Pierrr Agent FAQ

What happens to my data if I uninstall the agent?

It stays on your server. sudo pierrr-agent uninstall stops and removes the agent, its service, its configuration and its logs, but keeps your containers, your projects' files, their backups and their databases: a new install on the same machine finds them again. To erase everything, sudo pierrr-agent uninstall --purge-data lists what will be deleted, then asks for a second confirmation, which the --yes option never gives. The server stays listed in the console: revoke or delete it from the Servers page, its projects stay attached to it. Details on the Install the agent page.

Does the agent auto-update?

No: the agent never updates itself. You start each update from the server page, and a progress bar follows each step (download, verification, installation, restart). The binary is verified before being replaced. Your containers keep running during the operation. The Pierrr team can only start an update of your server if you allow it, with the "Updates by the Pierrr team" setting on the server page, off by default.

How is the licence enforced?

Each server uses one license seat, or is created with a code (voucher) that uses no seat. The enrollment token is single-use and ties the agent to its server.

Can two agents share the same licence key?

No: each enrollment token works only once, for a single server. Generate one per machine, and buy extra seats for extra servers.

What happens if the agent loses contact with the hub?

The agent does not stop and keeps retrying, and your apps keep running. While the link is down no command reaches it, and Pierrr keeps none waiting to send it later: start the operation again once the server is back online.

Can I install the agent on a shared machine?

Yes: set CPU and memory ceilings and a disk reserve, see the install page. With no ceiling, behavior is unchanged.

Why does network traffic not show up?

It needs an agent on version 0.53.0-beta or newer. Update it from the server page; until then the project's Topology tab states that no traffic is measured.

Is the connection between Pierrr and my server safe?

Yes. The agent opens an encrypted connection to Pierrr itself, and since version 0.62.0-beta it refuses any command Pierrr did not sign. You can also limit what Pierrr may do on your server, in a file that belongs to you. Details on the Agent security page.

Which addresses should I allow if I filter outbound traffic?

Outbound HTTPS (port 443) to two addresses: install.pierrr.com, which serves the installer, and agents.pierrr.com, which the agent connects to and gets its updates from. A server connected before Pierrr version 0.0.49-beta goes through api.pierrr.com: keep it allowed. Once the server has moved to agents.pierrr.com from its page in the console, it no longer needs api.pierrr.com. No inbound port needs to be opened.

What stays on my server, and what goes through Pierrr?

On your server: your code, fetched and built there, the built image (never sent to Pierrr), your apps and their volumes, their cache, their files, each project's database, your apps' logs and your backups (a backup downloaded from the console goes through Pierrr without being kept, and encrypted for your public key if you added one). Your visitors connect to it directly. What goes through Pierrr, to drive it: the commands sent to the agent and their outcome, the status and metrics of the server and of the containers Pierrr manages (the rest of the machine is not reported), build logs, the outcome of the pre-build checks (never the content of a file, read on the server), the description of your projects (names, domains, ports, branches), your environment variables and your apps' access to their database, kept encrypted and sent to the server encrypted for a key only it holds. The databases' administration account stays on the server. Your apps' logs are only read on request, never kept. Security scans, of containers and code, run on your server: only their report comes back to Pierrr, with no excerpt of your code and never the value of a secret found in a repository, and even cut down to each finding's identifier and severity if you turn summary-only scans on. Your images stay on the server, unless you choose to publish them to your own registry. You can turn health readings off from the server page, and limit what Pierrr may do there with a local policy. WordPress sites run on your server too, with their database created on the machine. The database panel and import go through the agent: an import is restored on the machine, and the panel's pages go through Pierrr without being kept, the database credentials staying on the server. Your apps also send their emails through Pierrr there, via the agent, with no port opened. The console assistant does not read the logs, detailed health or variables of a project hosted on your server.

Can I take my projects back after a reinstall?

Yes, on the same machine. Uninstall or revoke the old agent, install the new one, then open its page in the console: a "Same machine as" notice offers to take over the projects still attached to the old agent. Their databases and files, kept at uninstall time, are found again on the machine, then each project is brought back up. A missing database is reported and never recreated empty: restore a backup in that case. The new agent must be online and your role must allow managing servers.

Why does the agent need ports 80 and 443?

They are how your visitors reach your sites: the agent serves your domains over HTTPS on 443, and uses 80 to obtain and renew their certificates, then redirect to HTTPS. Both ports must therefore be free and open to your visitors. If another program, such as a web server already installed, holds them, the agent says so instead of failing without explanation: stop or move that program, then try again. No port needs opening to drive the server: the agent connects to Pierrr by itself.

Where is the database of a project hosted on my server?

On that server. The agent creates it when the project is created and keeps it on the machine, without exposing it to the Internet: only the project's apps reach it. Pierrr only keeps, encrypted, what it needs to connect it to your apps, and it does not count towards your storage quota. A project on your server never uses a database hosted by Pierrr, and it cannot move to another server while it has its database, except to an agent reinstalled on the same machine. Backups, restores and extensions go through the agent, which must be version 0.64.0-beta or later: the console tells you otherwise. The admin panel and importing an SQL file go through the agent too, version 0.71.0-beta or later. A major version upgrade of the database starts from the server page: it is never automatic, and the previous version comes back if it fails.

Are the cache and volumes paid for on my server?

No. For a project on your server, the cache and volumes are included, with no add-on to buy and no quota: add them from the project. They do not follow the project if it leaves this server. Object storage remains a paid option.

Are my backups encrypted? Who can open them?

Add your public encryption key from the Backups tab of the server's page in the console: every backup that leaves the server, downloaded from the console or copied off site, is encrypted for that key on the server, and only your private key opens it. Pierrr only keeps its fingerprint, never the private key, which stays on your computer: a private key pasted by mistake is refused. The archive kept on the server stays readable by the agent, so restoring from the console always works. A downloaded archive arrives encrypted: open it with your private key and your usual encryption tool. Without a key, downloading still works: the archive then passes through Pierrr without being kept, and the console invites you to add a key.

How do I copy my backups off my server?

Set the destination on the server itself: sudo pierrr-agent backups set-remote, to a disk, a mounted share or object storage (sudo pierrr-agent backups set-remote --help lists the options); any secret is asked at the prompt. The credentials stay on the server and are never sent to Pierrr. After each backup, the agent copies the archive there, encrypted for your key: without a key, nothing is copied. Expired backups are removed from the destination too, and the project's Backups tab shows for each one whether the copy succeeded. sudo pierrr-agent backups status shows the key and the destination, sudo pierrr-agent backups unset-remote stops the copy.