Compile agent

The client can recompile agents for different platforms and architectures.

Quick usage

Compile an agent for a target operating system and architecture:

tealc compile --id agent --goos linux --goarch amd64

The output is written below output/agent/ by default. Use tealc compile --drop-env when you need to customize the agent’s compiled-in defaults.

Before distributing a binary, verify its target OS, architecture, server address, public key, transport order, and authentication settings.

tealc compile (--id [ID]) (-O|--goos [OS]) (-A|--goarch [ARCH])

The ID flag can be:

• client
• server
• agent
• agent-mini: a small stager. It does not carry the full agent’s functionality itself. At runtime, it fetches the full agent from the server over the encrypted control channel and runs it (see Compilation).
• agent.dll
• shim: a Windows-only VS Code SSH parent-process compatibility shim.

The ARCH flag can be:

• amd64
• arm64
• arm
• 386

The OS flag can be:

• darwin
• linux
• windows

Compilation options

• -K/--age-public-key: age public key to embed in the compiled agent.
• -p/--compiler-agent-password: sets the agent’s static password (AGENT__PASSWORD) at compile time.
• --nopass: compile the agent without a static password.
• --compress: compress the compiled binary (controls the COMPRESS build variable).
• --seed: seed used to obfuscate the agent (sets CLIENT__COMPILE_SEED). Obfuscation is enabled by default even without this flag: a random seed is auto-generated unless --seed is explicitly set. To disable obfuscation entirely, pass an empty seed (--seed=""): the build then falls back to a plain, unobfuscated go build instead of garble.
• -o/--output: folder containing compiled agents.
• --source: source Goauld directory.
• --[no-]tiny: garble “tiny” flag (reduce size, but no stacktrace; enabled by default).
• --[no-]literals: garble “literals” flag (obfuscate string variables, but take more space; enabled by default).
• --keep: keep temporary sources.
• --wordlist: wordlist file used to compile.

Compile the agent with custom default values

1. Generate the configuration file:

tealc compile --drop-env > ./env.txt

This configuration file can then be modified to set custom defaults before recompilation.

# Optional seed used during agent compilation/obfuscation.
CLIENT__COMPILE_SEED=

# Shared secret used by the server to authenticate clients.
# Keep this value private and generate a strong random token.
COMMON__ACCESS_TOKEN=

# Public age key corresponding to the server's private key
AGENT__AGE_PUBLIC_KEY=age1e4txlmjtmc4sx5f8s7fhpka64d4d05rj3qn3jy4tgrta4p22euvq00ac5p

# HTTP domain
HTTP_DOMAIN=www.example.com
# Domain used to perform SSH over TLS
TLS_DOMAIN=app.example.com
# Primary domain used for SSH-over-DNS transport
DNS_DOMAIN=t.example.com
# SSHD port exposed by the server
SSHD_PORT=2222
# HTTP Port
HTTP_PORT=80
# HTTPS port
HTTPS_PORT=443
# DNS Port
DNS_PORT=53
# Quic Port
QUIC_PORT=443
# Whether generated agents should be compressed (true|false).
# Leave empty to use the default behavior.
COMPRESS=
# Either "http" or "https", depending on how the server is exposed.
AGENT__SERVER_SCHEME=http

tealc compile --env [/PATH/TO/ENV]

Reusing a value across multiple variables

Variables can reference other variables using $VARNAME syntax. This avoids repeating values across server, agent, and client sections:

Example:

HTTP_DOMAIN=www.example.com
...
SERVER__HTTP_DOMAIN=$HTTP_DOMAIN

Reference resolution

• References are resolved recursively: a variable can reference another variable that itself references a third one.
• Self-referencing and circular chains resolve to an empty value without an error.
• If a variable name is not found in the file, the client falls back to the system environment variable of that name, when available.