Fleet
The agent on each server — what it collects, what it may be asked to do, and who may ask.
Fleet is the servers with an agent installed, and everything you can do through it.
The shape
┌─ AccelerUp control plane ─┐
│ │
│ /api/v1/agent/connect ◄──┼──── outbound websocket
│ │ (nothing open inbound)
└────────────────────────────┘
┌── each server ──┐
│ accelerated │
│ profile caps │
│ what it accepts│
└─────────────────┘The agent dials out. Nothing needs to be open inbound, and the control plane cannot reach a machine that has not chosen to connect.
What you can do
Profiles cap everything
The agent's profile is set on the machine and cannot be widened remotely.
| Profile | Allows |
|---|---|
observe | Reporting only. No shell, no file transfer, no commands |
operate | Declared commands and unit actions. No interactive shell |
full | Everything |
This is the outer boundary. An AccelerUp admin cannot get a shell on an
observe machine, no matter what grants exist. The machine decides what it
is willing to do, and the control plane can only ask within that.
Fleet UI conventions
If you are contributing: Fleet pages import layout primitives from
agent-ui.tsx (PageHead, Note, Empty, Banner, Card, Tag, Pill,
Stat, Field, Stack, Row). Never redefine them locally.
Note and Empty are a real distinction: Empty means there is nothing yet,
Note means there is something you should know.
Where this behaviour lives: backend/cmd/accelerated/, backend/internal/service/agent_svc.go. If the code and this page disagree, the code is right — please fix the page.
Part of Fleet — The agent on each server: what it collects and what it may be asked to do.