Move a site agent

A site agent’s identity is its registration token, its WireGuard key, the allow-list of forwarding targets and its firewall settings. Moving it takes these to the new host, so the panel keeps seeing the same agent.

1. Export on the old host

trixos-agent export /root/trixos-agent-bundle.tgz

The bundle contains the agent token and the WireGuard private key. Treat it like a password.

2. Install on the new host

Copy the bundle to the new host, for example with scp, and run the installer with it:

curl -fsSL https://panel.example.com/agent/install.sh | bash -s -- --panel https://panel.example.com --bundle /root/trixos-agent-bundle.tgz

The new host needs the same network legs as the old one: an interface in the provisioning network and one in the out-of-band network. Pass --public-if and --oob-if when the interface names differ.

System → Agents → ⋯ → Move / export in the panel shows the same steps with your panel’s address filled in.

3. Finish

• WireGuard roams to the new address on its own. If the panel’s firewall only accepts WireGuard from known agent addresses, add the new address there.
• Delete the bundle on both hosts.
• Switch off the old agent host so that two agents never answer DHCP for the same site.

System → Agents shows the agent online with the new host name and a fresh tunnel handshake.