Architecture
The diagrams below show how the three Goauld components fit together and how an operator request travels through the server to an agent.
The full architecture diagram is retained below for implementation-level details.
Agent connection
In the normal brokered deployment, the agent does not require an inbound connection. It establishes its control and data connections outbound to the server. Agent-binding mode is an explicit exception in which the agent opens a listener for a client; see Agent binding.
Transport flexibility
The agent maintains two outbound paths. A Socket.IO control channel carries registration, heartbeats, metadata, and control instructions over HTTP long polling, WebSocket over HTTP(S), or WebSocket encapsulated over DNS. A separate SSH data connection carries shells, file transfers, proxies, forwards, and other operational traffic. The SSH connection can use direct SSH or be encapsulated over TLS, WebSocket, HTTP, DNS, or QUIC, depending on network restrictions.
Server as broker
On the server side, the control channel registers the agent and maintains its online state. The SSH connection authenticates separately and exposes the agent’s operational services. The client uses the HTTP API to discover and manage agents, then uses the server’s SSH entry point for shells, transfers, proxies, and forwards.
The server acts as a broker: it terminates the agent’s tunnel on one side and exposes a management interface to operators on the other, without either side needing to reach the other directly.
The default SSH listener exposed by the server is :2222 (see Quick start).
In-process routing
Beyond its core transport listeners (SSH, TLS, HTTP, DNS, and QUIC; see Listening services), the server does not open a separate listening socket for every forwarded proxy or port. An agent’s SOCKS, HTTP, and MITM proxies and remote port forwards are each identified by a virtual port scoped to that agent’s SSH connection. The server resolves that virtual port in-process when an operator asks to reach it. See Exposed proxies.
The same design is used by tealc bind and tealc embed-server; see Agent binding and Embed server. Their embedded server routes the connecting agent to sshd in-process instead of binding a raw SSH TCP listener. The number of externally exposed sockets therefore does not grow with the number of active proxies and forwards.
