Agent Configuration¶
The edge agent is /usr/local/sbin/edge-agent, run by the edge_agent rc.d
service as edge-agent serve. It logs to syslog (daemon.info, so
/var/log/daemon).
Environment variables¶
Read by every command. None is needed on an installed gateway: setup writes
the addresses into identity.json, and those take precedence over
EDGE_AGENT_NEXUS_ADDR / EDGE_AGENT_REALTIME_ADDR.
| Variable | Default | Description |
|---|---|---|
EDGE_AGENT_NEXUS_ADDR |
http://localhost:8080 |
Nexus ConnectRPC URL, with scheme |
EDGE_AGENT_REALTIME_ADDR |
empty | Realtime worker WSS URL |
EDGE_AGENT_ENROLL_TOKEN |
empty | Bootstrap token |
EDGE_AGENT_DATA_DIR |
/var/lib/edge-agent |
Identity, config and state |
EDGE_AGENT_PF_CONF |
/etc/pf.conf |
Path of the generated pf.conf |
EDGE_AGENT_DRY_RUN |
false |
Generate but do not apply pf/interface changes |
EDGE_AGENT_LOG_LEVEL |
info |
debug, info, warn, error |
EDGE_AGENT_LOG_FORMAT |
text |
text or json |
EDGE_AGENT_HEARTBEAT_INTERVAL |
30 |
Heartbeat interval, seconds |
EDGE_AGENT_STATE_INTERVAL |
300 |
Full state report interval, seconds |
--log-level and --log-format on any command override the variables.
Commands¶
| Command | Purpose |
|---|---|
edge-agent serve |
The daemon: connect to Nexus and Realtime, sync and apply config, report state |
edge-agent setup |
Enroll (interactive wizard, or --addr, --realtime, --token). Does nothing if already enrolled |
edge-agent reenroll |
Enroll against another environment, keeping a backup of the current identity; see Move a device between environments |
edge-agent status |
Live TUI: interfaces, carrier, config version, firewall rules, WireGuard peers |
edge-agent modem status |
What the cellular modem and the network report |
edge-agent modem at <cmd>... |
Send AT commands to the modem and print the replies |
edge-agent show interfaces |
Current system interfaces |
edge-agent show pf -f <config.json> |
Preview the pf.conf a config file would produce |
edge-agent apply -f <config.json> |
Apply a config file locally, without Nexus |
edge-agent version |
Print the agent version |
edge-agent setup \
--addr https://dev.nexus.digilan-edge.com \
--realtime wss://dev.realtime.digilan-edge.com \
--token GW-XXXX-XXXX-XXXX-XXXX
The installer runs this on first boot from rc.firsttime, using
/etc/edge-enroll.conf. setup is a no-op when identity.json exists; use
reenroll to change environment.
Operator shell¶
Root's ~/.kshrc on an installed gateway defines:
| Alias | Runs |
|---|---|
ea |
edge-agent (so ea status, ea version, ...) |
ea-log |
follow the agent's lines in /var/log/daemon |
ea-status |
rcctl check edge_agent and the agent version |
ea-restart |
rcctl restart edge_agent |
ea-id |
print identity.json |
digilan-status prints the boot status box (enrolled, agent, Nexus link,
reachability, WAN) at any time.
Files on the device¶
| Path | Contents |
|---|---|
/var/lib/edge-agent/identity.json |
Gateway id, API token, Nexus and Realtime addresses. Treat as a secret |
/var/lib/edge-agent/config.json, config.prev.json |
Applied config and the one before it |
/var/lib/edge-agent/state.json |
Full state, rewritten every 2 s, read by edge-agent status |
/var/lib/edge-agent/pending.json, pf.conf.rollback |
An armed config rollback |
/var/lib/edge-agent/relay-rung.json |
The last relay transport that worked |
/var/lib/edge-agent/known-good/, isolation/, selfheal.sh |
Self-heal snapshot and ladder |
/var/lib/edge-agent/update-* |
Self-update markers and watchdog |
/var/db/digilan/wan/ |
Uplink failover verdicts and history |
/var/db/digilan/modems.json |
Last known cellular modem reading |
/etc/edge-enroll.conf |
Flash-time enrollment settings, including the token |
/var/log/digilan-enroll.log |
First-boot enrollment log |