Agent and gateway settings
Configure executor identity, management reachability, local queues, health, and persistent state.
Agents and gateways run on managed devices or access hosts rather than inside the management API. Use their signed release package's configuration workflow on that host. The environment parsing and secret rules apply, and changes require restarting the named executor.
Endpoint agent
These variables configure the agent on its managed device:
| Variable | Default or requirement | Type, bounds, and behavior |
|---|---|---|
GUARD_AGENT_CONTROL_URL | Required | HTTPS management origin supplied by enrollment |
GUARD_AGENT_IDENTITY_FILE | Required after enrollment | File-only device-bound identity; never reuse across devices |
GUARD_AGENT_STATE_DIR | /var/lib/guard-agent on Linux | Absolute persistent path; other platforms use the package's native service data directory |
GUARD_AGENT_HEARTBEAT_SECONDS | 60 | Integer 15–300 seconds; does not promise network availability |
GUARD_AGENT_QUEUE_BYTES | 268435456 | Integer 16777216–4294967296 bytes; bounded local telemetry spool |
GUARD_AGENT_CA_FILE | System trust when omitted | Optional PEM CA bundle for management TLS; never disables certificate verification |
Enrollment supplies the control URL and identity through the installer. Supported environment overrides require local administrative authority and cannot bypass agent tamper controls. Enrollment tokens are one-time installer input, not long-lived daemon configuration.
The state directory preserves this device's identity, applied policy, and reporting progress. On agents with quarantine capability, it also holds protected local artifacts. Reuse the directory only for the same device; copying it to another device duplicates identity and response state.
GUARD_AGENT_QUEUE_BYTES limits buffered telemetry, not quarantine storage. When the queue fills, reporting can lose records. After reconnect, inspect Endpoints → Endpoint → Health for dropped-record counts and the reporting gap. Do not delete identity, response state, or quarantined artifacts to clear a full telemetry queue.
Access gateway
These variables configure the gateway on its access host:
| Variable | Default or requirement | Type, bounds, and behavior |
|---|---|---|
GUARD_GATEWAY_CONTROL_URL | Required | HTTPS management origin |
GUARD_GATEWAY_IDENTITY_FILE | Required | File-only site-bound identity issued at gateway enrollment |
GUARD_GATEWAY_STATE_DIR | /var/lib/guard-gateway | Absolute writable persistent path; preserves adopted policy and identity references |
GUARD_GATEWAY_TUNNEL_LISTEN | 0.0.0.0:51820 | Host and UDP port 1–65535 for the package's supported tunnel listener |
GUARD_GATEWAY_ACCESS_LISTEN | 0.0.0.0:443 | Host and TLS port 1–65535 for supported application access |
GUARD_GATEWAY_CA_FILE | System trust when omitted | Optional management trust bundle; unrelated to application backend TLS identity |
GUARD_GATEWAY_MAX_SESSIONS | 1000 | Integer 1–100000; capacity admission ceiling, not a licensed capacity override |
The site network must admit the chosen listener protocols. Binding a listener does not configure carrier routes or the host firewall. VPN peer profiles and ZTNA application policies are organization configuration, not environment secrets pasted into the gateway process.
A gateway restart can interrupt sessions. It preserves last adopted network policy in its state directory; fresh authorization-dependent sessions require the control path described in ZTNA. Inspect effective values locally through the signed package's service diagnostics and observe health under Access → Gateways → Gateway → Health. Never include identity-file contents in diagnostics.