web-prod-04 · logs\verlocx-agent.2026-10-19.txt · abridged

A small service in the guest. Outbound only.

2026-10-19T08:14:02.106Z INFO verlocx_agent: starting Verlocx agent service uuid=9b2e61f0-5c3a-4d7e-a1b8-0c42e7d9a315 backend=wss://verlocx-backend.example.com:8787/ws/agent

← new agent.key created

2026-10-19T08:14:02.214Z INFO verlocx_agent: tls connected

← outbound, port 8787

2026-10-19T08:14:02.231Z INFO verlocx_agent: enrolled with backend

← with bootstrap_secret

2026-10-19T08:14:02.236Z INFO verlocx_agent: backend identity verified

← matches backend_pubkey

2026-10-19T08:14:02.241Z INFO verlocx_agent: authenticated

← signed with its own key

2026-10-19T08:14:02.611Z INFO verlocx_agent: boot update-check: already up to date (running v0.0.34, latest v0.0.34)

← signed manifest

❯ online · metrics every 5 s · waiting for commands

It connects out to your Verlocx backend and does the in-guest work.

Agent docs

0inbound ports on the VM

Every connection starts inside.

No WinRM, no SSH — click a line to see what it carries.

Guest VMweb-prod-04runs: Verlocx agent

Verlocx backendrelaylistens: 8787 · 8788

Verlocx portalverlocx.example.comlistens: 443

guest VMportal

opened by this side commands and results, same socket

Selected link

Agent → backend

who connects: Opened by the agent in the guest
to: wss://verlocx-backend.example.com:8787/ws/agent
protocol: WebSocket over TLS, MessagePack frames

Enrollment and authentication
Metrics every 5 seconds
Commands, sent back down the same socket
Progress and results

Trust a key, not a certificate.

Identity comes from the backend key pinned in its config.

agentbackend

enroll
agent to backend:
Register { uuid, pubkey, bootstrap_secret }First boot only, or after Offboard. A UUID enrolled with another key is refused.
enroll
backend to agent:
Registered { ok: true }Key stored for this SMBIOS UUID.
agent to backend:
Hello { uuid }Every later start.
backend to agent:
Challenge { nonce, server_sig }Checked against backend_pubkey.
agent to backend:
ChallengeResponse { signature }Signed with agent.key.
backend to agent:
AuthOkBoth sides proven.
both ways:
Metrics · commands · resultsOne socket from here on.

config.toml

One file · 3 required keys · hover a line

C:\Program Files\Verlocx\Agent\config.tomlTOML

# WSS endpoint of the portal backend.backend_url = "wss://verlocx-backend.example.com:8787/ws/agent"
# Pinned backend Ed25519 public key (hex), from its server.pub file.backend_pubkey = "d17f1a2a80ff2ab3…7b6c830ff0"
# Pre-shared secret that lives in the VM template.bootstrap_secret = "a-long-random-secret"
# Override the SMBIOS UUID. Stays commented out in production.# override_uuid = "00000000-0000-0000-0000-000000000001"
# Where the agent persists its own Ed25519 key. Auto-created.agent_key_path = "agent.key"
# Portal agent-update manifest URL, checked on boot and once a day.update_url = "https://verlocx.example.com/api/agent/manifest"

backend_urlrequiredWhere to connectThe backend's WebSocket address.
backend_pubkeyrequiredThe only server it trustsEvery connection and every update must prove this key.
bootstrap_secretrequiredUsed to enrollEnrolls the agent's own key on first boot, or after Offboard. It opens nothing else — not the portal's connection, not another VM's identity.
override_uuidTesting onlyReplaces the SMBIOS UUID. Off in production.
agent_key_pathThe agent's own keyCreated on first start. Leave none in the template.
update_urlAutomatic updatesOptional: check for a newer build at boot and daily.

