Agent configuration
The agent reads one JSON file next to its binary. The install script writes it; you rarely edit it by hand. Two fields are deliberately local-only and can never be set by the hub: allow_shell and secrets.
The file
{
"server_url": "wss://hub.[yourdomain]/agent",
"token": "bet_… (this company's enrollment token)",
"agent_id": "generated on first run; keep it to keep the machine's history",
"allow_shell": false,
"proxy_allow_shell": false,
"update_url": "https://hub.[yourdomain]/dl/manifest.json",
"sample_interval_sec": 300,
"cert_sha256": "",
"ping_targets": ["10.8.0.1"],
"secrets": { "app_token": "Bearer …" }
}Fields
| field | meaning |
|---|---|
| server_url | the hub's WebSocket address; outbound only |
| token | the company's enrollment token; a machine belongs to the company that enrolled it |
| agent_id | minted on first run; the install script preserves it on re-runs |
| allow_shell | whether run_shell exists on this machine at all; false by default; the hub cannot change it |
| proxy_allow_shell | whether commands may be run on proxied devices through this machine; same rule |
| update_url | where the agent fetches its signed update manifest; empty disables self-update |
| sample_interval_sec | heartbeat period; default 300, minimum 30 |
| cert_sha256 | optional pin of the hub's certificate; empty means normal CA verification |
| ping_targets | extra hosts pinged every heartbeat, on top of hosts named by ping checks |
| secrets | credentials for http_check headers, resolved on the machine, never sent to the hub |
Where it lives
| platform | folder |
|---|---|
| Windows | C:\BEAgent |
| Linux | /opt/be-agent |
| macOS | /usr/local/be-agent |
| OPNsense, pfSense | /usr/local/be-agent |
| OpenWrt, Teltonika | /etc/be-agent |
Alongside it: checks.json (the approved check document), checks-state.json (last verdicts, so a restart neither re-alerts nor swallows a recovery) and be-agent.log.
Try it on one machine first.
The install line takes a minute. Uninstall the agent and you are out.