Configuration
Server: /etc/fleetd/server.yaml
listen: ["127.0.0.1:8480"] # addresses to listen on
database: postgres://fleetd:pass@127.0.0.1:5432/fleetd
key_file: /etc/fleetd/server.key # created by `fleetd-server keygen`
trust_loopback_proxy: true # a reverse proxy on this host sets X-Forwarded-For / -Proto
release_key: <public release key> # from `fleetd-release keygen`
internal_agent_url: ws://10.0.0.1:8480/agent/ws # optional private-network endpoint
language: en # en or zh, for alerts, e-mails and API errors
smtp:
host: smtp.example.com # empty: no e-mail
port: 587
username: alerts@example.com
password: change-me
from: alerts@example.com
to: [you@example.com]
alerts:
offline: 40s
cpu_percent: 90
mem_percent: 90
sustain: 5m
disk_percent: 90
inode_percent: 90
wg_handshake: 5m # 0 disables
| Key | Default | Notes |
|---|---|---|
listen | ["127.0.0.1:8480"] | Keep it off public interfaces; use a reverse proxy |
database | — | Required. Tables are created on start |
key_file | /etc/fleetd/server.key | Agents pin the matching public key |
trust_loopback_proxy | false | Only trust forwarded headers from 127.0.0.1 / ::1 |
release_key | — | Needed for the installer and agent updates; uploads signed with other keys are refused |
internal_agent_url | — | Offered in the install command as Use private network |
language | en | en or zh |
Durations accept Go syntax: 40s, 5m, 1h30m.
Agent: /etc/fleetd/agent.yaml
Written by the installer; edit it and restart the agent to change anything.
server_url: wss://fleetd.example.com/agent/ws
server_key: <server public key> # pinned: the agent refuses any other server
release_key: <public release key> # empty: no remote updates
permission: full # monitor | allowlist | full
trusted_signers:
- <admin signing public key>
allowlist: # used with permission: allowlist
restart-nginx: [systemctl, restart, nginx]
key_file: /etc/fleetd/agent.key # created on first start
state_dir: /var/lib/fleetd # replay protection; /etc/fleetd on OpenWrt
Commands
fleetd-server
fleetd-server [-config /etc/fleetd/server.yaml] <command>
serve run the server (default)
keygen create the server key if missing and print its public key
admin-add [-totp] <user> create an admin or reset its password; -totp enables two-factor
version
admin-add on an existing user resets the password (and two-factor secret with -totp) and signs out all of that user's sessions.
fleetd-agent
fleetd-agent [-config /etc/fleetd/agent.yaml] [run|fingerprint|version]
fleetd-release
fleetd-release keygen [-key release.key]
fleetd-release pubkey [-key release.key]
fleetd-release sign [-key release.key] -version X [-arch amd64] [-o out] <binary>
Files
| Path | What |
|---|---|
/usr/local/bin/fleetd-server | Server binary |
/etc/fleetd/server.yaml, server.key | Server config and key (mode 640, root:fleetd) |
/usr/local/bin/fleetd-agent | Agent binary (/usr/bin on OpenWrt); .old is the previous version |
/etc/fleetd/agent.yaml, agent.key | Agent config and key (mode 600) |
/var/lib/fleetd/seen.json | Used command ids (/etc/fleetd on OpenWrt) |