Originally created by @AndreKR on GitHub (Jan 29, 2025).
Original GitHub issue: https://github.com/moghtech/komodo/issues/281
Currently the periphery agent needs to be reachable and have valid TLS certificates so that the server can connect to the agent.
If the agent could connect to the server instead, Komodo would be able to manage devices that do not provide a web server (or any server at all).
It would also simplify certificate management because only the server would need to have valid TLS certificates, not every agent.
This is related to #123 and #147.
Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication.
<!-- gh-comment-id:2622537584 -->
@mbecker20 commented on GitHub (Jan 29, 2025):
Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication.
<!-- gh-comment-id:2685374236 -->
@freedbygrace commented on GitHub (Feb 26, 2025):
There is also a protocol called NATS that could help with this.
https://youtu.be/hjXIUPZ7ArM
But the change is not breaking for existing users.
<!-- gh-comment-id:3370193087 -->
@mbecker20 commented on GitHub (Oct 6, 2025):
It is coming https://github.com/moghtech/komodo/pull/889
But the change is not breaking for existing users.
Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication.
I like this idea. But I would propose to use this token only on the first connection. After that both should create their own unique token (or a certificate) for future connection.
That way Komodo is able to detect if the agent is fresh setup or - if the token refresh permanently - even if it was restored from a backup and could notify about that.
<!-- gh-comment-id:3521576157 -->
@Mannshoch commented on GitHub (Nov 12, 2025):
> Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication.
I like this idea. But I would propose to use this token only on the first connection. After that both should create their own unique token (or a certificate) for future connection.
That way Komodo is able to detect if the agent is fresh setup or - if the token refresh permanently - even if it was restored from a backup and could notify about that.
I think that is exactly how it is working. Have you tried v2.0? ghcr.io/moghtech/komodo-core:2-dev
<!-- gh-comment-id:3521609061 -->
@AndreKR commented on GitHub (Nov 12, 2025):
I think that is exactly how it is working. Have you tried v2.0? `ghcr.io/moghtech/komodo-core:2-dev`
No, I simply passed by while searching for some answers about komodo and this was one of my Question.
<!-- gh-comment-id:3521850349 -->
@Mannshoch commented on GitHub (Nov 12, 2025):
No, I simply passed by while searching for some answers about komodo and this was one of my Question.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @AndreKR on GitHub (Jan 29, 2025).
Original GitHub issue: https://github.com/moghtech/komodo/issues/281
Currently the periphery agent needs to be reachable and have valid TLS certificates so that the server can connect to the agent.
If the agent could connect to the server instead, Komodo would be able to manage devices that do not provide a web server (or any server at all).
It would also simplify certificate management because only the server would need to have valid TLS certificates, not every agent.
This is related to #123 and #147.
@mbecker20 commented on GitHub (Jan 29, 2025):
Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication.
@freedbygrace commented on GitHub (Feb 26, 2025):
There is also a protocol called NATS that could help with this.
https://youtu.be/hjXIUPZ7ArM
@mbecker20 commented on GitHub (Oct 6, 2025):
It is coming https://github.com/moghtech/komodo/pull/889
But the change is not breaking for existing users.
@Mannshoch commented on GitHub (Nov 12, 2025):
I like this idea. But I would propose to use this token only on the first connection. After that both should create their own unique token (or a certificate) for future connection.
That way Komodo is able to detect if the agent is fresh setup or - if the token refresh permanently - even if it was restored from a backup and could notify about that.
@AndreKR commented on GitHub (Nov 12, 2025):
I think that is exactly how it is working. Have you tried v2.0?
ghcr.io/moghtech/komodo-core:2-dev@Mannshoch commented on GitHub (Nov 12, 2025):
No, I simply passed by while searching for some answers about komodo and this was one of my Question.