agent

type Agent struct {
	// contains filtered or unexported fields
}

type AgentConfig struct {
	HubURL  string `json:"hubURL"`
	Token   string `json:"token"`
	Cluster string `json:"cluster,omitempty"`
}

type AgentType string

type Options struct {
	HubURL        string
	HubKubeconfig string
	HubContext    string
	TunnelURL     string // Separate URL for reverse tunnel (defaults to hubConfig.Host)
	Token         string
	EdgeName      string
	Kubeconfig    string
	Context       string
	Labels        map[string]string
	// Type controls whether the agent registers as a Kubernetes, Linux server,
	// or macOS service edge. Defaults to AgentTypeKubernetes.
	Type AgentType
	// InsecureSkipTLSVerify disables TLS certificate verification for the hub
	// connection. Should only be used in development/testing; never in production.
	InsecureSkipTLSVerify bool
	// SSHProxyPort is the local port of the SSH daemon the agent proxies to.
	// Defaults to 22; override in tests to avoid conflicts with the host sshd.
	SSHProxyPort int
	// SSHUser is the SSH username to authenticate as on server-type edges.
	// Defaults to the current user if not set.
	SSHUser string
	// SSHPassword is the SSH password for password-based authentication.
	// Prefer SSHPrivateKeyPath for better security.
	SSHPassword string
	// SSHPrivateKeyPath is the path to an SSH private key file for key-based auth.
	SSHPrivateKeyPath string
	// Cluster is the kcp logical cluster path (e.g., "root:railgrid:user-default").
	// If not set, it's extracted from the SA token (for kubeconfig-based auth)
	// or defaults to "default" (for static token auth).
	Cluster string
	// UsingSavedKubeconfig is set to true when the agent loaded a saved
	// kubeconfig from a previous join-token registration. When true, edge
	// registration is skipped (the edge was already registered).
	UsingSavedKubeconfig bool
	// DebugAddr, if non-empty, is the bind address for the agent's debug
	// HTTP server. It exposes /healthz and the standard /debug/pprof/*
	// endpoints. Use "127.0.0.1:6060" for local-only access; bind to a
	// non-loopback address only when port-forwarding is not an option.
	DebugAddr string
	// SvcAllowedCIDRs are the CIDRs (e.g. "192.168.1.0/24") the /svc proxy may
	// dial besides loopback and, in kubernetes mode, cluster-DNS names. A
	// Service's spec.host outside this set is refused (or warned about, per
	// SvcPolicy). Link-local, unspecified and multicast addresses are never
	// dialable even if listed. Flag: --svc-allow-cidr (repeatable); env:
	// RAILGRID_AGENT_SVC_ALLOW_CIDR (comma-separated).
	SvcAllowedCIDRs []string
	// SvcPolicy is what the /svc proxy does with a target outside the allowed
	// set: "enforce" (403, never dialed), "warn" (dialed, logged, response
	// carries X-Railgrid-Svc-Policy: warn) or "allow-any" (allow list disabled,
	// logged at startup). Defaults to "warn" in this release; the next release
	// flips the default to "enforce". Flag: --svc-policy; env: RAILGRID_AGENT_SVC_POLICY.
	SvcPolicy string
}