmaxms, agentbackoffmultiplier, agentidletimeoutsecs, agentenablemdns, agentdisableupdate, agentforceupdate, agentlogupdate, agentfakeupdate).Carry the config in the POST /api/v1/enroll response as the authoritative initial config (group id omitted there: no node row exists yet and group binding is a follow-up).
Push {"action":"agentconfig", ...} on each control-channel connect via
push_agent_config, reading the group id from the node row the server wrote in register_agent_in_db (not the value the agent claimed in AuthInfo), so an admin regroup propagates on the next connect and supersedes the bootstrap bundle's all-zeros default.#VS-67
The .vagent seed file removed by token-bootstrapped mTLS enrollment (VS-63) was the only source of agent-side config: group id, connection tunables (backoff floor/ceiling/multiplier, idle timeout), the mDNS toggle, and the self-update policy flags. The server now owns these and pushes them to the agent. Add `AgentConfig` (crates/vervain-web/src/agent_config.rs): an all-optional payload that serializes with unset knobs omitted, so the agent keeps its env-var fallback for any knob the operator has not set. `AgentConfig::build` sources tunables and flags from the per-domain config block; the group id is the server's authoritative assignment for the node. Surface the tunables/flags as typed `Domain` fields in vervain-config (agentbackoffinitialms, agentbackoffmaxms, agentbackoffmultiplier, agentidletimeoutsecs, agentenablemdns, agentdisableupdate, agentforceupdate, agentlogupdate, agentfakeupdate). Carry the config in the POST /api/v1/enroll response as the authoritative initial config (group id omitted there: no node row exists yet and group binding is a follow-up). Push {"action":"agentconfig", ...} on each control-channel connect via `push_agent_config`, reading the group id from the node row the server wrote in register_agent_in_db (not the value the agent claimed in AuthInfo), so an admin regroup propagates on the next connect and supersedes the bootstrap bundle's all-zeros default. #VS-67