Some of it on request. Some of it on its own.

when the portal asks

Set the hostname
Join the domain
Add local administrators
Run workflow steps≥ 0.0.33
Run building blocks≥ 0.0.33
Run remote scripts
Scan a disk
Extend C:

without being asked

Report metrics every 5 s
Reconnect after 2 s
Deliver results after a reboot
Check for updates at boot and daily
Keep a daily rolling log

metricsevery 5 s · cpu · memory · volumes · uptimeevery 5 s

Fetch the manifestFrom update_url, or Fleet → Update agent.
Check its signatureVerified against backend_pubkey.
if unsigned or wrong key →refused, nothing downloaded
Compare versionsStrictly newer only. No downgrades.
if not newer →already up to date
Is Windows still setting up?No restart during setup or OOBE.
if busy →deferred to next boot or day
Download the buildCapped at 200 MB.
Verify SHA-256Against the signed manifest.
if mismatch →refused, old build keeps running
Swap and restartThe service restarts on the new binary.

Self-update, verified twice.

Only a build signed by the backend’s key and matching its checksum gets installed.

Every agent, on one page.

Open a row’s menu and press Update agent.

Fleet

Verlocx guest agents reporting to the portal · 4 agents, 3 online

Filter

4 agents

Agent UUID	Hostname	Linked VM	OS	Version	IP	vCPU	RAM	CPU%	Mem%	Uptime	Last seen
4c81d2aa…e7b2	app-test-12	app-test-12	Windows Server 2025 Standard	v0.0.33	10.20.4.62	2	8.0 GB	71%	48%	12d 2h	just now
71aa0c5e…f318	WIN-7Q2K4M1P0RS	unlinked	Windows 11 Enterprise	v0.0.31	10.20.6.140	2	4.0 GB	—	—	—	4h ago
9b2e61f0…a315	web-prod-04	web-prod-04	Windows Server 2022 Datacenter	v0.0.34	10.20.4.50	4	16.0 GB	23%	61%	3d 4h	just now
e03f7b19…4e86	sql-dev-02	sql-dev-02	Windows Server 2022 Standard	v0.0.33	10.20.5.17	8	32.0 GB	9%	88%	1d 7h	just now

1–4 of 4 agents

Rows per page25

Page 1 of 1

When something’s off, the log says so.

Select-String -Path logs\verlocx-agent.*.txt -Pattern10 matches

WARN verlocx_agent: connection error, reconnecting in 2s err=connecting to backend
to fixPort 8787 blocked, or backend_url wrong. Retries every 2 s.
WARN verlocx_agent: connection error, reconnecting in 2s err=backend identity check failed — pinned pubkey mismatch
to fixbackend_pubkey doesn't match the backend's server.pub.
WARN verlocx_agent: connection error, reconnecting in 2s err=registration rejected: …
to fixUsually a bootstrap_secret that differs from the backend's.
WARN verlocx_agent: connection error, reconnecting in 2s err=registration rejected: already enrolled with another key
to fixThis VM is enrolled with a different key — e.g. a reinstalled agent. Offboard it in Fleet; it enrolls again.
WARN verlocx_agent: Hello rejected; will re-register
expectedThe backend forgot this agent, e.g. after Offboard. It enrolls again.
INFO verlocx_agent: deploy step triggered reboot; result deferred
expectedRename or domain join. Delivered once the agent is back.
INFO verlocx_agent: set_local_admin ok request_id=…
expectedA domain account waits until the VM has joined, then it's added.
INFO verlocx_agent: boot update-check: update to v0.0.34 deferred — Windows busy: …
expectedWindows is still setting up. Retried at next boot or daily.
INFO verlocx_agent: boot update-check: update failed: manifest signature does not verify against the pinned backend key — refusing update
to fixNot signed with the backend's key. Nothing installed.
INFO verlocx_agent: boot update-check: update failed: sha256 mismatch — refusing to install (manifest …, downloaded …)
to fixChecksum mismatch. The running build stays.

Install it once, in the template.

Every clone creates its own key and shows up in Fleet on first boot.

template VM · elevated PowerShellPowerShell

.\install-agent.ps1 -InstallDir 'C:\Program Files\Verlocx\Agent'

Installation guide Pricing