# ash-agent

Proof-of-concept host agent for All Source Hosting. Go, standard library only (no third-party dependencies), so the whole thing is auditable in a sitting.

It talks only to the Proxmox API you point it at (`ASH_PVE_URL`). It makes no other network connections.

| File | What it does |
|---|---|
| `main.go` | CLI: `vyos-config`, `preflight`, `deploy-vyos`, `certify-request` |
| `pve.go` | Minimal Proxmox VE API client; `--dry-run` prints calls instead of sending |
| `vyos.go` | Renders VyOS 1.4 config (DHCP, NAT, firewall, optional WireGuard) |
| `certify.go` | Read-only host checks that become the certification report |
| `main_test.go` | Tests against a mock Proxmox server |

```
go build -o ash-agent .
go test ./...
export ASH_PVE_URL=https://pve.lan:8006 ASH_PVE_TOKEN='ash@pve!agent=<secret>' ASH_PVE_NODE=pve
./ash-agent deploy-vyos --dry-run --wireguard
```

Credentials are read from the environment, never flags. Generated config files are written mode 0600 because they can contain a WireGuard private key. See the Docs tab on the site for the full setup guide.