Install the VaultLayer Agent

What the agent does

The VaultLayer Agent is a lightweight service that sends authenticated server telemetry to VaultLayer every 60 seconds. It reports operating-system, CPU, memory, disk, runtime, service and uptime information without opening an inbound port.

• Outbound HTTPS only
• Single-use, 30-minute enrolment tokens
• Agent credentials stored locally with owner-only permissions
• Allow-listed diagnostics — no arbitrary remote shell
• Automatic restart through systemd

Requirements

The current installer supports Linux servers using systemd and Node.js 20 or newer. The agent is suitable for Forge, DigitalOcean, Hetzner, Vultr, Linode and conventional VPS deployments.

• Linux with systemd
• Node.js 20+
• sudo access
• Outbound HTTPS access to VaultLayer

Install

Open the website in VaultLayer, choose Settings, then find VaultLayer Agent. Select Generate install command, copy the one-line command and run it with sudo on that website's server.

The command downloads the application-hosted agent, exchanges the one-time token for a unique agent credential, installs a systemd service and begins reporting immediately. The website Settings page changes to Connected after its first heartbeat.

Verify and troubleshoot

Check service health with: systemctl status vaultlayer-agent. Follow logs with: journalctl -u vaultlayer-agent -f. The local configuration is stored at /etc/vaultlayer-agent.json with owner-only permissions.

If the agent shows Offline, verify that the server can reach your VaultLayer URL over HTTPS and that its clock is correct. Generate a new install command if the token expired; tokens cannot be reused.

Security model

VaultLayer stores only a SHA-256 hash of the agent credential. Revoking an agent immediately invalidates its credential. Remote actions are restricted to a fixed allow-list of diagnostics; command payloads cannot contain arbitrary shell commands.