Agent binding
When the agent is in bind mode, the client connects directly to the port exposed by the agent (see Agent binding transport).
Quick usage
To do this, tealc bind starts a full local server instance (the same embedded server used by tealc embed-server, see Embed server) to accept the agent’s connection.
tealc bind <AGENT_ADDR>
Only the first agent to connect is used to open an SSH session. Any agent that connects afterward is terminated immediately; this happens regardless of the --kill flag. --kill only controls whether the agent actually used for the session is terminated once that session ends.
Options
--killwhether to kill the agent on disconnection<AGENT_ADDR>: the agent to bind to, format:[IP]:[PORT]--age-privkey: age private key for the embedded server.tealcrequires this key to be provided via one of these methods:--age-privkeyflag- Configuration file entry
- Environment variable
- Compile-time embedding via
CLIENT__AGE_PRIVKEY(see Compile agent)
--http-listen-addr,--https-listen-addr,--dns-listen-addr,--quic-listen-addr: override the listen addresses for the embedded server’s respective services, matching their Listening services counterparts.
--ssh-listen-addr exists as a flag but has no effect here: tealc bind’s embedded server never binds a raw SSH TCP listener. The agent reaches sshd in-process regardless of transport, and the operator’s own SSH connection is always routed through the embedded server’s /ssh-ws/ WebSocket endpoint instead of a -p<port> TCP dial (see Connecting over WebSocket in client/SSH).