From 3042bac6ae9c8633a28be97625ad20ea1cc5e49e Mon Sep 17 00:00:00 2001
From: sam <sam@noctools.nz>
Date: Fri, 21 Aug 2026 06:33:21 +0000
Subject: [PATCH] feat: drop AGENT_LOCATION (agent location is
 central-record-only); image 20260821-3

---
 .env.agent.example       |  6 +++---
 README.md                |  7 ++++---
 docker-compose.agent.yml | 11 +++++------
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.env.agent.example b/.env.agent.example
index 7beb07b..e2785e0 100644
--- a/.env.agent.example
+++ b/.env.agent.example
@@ -1,4 +1,4 @@
-# onlyscans remote-agent .env (copy to .env, fill the three AGENT_ values)
+# onlyscans remote-agent .env (copy to .env, fill the two AGENT_ values)
 # Values come from the central /agents admin page (Sam provisions them).
 
 # Username of the agent record created at /agents (e.g. chch-1)
@@ -7,8 +7,8 @@ AGENT_IDENTITY=
 # The password shown ONCE at agent creation (or after a reset on /agents)
 AGENT_PASSWORD=
 
-# The location NAME this agent scans from (e.g. chch-office)
-AGENT_LOCATION=
+# The agent's location is defined by its record on the central instance —
+# no local configuration needed (or used) for it.
 
 # NOT needed — the registry image is publicly pullable. If Sam ever tells you
 # the registry has been re-privatized, they will send login instructions
diff --git a/README.md b/README.md
index 886d8fc..45a90d7 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ contains no secrets.
 git clone https://gitea.noctools.nz/noctools/onlyscans-agent-kit.git
 cd onlyscans-agent-kit
 cp .env.agent.example .env
-# edit .env: AGENT_IDENTITY / AGENT_PASSWORD / AGENT_LOCATION
+# edit .env: AGENT_IDENTITY / AGENT_PASSWORD
 docker compose -f docker-compose.agent.yml up -d
 docker logs -f onlyscans-agent
 ```
@@ -36,7 +36,8 @@ docker logs -f onlyscans-agent
 The worker image pulls anonymously — no `docker login` required.
 
 **Expected log lines on a healthy start:**
-`authenticated` … `agent <name>: AGENT_LOCATION "<loc>" validated`.
+`authenticated to PocketBase …` — that's it. (The agent's location is
+carried by its central record; nothing local participates.)
 A rejected password or unknown location name is FATAL by design —
 check the values in `.env` and `docker compose -f docker-compose.agent.yml up -d --force-recreate`.
 
@@ -78,6 +79,6 @@ The agent re-authenticates and resumes polling.
 | Symptom | Meaning |
 |---|---|
 | `no configuration file provided: not found` | You ran a follow-up `docker compose logs`/`ps` without `-f docker-compose.agent.yml` — the kit's compose file has a non-default name, so it isn't auto-discovered. Re-run with `-f docker-compose.agent.yml`, or use plain `docker logs onlyscans-agent` (the container itself is fine) |
-| Container exits ~1 s after start | Bad `AGENT_IDENTITY`, `AGENT_PASSWORD`, or unknown `AGENT_LOCATION` — fatal by design; fix `.env` and recreate |
+| Container exits ~1 s after start | Bad `AGENT_IDENTITY` or `AGENT_PASSWORD` — fatal by design; fix `.env` and recreate |
 | Agent shows **offline** centrally (`/agents`) | Container down, or no egress to `scan-api.noctools.nz:443` — check `docker logs onlyscans-agent` |
 | Scans stay queued | Agent online but for a different location, or targets unreachable from the container's network — try the host-network variant |
diff --git a/docker-compose.agent.yml b/docker-compose.agent.yml
index e3078f2..4545713 100644
--- a/docker-compose.agent.yml
+++ b/docker-compose.agent.yml
@@ -7,8 +7,8 @@
 #      password is shown ONCE — put it in .env as AGENT_PASSWORD below.
 #
 # Then on this host:
-#   cp .env.agent.example .env  (fill AGENT_IDENTITY / AGENT_PASSWORD /
-#   AGENT_LOCATION) → docker compose -f docker-compose.agent.yml up -d
+#   cp .env.agent.example .env  (fill AGENT_IDENTITY / AGENT_PASSWORD)
+#   → docker compose -f docker-compose.agent.yml up -d
 # The worker image pulls anonymously from the public registry — no
 # `docker login` needed. (Fallback if the registry is ever re-privatized:
 # Sam will send login instructions with the kit credentials.)
@@ -29,7 +29,7 @@
 name: onlyscans-agent
 services:
   agent:
-    image: gitea.noctools.nz/noctools/onlyscans-worker:20260821-2
+    image: gitea.noctools.nz/noctools/onlyscans-worker:20260821-3
     # Bump the tag to track the central worker version (see README.md).
     container_name: onlyscans-agent
     restart: unless-stopped
@@ -40,11 +40,10 @@ services:
       PB_URL: https://scan-api.noctools.nz
       AGENT_IDENTITY: ${AGENT_IDENTITY:?set in .env — the username created on /agents}
       AGENT_PASSWORD: ${AGENT_PASSWORD:?set in .env — the shown-once password}
-      AGENT_LOCATION: ${AGENT_LOCATION:?set in .env — the location NAME from /agents}
       AGENT_HEARTBEAT_SECONDS: 30
       # Shown on /agents (agent_version) — bump together with the image tag
       # when upgrading so the central UI can confirm the rollout.
-      AGENT_VERSION: 20260821-2
+      AGENT_VERSION: 20260821-3
       # Optional: CVE matching via the central cve-match API. Leave EMPTY unless
       # Sam has given you a CVE_MATCH_API URL + token (its public exposure is a
       # manual central-side step). Without it, scans still complete — the CVE
@@ -74,7 +73,7 @@ services:
 #
 #   services:
 #     agent:
-#       image: gitea.noctools.nz/noctools/onlyscans-worker:20260821-2
+#       image: gitea.noctools.nz/noctools/onlyscans-worker:20260821-3
 #       network_mode: host          # container shares the host's stack
 #       environment:
 #         ...