[GH-ISSUE #281] [Feature] Reverse agent connection #4793

New Issue

GiteaMirror · 2026-04-21T23:49:44-05:00

GiteaMirror commented

2026-04-21 23:49:44 -05:00

Originally created by @AndreKR on GitHub (Jan 29, 2025).
Original GitHub issue: https://github.com/moghtech/komodo/issues/281

Currently the periphery agent needs to be reachable and have valid TLS certificates so that the server can connect to the agent.

If the agent could connect to the server instead, Komodo would be able to manage devices that do not provide a web server (or any server at all).

It would also simplify certificate management because only the server would need to have valid TLS certificates, not every agent.

This is related to #123 and #147.

Originally created by @AndreKR on GitHub (Jan 29, 2025). Original GitHub issue: https://github.com/moghtech/komodo/issues/281 Currently the periphery agent needs to be reachable and have valid TLS certificates so that the server can connect to the agent. If the agent could connect to the server instead, Komodo would be able to manage devices that do not provide a web server (or any server at all). It would also simplify certificate management because only the server would need to have valid TLS certificates, not every agent. This is related to #123 and #147.

GiteaMirror added the seen 👀 label 2026-04-21 23:49:44 -05:00

GiteaMirror commented

2026-04-21 23:49:46 -05:00

@mbecker20 commented on GitHub (Jan 29, 2025):

Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication.

@mbecker20 commented on GitHub (Jan 29, 2025): Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication.

GiteaMirror commented

2026-04-21 23:49:47 -05:00

@freedbygrace commented on GitHub (Feb 26, 2025):

There is also a protocol called NATS that could help with this.

https://youtu.be/hjXIUPZ7ArM

@freedbygrace commented on GitHub (Feb 26, 2025): There is also a protocol called NATS that could help with this. https://youtu.be/hjXIUPZ7ArM

GiteaMirror commented

2026-04-21 23:49:47 -05:00

@mbecker20 commented on GitHub (Oct 6, 2025):

It is coming https://github.com/moghtech/komodo/pull/889

But the change is not breaking for existing users.

@mbecker20 commented on GitHub (Oct 6, 2025): It is coming https://github.com/moghtech/komodo/pull/889 But the change is not breaking for existing users.

GiteaMirror commented

2026-04-21 23:49:48 -05:00

@Mannshoch commented on GitHub (Nov 12, 2025):

Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication.

I like this idea. But I would propose to use this token only on the first connection. After that both should create their own unique token (or a certificate) for future connection.

That way Komodo is able to detect if the agent is fresh setup or - if the token refresh permanently - even if it was restored from a backup and could notify about that.

@Mannshoch commented on GitHub (Nov 12, 2025): > Yes I have considered this and agree, I was planning this for Komodo v2 (it would definitely be breaking change for existing users). The idea is the Periphery agent is given a Core endpoint and an identity token generated by Core unique to each server. Then they will persist outbound websocket connection to Core to achieve duplex communication. I like this idea. But I would propose to use this token only on the first connection. After that both should create their own unique token (or a certificate) for future connection. That way Komodo is able to detect if the agent is fresh setup or - if the token refresh permanently - even if it was restored from a backup and could notify about that.

GiteaMirror commented

2026-04-21 23:49:49 -05:00

@AndreKR commented on GitHub (Nov 12, 2025):

I think that is exactly how it is working. Have you tried v2.0? ghcr.io/moghtech/komodo-core:2-dev

@AndreKR commented on GitHub (Nov 12, 2025): I think that is exactly how it is working. Have you tried v2.0? `ghcr.io/moghtech/komodo-core:2-dev`

GiteaMirror commented

2026-04-21 23:49:49 -05:00

@Mannshoch commented on GitHub (Nov 12, 2025):

No, I simply passed by while searching for some answers about komodo and this was one of my Question.

@Mannshoch commented on GitHub (Nov 12, 2025): No, I simply passed by while searching for some answers about komodo and this was one of my Question.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/komodo#4793