fix: clone URL under noctools org; per-agent env file for second agents; drop -u sam from public fallback

.env.agent.example

@@ -10,10 +10,9 @@ AGENT_PASSWORD=
 # The location NAME this agent scans from (e.g. chch-office)
 AGENT_LOCATION=
 
-# NOT needed — the registry image is publicly pullable. Only fill this if
-# Sam tells you the registry has been re-privatized (then also run:
-# docker login gitea.noctools.nz -u sam -p <this-token>).
-# REGISTRY_TOKEN=
+# NOT needed — the registry image is publicly pullable. If Sam ever tells you
+# the registry has been re-privatized, they will send login instructions
+# together with the agent credentials.
 
 # Optional CVE matching via central API (leave empty unless Sam provides it)
 CVE_MATCH_API=

README.md

@@ -25,7 +25,7 @@ contains no secrets.
 ## Install
 
 ```bash
-git clone https://gitea.noctools.nz/sam/onlyscans-agent-kit.git
+git clone https://gitea.noctools.nz/noctools/onlyscans-agent-kit.git
 cd onlyscans-agent-kit
 cp .env.agent.example .env
 # edit .env: AGENT_IDENTITY / AGENT_PASSWORD / AGENT_LOCATION
@@ -62,9 +62,13 @@ The agent re-authenticates and resumes polling.
 - **Host-network variant** (scan the site LAN directly, ARP-level
   discovery, non-routed subnets): swap the service to `network_mode: host`
   per the commented block in `docker-compose.agent.yml`.
-- **Second agent on the same box:** copy the compose file, change the
-  project `name:` and `container_name` (and `WORKER_HEALTH_PORT` under
-  host networking) per the comments in the file.
+- **Second agent on the same box:** each agent needs its OWN credentials —
+  copy the compose file AND create a second env file (`.env-agent2`), then
+  run it with `docker compose --env-file .env-agent2 -f
+  docker-compose.agent2.yml up -d`. In the copy, change the project `name:`
+  and `container_name` (and `WORKER_HEALTH_PORT` under host networking) per
+  the comments in the file. Two agents sharing one `.env` would share one
+  auth record — unsupported and silently wrong.
 - **CVE matching** (optional): fill `CVE_MATCH_API` + `CVE_MATCH_TOKEN`
   in `.env` only if Sam provides them. Without it, scans complete
   normally with the CVE stage skipped.
@@ -73,6 +77,6 @@ The agent re-authenticates and resumes polling.
 
 | Symptom | Meaning |
 |---|---|
-| Container exits ~1 s after start | Bad `AGENT_PASSWORD` or unknown `AGENT_LOCATION` — fatal by design; fix `.env` and recreate |
+| Container exits ~1 s after start | Bad `AGENT_IDENTITY`, `AGENT_PASSWORD`, or unknown `AGENT_LOCATION` — fatal by design; fix `.env` and recreate |
 | Agent shows **offline** centrally (`/agents`) | Container down, or no egress to `scan-api.noctools.nz:443` — check `docker logs onlyscans-agent` |
 | Scans stay queued | Agent online but for a different location, or targets unreachable from the container's network — try the host-network variant |

docker-compose.agent.yml

@@ -1,5 +1,5 @@
-# onlyscans REMOTE AGENT install kit — run this ON THE REMOTE SITE's
-# docker host. One agent = one location = one vantage.
+# onlyscans REMOTE AGENT install kit (Phase 2) — run this ON THE REMOTE SITE's
+# docker host, NOT on the central box. One agent = one location = one vantage.
 #
 # Prereqs (do these FIRST, on the central instance's web UI):
 #   1. Admin → /agents → create the LOCATION for this site (e.g. "chch-office").
@@ -11,12 +11,16 @@
 #   AGENT_LOCATION) → docker compose -f docker-compose.agent.yml up -d
 # The worker image pulls anonymously from the public registry — no
 # `docker login` needed. (Fallback if the registry is ever re-privatized:
-# Sam issues a gitea read:package token → `docker login gitea.noctools.nz
-# -u sam -p <token>`.)
+# Sam will send login instructions with the kit credentials.)
 # Full walkthrough: README.md in this repo.
-# (Running a SECOND agent on the same box: copy this file, change the project
-# `name:` and `container_name` below — otherwise compose project + container
-# collide with the first agent.)
+# (Running a SECOND agent on the same box: each agent needs its OWN
+# credentials — copy this file to e.g. docker-compose.agent2.yml AND create
+# a second env file (.env-agent2), then run it with
+# `docker compose --env-file .env-agent2 -f docker-compose.agent2.yml up -d`.
+# In the copy, change the project `name:` and `container_name` below —
+# otherwise compose project + container collide with the first agent. Two
+# agents sharing one .env would share one auth record — unsupported and
+# silently wrong.)
 #
 # The agent talks to the central PocketBase over the public tunnel TLS
 # (https://scan-api.noctools.nz) — credentials and results are encrypted in