Configuration
Single source of truth
manager.config.yaml is the single source of truth: endpoints (entry + spawn lifecycle
for each DSH process), agents (workspace bindings), runner
(timeouts/silence/budget), pricing (peak/off-peak windows + weekend rule),
brain.daily_budget_usd (brain dispatch breaker).
[!IMPORTANT] Secrets live only in
.env(GW_KEY_*/BRAIN_TOKEN) — never in git.
Domain + TLS
Answer the domain question during install and pick a TLS mode. See Quick start for the three ways to supply a certificate. The manager turns on secure cookies automatically in production.
Per-node DSH version
The node wizard accepts an optional dsh_version, validated against the version matrix
SUPPORTED_DSH (each row pairs a DSH version with a facade ref). Unknown versions are
rejected; pairs not yet verified install with a warning. Switching versions is a page
action on /nodes (container = image rebuild; process = reseed + reinstall + restart).
Facade firewall whitelist (required before going cross-network)
A node's facade port (e.g. 3081) is exposed on its server and must only allow the manager's egress IP. The GUI uses the user-side SSH tunnel (loopback) and is unaffected.
- Linux (ufw):
sudo ufw allow from <manager-egress-IP> to any port 3081 proto tcp && sudo ufw enable - Linux (firewalld):
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<manager-egress-IP>" port port="3081" protocol="tcp" accept' && sudo firewall-cmd --reload - Cloud security group: inbound only
<manager-egress-IP>/32→ node port, deny everything else.
Acceptance: curl the facade from a non-whitelisted IP → refused; the manager's probe
still shows the node live on /nodes.
Limits and scale
- Channel rate limits: join issue 20/min, agent register 10/min, command long-poll 240/min, event report 240/min, revoke/rotate 20/min — all counted per agent / per user.
- A single manager is comfortable up to ~50 machines; larger fleets → multiple managers (planned).