# Generated from Goauld config/client_config.yaml. Do not edit manually.
# HTTP server address to connect to.
server: http://www.example.com

# SSH server address to connect to.
ssh-server: www.example.com:2222

# Tunnel SSH traffic over a WebSocket to the server's HTTP(S) address (--server) instead of a raw TCP connection to --ssh-server. Requires the server to be started with --ssh-websocket. Useful when only HTTP(S) egress is available, e.g. behind a restrictive reverse proxy.
ws: false

# Seconds to wait for the agent to come online (0 waits indefinitely).
wait-timeout: -1

# Access token for the /manage/ API endpoint.
access-token: ACCESS_TOKEN_REPLACE_ME

# Admin token for the /admin/ API endpoint.
admin-token: ADMIN_TOKEN_REPLACE_ME

# Suppress all log output.
quiet: false

# Increase log verbosity. Repeat for more detail.
verbose: 0

# Allow insecure connections (skip TLS certificate verification).
insecure: false

# Display version information and exit.
version: false

# Generate a configuration file based on the current options.
generate-config: false

# Path to configuration file.
config-file: ""

# Agent password map (internal use only).
agent-password: {}

# Agent static password.
password: ""

# Prompt for the agent's static password.
prompt: false

# Save the prompted password in the configuration file.
save-password: false

# Enable SSH control master to reuse the SSH connection.
control-master: false

# Connect to an agent via SSH.
# Place SSH options at the end of the command line:
#  tealc ssh [TEALC OPTIONS] AGENT [SSH OPTIONS]
ssh:
  # Target agent to connect to.
  agent: ""
  # Forward the agent's SOCKS proxy to the local host.
  socks: true
  # Forward the agent's HTTP proxy to the local host.
  http: true
  # Forward the agent's HTTP MITM proxy to the local host.
  http-mitm: true
  # Forward the agent's WireGuard interface to the local host.
  wg: true
  # Local port to bind the SOCKS proxy.
  socks-port: 1080
  # Local port to bind the HTTP proxy.
  http-port: 3128
  # Local port to bind the HTTP MITM proxy.
  http-mitm-port: 3129
  # Local port to bind the WireGuard proxy.
  wg-port: 51820
  # Connect directly to the agent's SSH service.
  ssh: true
  # Print the generated SSH command instead of executing it.
  print: false
  # Use direct STDIN/STDOUT mode for ProxyCommand compatibility.
  proxy: false
  # Record the SSH session to a log file.
  log: false
  # Additional SSH options (equivalent to '-o').
  ssh-opts: []
  # Path to an SSH configuration file to use.
  ssh-config-file: ""
  # Additional arguments passed directly to the underlying SSH command.
  ssh-args: []
  # Select and attach to a persistent shell session.
  session: false

# Expose the SOCKS proxy provided by the agent.
#  tealc socks [TEALC OPTIONS] AGENT
socks:
  # Target agent to connect to.
  agent: ""
  # Forward the agent's SOCKS proxy to the local host.
  socks: true
  # Forward the agent's HTTP proxy to the local host.
  http: true
  # Local port to bind the SOCKS proxy.
  socks-port: 1080
  # Local port to bind the HTTP proxy.
  http-port: 3128
  # Connect to the agent's SSH service.
  ssh: false
  # Print the generated SSH command instead of executing it.
  print: false
  # Use direct STDIN/STDOUT mode for ProxyCommand compatibility.
  proxy: false
  ssh-args: []

# Transfer files to/from the agent using SCP.
# - Agent to client:
#  tealc scp AGENT:/remote/path /local/path
# - Client to agent:
#  tealc scp /local/path AGENT:/remote/path
# On Windows agents, use forward slashes in remote paths:
#  tealc scp AGENT:C:/remote/path /local/path
scp:
  # Target agent to connect to.
  agent: ""
  # Print the generated SCP command instead of executing it.
  print: false
  # Record the SSH session to a log file.
  log: false
  # Additional SSH options (equivalent to '-o').
  ssh-opts: []
  # Path to an SSH configuration file to use.
  ssh-config-file: ""
  # Paths to copy using SCP.
  paths: []

# Transfer files to/from the agent using rsync.
# - Agent to client:
#  tealc rsync AGENT:/remote/path /local/path
# - Client to agent:
#  tealc rsync /local/path AGENT:/remote/path
# On Windows agents, use forward slashes in remote paths:
#  tealc rsync AGENT:C:/remote/path /local/path
rsync:
  # Target agent to connect to.
  agent: ""
  # Record the SSH session to a log file.
  log: false
  # Print the generated rsync command instead of executing it.
  print: false
  # Paths to synchronize using rsync.
  paths: []

# Update the remote agent content.
update:
  # Target agent to update.
  agent: ""
  # Update the clipboard content on an agent.
  set: ""

# Locally mount the target folder of the agent using rclone.
#  tealc rclone AGENT:/remote/path /local/path
rclone:
  target: ""
  # Record the SSH session to a log file.
  log: false
  # Print the generated rclone command instead of executing it.
  print: false
  # Agent and remote path to mount, format: AGENT:/remote/path.
  agent: ""
  # Local path.
  local-path: ""
  # Paths to synchronize using rclone.
  args: []

# SSH into a remote host using the agent as a jump server (similar to ssh -J).
# Place SSH options at the end of the command line:
#  tealc jump AGENT REMOTE_HOST [SSH OPTIONS]
jump:
  # Target agent to use as a jump host for SSH connections.
  agent: ""
  # Print the generated SSH jump command instead of executing it.
  print: false
  # Use SCP through the jump host.
  scp: false
  # Record the SSH session to a log file.
  log: false
  args: []

