Zero-Touch Enrollment
On the DRLink Server:
DataRelay Link returns a one-time installation command for the intended host.
Security limits
Each ticket is unique. Raw ticket/install URL material is shown only at issuance. Persistent Server state stores a verifier/hash plus lifecycle metadata, not a redisplayable raw ticket.
A successful enrollment atomically consumes the ticket. Reusing a consumed ticket is denied.
Important boundary
Zero-Touch enrolls the Agent. It does not create OS users, change SSH configuration, modify cloud firewalls, or automatically create policy Rules.
Current DNS-optional enrollment
DataRelay Link generates a compact one-time launcher using a trusted public HTTPS hostname or a numeric-IP path with verified Private CA fingerprint and certificate IP SAN. DNS is optional. If neither path qualifies, it fails before service prompts/ticket issuance. Run the exact generated command; do not reconstruct historical long bootstrap payloads. SSH username may be blank.
Automatic setup and additional services
Services selected through Zero-Touch SSH only, RDP only or Choose Remote Services automatically receive the required Service Object, Remote Service and public endpoint reservation during enrollment. Do not create the same service manually again. Inspect actual names with show remote-services on the Agent.
A blank username in SSH only affects connection hints; it is not management-only enrollment. To enroll without publishing services, run set enrollment bulk, choose count 1 and leave the SSH username blank. Choose Remote Services requires at least one service. OS accounts, sshd/RDP, external firewalls and Access Policy rules remain separate.
Only when adding a new destination/port to an existing Agent, inspect/prepare the Server Object definitions and use set remote-service <NAME> on the owning Agent.Last modified on October 29, 2026
