Module enroll_client 

Node side of enrollment: key generation in the node’s own state directory, the signed request with the operator’s one-time code, and the stored public answer.

Keys live in <state dir>/identity.key and <state dir>/wg.key (directory 0700, files 0600) and never leave the host; only public keys are sent. Run provider agents as another user (or inside a guest) so they cannot read this directory.

Structs

EnrolledState

Public result of a successful enrollment, stored next to the keys.

Enums

EnrollClientError

EnrollTarget

Where to send the enrollment request.

Functions

default_enroll_dir

Default state directory: $XDG_STATE_HOME/gate4agent-node/enroll or $HOME/.local/state/....

enroll

Generate (or load) the keys, send the signed request, store the public answer.

enroll_to

enroll to any EnrollTarget.

load_enrolled

Load the identity and the stored public answer of an enrolled node.

load_enrolled_signing_only

Load the identity for signing only (no WireGuard key is read) and the enrolled state. For a node whose tunnel is brought up by a privileged helper.

node_call

Make a signed mail/task call through C2 (op like mail.send, task.list). The node proves who it is with its identity key; no server credential is involved. Returns the reply JSON.

request_build

Ask C2 to build and sign a configured recipe on the build host. The node proves who it is with its identity key; it holds no build-host credential and never sees a signing key. The receipt is checked against trusted_signer (the operator-provided public key of the build host) and the artifact against the signed hash before it is returned.

wireguard_env_from_state

Environment the kernel WireGuard bring-up reads, from the enrolled state. Only variables that are unset are filled. Returns the call-home address when the answer carries one.