# Options for the MetricHarbor agent service.
#
# This file is NOT inside /etc/metricharbor. That is deliberate: the unit grants the agent
# write access to /etc/metricharbor (it keeps its enrolment state and its credential store
# there), and a process that can rewrite its own hardening options is not constrained by them.
# Under ProtectSystem=strict the rest of /etc is read-only to the agent, so the options below
# can only be changed by root — which is the whole point of MH_OPTS=--no-exec.
#
# Change a value, then: systemctl restart metricharbor-agent

# --no-exec
#   Refuse `script` and `agent_exec` bindings outright, whatever the platform sends. This is
#   the control that survives a compromised platform: if our cloud were taken over, an
#   attacker could push a binding that runs a script on this host. With --no-exec the agent
#   refuses it, records why, and keeps collecting everything else. Customers who want
#   monitoring without remote execution should set this.
#
# --auto-update
#   Let the agent replace its own binary with a signed release when the platform says a newer
#   version is desired.
#
#   Left OFF here on purpose, and that is not timidity: this package is managed by apt or dnf,
#   and an agent that overwrites /usr/bin/metricharbor-agent behind the package manager's
#   back leaves the two permanently disagreeing about what is installed — until the next
#   `apt upgrade` silently reinstates an older binary. For package installs the platform
#   surfaces "agent out of date" and your own tooling does the upgrade. The tarball and
#   container builds, which no package manager owns, are where --auto-update belongs.
#
# --buffer-mb / --buffer-hours
#   How much collected-but-unshipped data to keep on disk during an outage, and for how long.
#   Defaults: 64 MiB, 72 hours. Raise both if this host monitors many targets and your link
#   to us is unreliable.

MH_OPTS=
