From 5c32baa3c7cce8e4c02a28c90ea066c17f414e77 Mon Sep 17 00:00:00 2001 From: sam Date: Fri, 21 Aug 2026 06:03:05 +0000 Subject: [PATCH] fix: clone URL under noctools org; per-agent env file for second agents; drop -u sam from public fallback --- .env.agent.example | 7 +++---- README.md | 14 +++++++++----- docker-compose.agent.yml | 18 +++++++++++------- 3 files changed, 23 insertions(+), 16 deletions(-) diff --git a/.env.agent.example b/.env.agent.example index af3d98f..7beb07b 100644 --- a/.env.agent.example +++ b/.env.agent.example @@ -10,10 +10,9 @@ AGENT_PASSWORD= # The location NAME this agent scans from (e.g. chch-office) AGENT_LOCATION= -# NOT needed — the registry image is publicly pullable. Only fill this if -# Sam tells you the registry has been re-privatized (then also run: -# docker login gitea.noctools.nz -u sam -p ). -# REGISTRY_TOKEN= +# NOT needed — the registry image is publicly pullable. If Sam ever tells you +# the registry has been re-privatized, they will send login instructions +# together with the agent credentials. # Optional CVE matching via central API (leave empty unless Sam provides it) CVE_MATCH_API= diff --git a/README.md b/README.md index 20168a0..9a99a19 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ contains no secrets. ## Install ```bash -git clone https://gitea.noctools.nz/sam/onlyscans-agent-kit.git +git clone https://gitea.noctools.nz/noctools/onlyscans-agent-kit.git cd onlyscans-agent-kit cp .env.agent.example .env # edit .env: AGENT_IDENTITY / AGENT_PASSWORD / AGENT_LOCATION @@ -62,9 +62,13 @@ The agent re-authenticates and resumes polling. - **Host-network variant** (scan the site LAN directly, ARP-level discovery, non-routed subnets): swap the service to `network_mode: host` per the commented block in `docker-compose.agent.yml`. -- **Second agent on the same box:** copy the compose file, change the - project `name:` and `container_name` (and `WORKER_HEALTH_PORT` under - host networking) per the comments in the file. +- **Second agent on the same box:** each agent needs its OWN credentials — + copy the compose file AND create a second env file (`.env-agent2`), then + run it with `docker compose --env-file .env-agent2 -f + docker-compose.agent2.yml up -d`. In the copy, change the project `name:` + and `container_name` (and `WORKER_HEALTH_PORT` under host networking) per + the comments in the file. Two agents sharing one `.env` would share one + auth record — unsupported and silently wrong. - **CVE matching** (optional): fill `CVE_MATCH_API` + `CVE_MATCH_TOKEN` in `.env` only if Sam provides them. Without it, scans complete normally with the CVE stage skipped. @@ -73,6 +77,6 @@ The agent re-authenticates and resumes polling. | Symptom | Meaning | |---|---| -| Container exits ~1 s after start | Bad `AGENT_PASSWORD` or unknown `AGENT_LOCATION` — fatal by design; fix `.env` and recreate | +| Container exits ~1 s after start | Bad `AGENT_IDENTITY`, `AGENT_PASSWORD`, or unknown `AGENT_LOCATION` — fatal by design; fix `.env` and recreate | | Agent shows **offline** centrally (`/agents`) | Container down, or no egress to `scan-api.noctools.nz:443` — check `docker logs onlyscans-agent` | | Scans stay queued | Agent online but for a different location, or targets unreachable from the container's network — try the host-network variant | diff --git a/docker-compose.agent.yml b/docker-compose.agent.yml index 7618038..e3078f2 100644 --- a/docker-compose.agent.yml +++ b/docker-compose.agent.yml @@ -1,5 +1,5 @@ -# onlyscans REMOTE AGENT install kit — run this ON THE REMOTE SITE's -# docker host. One agent = one location = one vantage. +# onlyscans REMOTE AGENT install kit (Phase 2) — run this ON THE REMOTE SITE's +# docker host, NOT on the central box. One agent = one location = one vantage. # # Prereqs (do these FIRST, on the central instance's web UI): # 1. Admin → /agents → create the LOCATION for this site (e.g. "chch-office"). @@ -11,12 +11,16 @@ # AGENT_LOCATION) → docker compose -f docker-compose.agent.yml up -d # The worker image pulls anonymously from the public registry — no # `docker login` needed. (Fallback if the registry is ever re-privatized: -# Sam issues a gitea read:package token → `docker login gitea.noctools.nz -# -u sam -p `.) +# Sam will send login instructions with the kit credentials.) # Full walkthrough: README.md in this repo. -# (Running a SECOND agent on the same box: copy this file, change the project -# `name:` and `container_name` below — otherwise compose project + container -# collide with the first agent.) +# (Running a SECOND agent on the same box: each agent needs its OWN +# credentials — copy this file to e.g. docker-compose.agent2.yml AND create +# a second env file (.env-agent2), then run it with +# `docker compose --env-file .env-agent2 -f docker-compose.agent2.yml up -d`. +# In the copy, change the project `name:` and `container_name` below — +# otherwise compose project + container collide with the first agent. Two +# agents sharing one .env would share one auth record — unsupported and +# silently wrong.) # # The agent talks to the central PocketBase over the public tunnel TLS # (https://scan-api.noctools.nz) — credentials and results are encrypted in