Appearance
xg3 Agent
The xg3 Agent runs in your network. It connects outbound to the xgress3 regional gateway, receives relayed HTTP requests, forwards them to your private backends, and returns responses. It does not accept inbound connections from the internet.
After a one-time enrollment, the agent holds a client certificate and maintains a long-lived tunnel. Your operators manage agents, services, and credentials in the console — the agent itself does not store OAuth secrets or service keys.
What the agent does
| Area | Behavior |
|---|---|
| Enrollment | Registers with the regional gateway, displays a code for console approval, obtains a certificate, opens a tunnel |
| Interactive console | On Windows CLI (without --no-interactive), shows enrollment / running / error status screens; logs go to {data-dir}/logs/ |
| Log files | Rolling files under {data-dir}/logs/ (7-day retention); verbosity via RUST_LOG |
| Data plane | Forwards authorized HTTP/HTTPS to your configured backend URLs |
| Resume | After restart, reuses on-disk certificate and skips enrollment when files are valid |
| Reconnect | Automatically reopens the tunnel after disconnect (unless shut down or told to stand down) |
| Upgrade | Operators can upgrade from the console while the tunnel is connected; the prior binary is retained for rollback |
| Renewal | Renews the client certificate before expiry while the tunnel is running |
What the agent does not do
- Terminate or validate caller credentials (JWT or service keys) — that happens at the gateway before relay
- Provide VPN or arbitrary network access
- Listen for inbound connections from the internet
Prerequisites
- Outbound HTTPS access from the agent host to your regional gateway (for example
https://au.xg3.io) - Outbound HTTP/HTTPS from the agent host to your backend URLs configured in services
- An operator with console access to approve the enrollment code
Next steps
| Task | Document |
|---|---|
| Install and start the agent | Install and run |
| Enrollment flow and certificate files | Enrollment |
| Tunnel behavior, upgrades, rollback, exit codes | Operations |
| Console approval and services | Agents and services |