The design is a central hub the appliance reaches on its own. The firewall opens an outbound sealed wss:// channel; the hub never connects in. Enrolling adds no management listener on the box. The free Orchestrator download is the fleet hub. It is not a Business+ license feature.
Why outbound-only
- Nothing to attack. There is no management port to scan, exploit or brute-force. The only socket leaving the box is the one the agent opens.
- NAT and edge friendly. Appliances behind NAT or CGNAT reach the hub without inbound rules or port forwards.
- Revocable centrally. Drop a device at the hub and its channel is dead — no change on the firewall required.
Identity and encryption
Transport is wss://. On top of TLS, payloads are sealed end to end with the device's identity key against the hub's pinned public key, so confidentiality and integrity survive a TLS-terminating load balancer in front of the hub. The agent refuses any peer that is not the pinned one.
The device identity key lives in the secret store and is referenced by name, never inlined in the config document. Configuration validation refuses a hub URL that is not wss://, and requires a device id, an identity key reference and a pinned hub key before the feature can be enabled at all.
What the hub can do — per feature
Each capability is a separate toggle, so you can enrol for telemetry only if that is all you want.
| Feature | Commands | Backed by |
|---|---|---|
config_management | Get, commit, roll back configuration | configd's control API — full validation and auto-rollback |
telemetry | Collect system details | The active configuration and runtime state |
backups | Pull a disaster-recovery backup | The active revision — already a content-addressed document |
lifecycle | Updates, reboot, restart | The same image and service controls as a local operator |
Every hub-initiated change goes through configd's local control API, which means a remote commit gets the same validate → render → apply → confirm/rollback path as a local one. The agent is a transport, not a second writer — there is exactly one component that may write the document. The commit pipeline.
Status. The fleet hub is the free Orchestrator download. Firewalls dial out; the hub never dials in. Not a Business+ license feature. What ships today