git init

examples/agent-config.toml

@@ -0,0 +1,43 @@
+[server]
+# Use the VPS WireGuard address in production. Never use 0.0.0.0.
+listen = "10.10.0.1:9105"
+
+[auth]
+mode = "token"
+token_file = "/etc/vps-agent/credentials/control-plane.token"
+
+[limits]
+max_concurrent_requests = 32
+request_timeout_seconds = 5
+max_body_bytes = 65536
+read_requests_per_second = 10.0
+write_requests_per_second = 2.0
+burst = 20.0
+command_timeout_seconds = 4
+
+[services]
+allowed = ["nginx", "fail2ban", "wg-quick@wg0"]
+
+[firewall]
+management_enabled = false
+rollback_timeout_seconds = 60
+max_snapshots = 5
+
+[logging]
+level = "info"
+
+[telemetry]
+connections_enabled = true
+process_info_enabled = true
+
+[logs]
+# Requires read access to journald. Keep units narrowly allow-listed.
+enabled = false
+allowed_units = ["vps-agent.service", "nginx.service"]
+max_entries_per_request = 200
+max_message_bytes = 16384
+
+[tls]
+enabled = false
+certificate_file = ""
+private_key_file = ""