Why the agent dials out

The usual setup

Most “manage my VPS for me” products start with the same assumption: the control plane must be able to reach the machine. That usually means an SSH key in a vault, an agent listening on a public port, or a VPN that turns every box into part of someone else’s network.

It works in demos. It also means a compromised control plane — or a leaked key — can walk into every customer server. The blast radius is structural, not accidental.

Flip the direction

Boson’s agent is a Rust binary you install on the VPS. It dials out over WebSocket to the control plane and keeps that session alive with heartbeats. We never need an inbound management port for normal operation.

Pairing uses a short-lived join token. The agent exchanges it for longer-lived credentials, then you can revoke the agent from the dashboard when the box is retired. There is no standing SSH key sitting in our cloud waiting to be abused.

What outbound actually buys you

Smaller attack surface on the VPS

Firewall policy gets simpler: allow 22 for your own ops if you want it, allow 80/443 for the gateway, deny the rest. You are not punching a hole so Boson can “come in and help.”

Clear ownership of secrets

Deploy credentials, registry tokens, and app env vars can stay on the machine. The control plane orchestrates; the agent executes locally against docker.sock and the filesystem you already trust.

Failure modes you can reason about

If the control plane is down, the agent cannot receive new deploy jobs — but your running containers and gateway keep serving traffic. If the agent dies, you notice from heartbeats, not from a silent open door.

What we still have to get right

Outbound is not magic. The agent is powerful on the box: it can build and run containers. Treat join tokens like secrets. Rotate and revoke. Keep the binary updated. Prefer least privilege around docker access where your threat model demands it.

The point is not that security becomes free. The point is that the default trust model stops requiring inbound admin access from a multi-tenant control plane.

The product shape that follows

Once the agent dials out, the rest of Boson can stay honest about ownership: your VPS runs the workload, our control plane schedules and observes, and the gateway on your edge is what makes request metrics exist without an SDK.

That is why the install path is a curl | sh with a join token, not “paste your SSH private key into a form.” Direction matters.