# Launch VS Code in remote mode via the agent.
# Warning: this downloads and executes the VS Code remote server in the agent's working directory and may trigger security tooling.
# Automatic cleanup may fail; remove the downloaded directory manually.
vscode:
  # Target agent to open in VS Code remote mode.
  agent: ""
  remote-path: .
  # Path to a Windows sshd compatibility shim to upload if hardlinking fails.
  shim: ""

# Access or modify the agent clipboard.
clip:
  # Retrieve the clipboard content from an agent.
  get:
    # Target agent from which to retrieve the clipboard content.
    agent: ""
  # Update the clipboard content on an agent.
  set:
    # Target agent on which to set the clipboard content.
    agent: ""
    # Clipboard text content to set on the target agent.
    content: ""

# Retrieve recorded logs from an agent.
logs:
  # Target agent from which to retrieve logs.
  agent: ""
  # Output format: json or text.
  format: text
  # Write logs to file instead of stdout.
  output: ""
  # Filter to log level: trace, debug, info, warn, error, or custom (run, kill, reset). Applied on agent side to reduce network footprint.
  level: ""
  # Maximum number of entries to return (0 = unlimited). Returns the most recent N entries. Applied on agent side to reduce network footprint.
  limit: 0
  # After printing the initial snapshot, keep the connection open and print new log entries in real time. Press Ctrl+C to stop.
  tail: false

# Launch the text-based interface for managing connected agents.
tui:
  # Redact all information in the TUI.
  audit-mode: false

# Retrieve stored passwords used by the agent.
pass:
  # Target agent from which to retrieve the password.
  agent: ""
  # Type of password to retrieve (e.g., 'otp' or 'agent').
  type: ""
  args: []

# Terminate a running agent.
kill:
  # Target agent to terminate.
  agent: ""
  # Also delete the agent's binary after termination.
  delete: false

# Reset an agent to its default state.
reset:
  # Target agent to reset.
  agent: ""

# Delete an agent permanently.
delete:
  # Target agent to delete.
  agent: ""

# List all available agents.
list: {}

# Generate shell completion scripts.
#  tealc completion zsh | sudo tee /usr/share/zsh/site-functions/_tealc
completion:
  # Shell type for completion (zsh, bash, fish).
  shell: ""

# Compile a new agent binary.
#  tealc compile -O windows -A amd64
compile:
  args: []

# Administrative commands (internal use).
admin:
  # Dump all the agent information.
  dump:
    # Print JSON representation.
    json: false
  # Update the server log level.
  log-level:
    # Log level.
    level: ""
  # Display the server configuration.
  config:
    # Print JSON representation.
    json: false
  # Display the full server state (agents, configuration, etc.).
  state:
    # Print JSON representation.
    json: false

# Generate or manage WireGuard configuration.
wireguard:
  # Generate WireGuard configuration file.
  generate: {}
  # Start WireGuard tunnel.
  start:
    # Target agent for which to start the WireGuard service.
    agent: ""
    # Port number to listen on for WireGuard connections.
    port: 51820
    # IP ranges to route through the WireGuard VPN (comma-separated).
    ranges: ""
    # Automatically set the ranges from the agent network configuration.
    auto-ranges: false
    # Use the loopback interface with the 240.0.0.0/8 address range.
    loopback: false
    # Execute WireGuard commands directly with elevated privileges.
    exec: true
    # WireGuard public key.
    wg-public-key: ""
    # WireGuard private key.
    wg-private-key: ""
    # WireGuard tunnel IP address.
    wg-ip: ""

# Internal: forward stdio to the SSH-over-WebSocket bridge (used as an ssh ProxyCommand).
ws-proxy: {}

# Wait for the agent to be online.
wait:
  # Target agent to wait for.
  agent: ""

# Start a server to serve agents.
embed-server:
  # Age private key used by the server.
  age-privkey: ""
  # Address and port to bind for HTTP connections (port 0 = random).
  http-listen-addr: :80
  # Address and port to bind for HTTPS connections (port 0 = random).
  https-listen-addr: :443
  # Address and port to bind for SSH connections (port 0 = random).
  ssh-listen-addr: :2222
  # Address and port to bind for DNS connections (port 0 = random).
  dns-listen-addr: :53
  # Address and port to bind for QUIC connections (port 0 = random).
  quic-listen-addr: :443

# Connect the agent through bind connection.
bind:
  # Age private key used by the embed server (tealc embed-server / tealc bind --age-privkey default).
  age-privkey: ""
  # Address and port to bind for HTTP connections (port 0 = random).
  http-listen-addr: :80
  # Address and port to bind for HTTPS connections (port 0 = random).
  https-listen-addr: :443
  # Address and port to bind for SSH connections (port 0 = random).
  ssh-listen-addr: :2222
  # Address and port to bind for DNS connections (port 0 = random).
  dns-listen-addr: :53
  # Address and port to bind for QUIC connections (port 0 = random).
  quic-listen-addr: :443
  # The address of the agent to bind to.
  bind-agent: ""
  # Kill the agent on disconnection.
  kill: false

# Forward TCP ports, Unix sockets, or Windows named pipes through the agent using OpenSSH -L/-R syntax.
#  tealc forward AGENT -L [bind_addr:]port:host:hostport
#  tealc forward AGENT -R [bind_addr:]port:host:hostport
# A socket or pipe path may be used in place of either address.
forward:
  # Target agent.
  agent: ""
  localfwd: []
  remotefwd: []
  # Maximum time to establish each forwarded connection; 0 disables the timeout.
  dial-timeout: 10s
searchconfigdir: ~/.config/tealc.yaml