Restricted networks and regions

Besides the team key, the installer accepts a few environment parameters. These describe the install environment, not monitoring logic. They matter in locked-down networks and when data residency is a requirement. Only --key is required. Check the installer --help for the exact flag names, they are listed there.

Outbound proxy

The agent only makes outbound connections (HTTPS for the one-time bootstrap, then the persistent WebSocket). If the host reaches the internet through a proxy, point the agent at it at install time. No inbound ports are ever needed.

Custom CA

In a network with an internal PKI or a TLS-inspecting proxy, add your trusted root CA to the host's system trust store so the agent's outbound connection validates. Note that the data-plane WebSocket is certificate-pinned to Wakora's own key regardless, so this applies to the outbound path through your infrastructure.

Data region

The backend is a managed SaaS. There is no on-premise or self-hosted backend. Where the physical location of data matters, you choose a region, and the installer installs the matching regional build of the agent. The server endpoint is baked into the binary at build time, so there is no server address in any file on the host. Data residency is a region choice, not on-premise. High availability is a cluster plus multi-region.

Host label or group

You can pass a label or group for the host. It travels as part of the host identity at registration, so the host shows up under the right group in the console from the first heartbeat.

What is never in a host file

The endpoint, the certificate pin, and the publisher key are all baked into the binary at build time. None of them live in an on-host file, so there is nothing there to tamper with or to leak.