Skip to content
WatchTower15 Docs

Configuration reference

The agent is designed to need almost no local configuration — most behaviour comes from the server profile it’s assigned to, served from the backend and refreshed automatically. The settings below are the local overrides, mostly used at install time or for special environments.

Environment variables

Section titled “Environment variables”

Set these in the systemd unit’s environment (or export them before running the installer). All are optional unless noted.

Variable Default Description
WT15_ORG_TOKEN — Organisation install token used at enrollment. Usually passed as the installer argument instead. Keep it in a secret store, not an image layer.
WT15_PROFILE_SLUG org default Assigns the host to a named profile at enrollment (e.g. production-servers).
WT15_API_BASE public API Base URL of the WatchTower15 API. Override for private/regional endpoints.
WT15_BINARY_URL public CDN Where the installer fetches the agent binary (used for air-gapped/mirrored installs).
WT15_DISABLE_LOGGING 0 Set to 1 to disable log collection and shipping entirely.
WT15_LOG_FILES profile-defined Comma-separated list of log files to tail. Fallback only — the profile’s log-file list takes precedence when present.
WT15_LOG_MAX_LINES 1000 Maximum log lines shipped per batch. Matches the backend’s per-batch cap.
WT15_LOG_STATE_PATH agent state dir Where per-file log checkpoints (inode + offset) are stored so shipping resumes exactly where it left off across restarts and rotations.
WT15_AGENT_LOG_PATH /var/log/wt15-server-agent.log The agent’s own diagnostic log.
HTTPS_PROXY — Standard proxy variable, honoured for all outbound requests.

Profile-driven settings (served from the backend)

Section titled “Profile-driven settings (served from the backend)”

These are not local environment variables — they are delivered as part of the agent’s configuration document (fetched on enrollment and whenever the X-Agent-Config-Etag changes). Manage them on the profile:

Setting Typical value Controls
Telemetry interval 60 s How often host telemetry is pushed.
System-info interval 300 s How often the fuller system-information snapshot is pushed.
Log files & folders profile list Which paths the agent tails and ships.
Server-led tagging on/off + filter Whether the agent self-reports tags, and the include/exclude filter applied.

Because intervals and log paths live on the profile, you can retune an entire fleet from one place without touching a single host — the change propagates on the next configuration poll.

The credentials file

Section titled “The credentials file”

At enrollment the agent stores its identity (server UUID, encrypted agent secret, and its self-reported tag baseline) in a local credentials file readable only by the wt15-agent user. This is what lets the agent sign requests and compute tag deltas without re-enrolling. Deleting it forces a fresh enrollment on next start.

Section titled “Related”