[Feature] Reverse agent connection

[AndreKR]

Currently the periphery agent needs to be reachable and have valid TLS certificates so that the server can connect to the agent.

If the agent could connect to the server instead, Komodo would be able to manage devices that do not provide a web server (or any server at all).

It would also simplify certificate management because only the server would need to have valid TLS certificates, not every agent.

This is related to #123 and #147.

[mbecker20]

Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication.

[freedbygrace]

There is also a protocol called NATS that could help with this.

https://youtu.be/hjXIUPZ7ArM

[mbecker20]

It is coming #889

But the change is not breaking for existing users.

[Mannshoch]

Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication.

I like this idea. But I would propose to use this token only on the first connection. After that both should create their own unique token (or a certificate) for future connection.

That way Komodo is able to detect if the agent is fresh setup or - if the token refresh permanently - even if it was restored from a backup and could notify about that.

[AndreKR]

I think that is exactly how it is working. Have you tried v2.0? ghcr.io/moghtech/komodo-core:2-dev

[Mannshoch]

No, I simply passed by while searching for some answers about komodo and this was one of my Question.