Installed as root, by you
The agent runs as a systemd service. The unit file ships with the release and its hash is in the manifest.
Security
Silent Failure holds a map of exactly where your servers are vulnerable. That is worth being precise about.
On your host
The token lives in one file
/etc/silentfailure/agent.yaml, mode 600. It is what binds the host to your organisation.
Rotation is a button
Rotate the token from the host page. The old one stops working as soon as the agent has picked up the new one.
On our side
Tokens are stored as hashes
A join token is shown once, at creation. A database dump contains no usable key.
Enrollment needs a join token
Without one, anyone who can reach the central could put a host in the approval queue under a name they chose.
Auto-approve needs a limit
A token that skips the human step must not be unlimited. The limit is the blast radius if it leaks.
Every change is recorded
Who approved a host, who acknowledged a finding, who changed the plan — with the reason they gave.
The signing key
Agent releases are signed with minisign. The public key is published here so you have it from somewhere other than the script you are about to run.
The private key lives on the build machine — not on the central, and not in the repository. That is the whole point: the signature covers precisely the case where someone holds the server or the repository but not the key.
The public key is served inside the install script as MINISIGN_PUBKEY. Compare the two, and you have checked the script against a page it did not serve.
See the verification chain
Three anchors, and what each one catches.
Start freeRead the install docs