Controllers and agents
Status, heartbeat, version, and actions stay inside the project.
Service access for engineers
Access to the property for your team.
Service access to property systems, with clear boundaries for the team.
- Project-controlled access
- Context beside the task
- Secure property work
- Actions stay auditable
What the agent solves
Access a service, not the whole network
The agent stays on an always-on site machine and keeps an outbound connection. The LAN is never exposed.
Access boundary
Only the saved host:port.
The user gets no subnet route and cannot replace the target.
Deny by default
After registration, the LAN is closed. Port policy, ACL, and role come first.
Services and devices
Working list of allowed IP:port targets. No ACL bypass.
Tunnels and public endpoints
Stable name.access.xyz.su survives external IP changes.
Rules, map, and log
Who connected, what is open, and why access was denied.
Three roles, one runtime
Choose the agent by where it works
One shd-agent binary. The mode depends on where it runs.
01
Controller-agent
On-site. Outbound TLS, heartbeat, saved TCP targets only.
02
User-agent
On the engineer's computer. One QUIC session, parallel HTTP, SSH, and TCP.
03
Server-agent
On a server. Gateway, Exit-node, and speed test by route policy.
Request path
From authorization to the first byte
The server authorizes. Data uses P2P; if the direct path is unavailable, relay takes over.
01
User or application
Overlay, public endpoint, or tunnel.
02
SHD checks access
User, project, service, role, and agent revision.
03
P2P or relay
Direct QUIC first. If unavailable, binary relay.
04
Controller-agent
Local TCP only to the exact host:port.
05
Exact service
HTTP, SSH, and Loxone keep their normal authentication.
P2P QUIC
Traffic moves directly between agents. Relay cannot see the data.
Relay fallback
If NAT or a firewall blocks P2P, frames go through relay.
One QUIC session per agent · one stream per TCP connection.
Security
Not a VPN and not an open LAN
Project access does not open the network. You need a role, port, and ACL.
Access model
Four boundaries for every request
The project sets context, policy defines the service, ACL selects who passes. Revocation closes the path immediately.
Module role
Reading agents does not grant permission to change settings.
Access-port policy
192.168.1.3:443 does not open :80 or neighboring devices.
ACL rule
User or group, exact service, allow/deny.
Revocation and audit
Sessions close immediately. Everything is logged.
Operating boundary
Tools for connection and operations
From agent installation to terminal, routes, and incident analysis.
01
HTTP, HTTPS, and WebSocket
Web UIs and APIs of saved services.
02
Terminal and SFTP
Browser SSH needs no local agent. SFTP is a separate role.
03
Public endpoints
name.access.xyz.su. Application login and ACL still apply.
04
Overlay and routes
Native L3 100.126.0.0/16. Ordinary internet routing stays intact.
05
Exit Network
Release traffic from the server-agent IP by route policy.
06
Heartbeat and jobs
Push-first: sync, update, reboot. HTTP is the fallback.
Putting into operation
From installation to a live connection
Runtime first, then the exact service, access, and transport check.
- 01
Install and enroll
Always-on machine, shd-agent, enrollment token.
- 02
Wait for online state
Outbound TLS, heartbeat, service list.
- 03
Save the required ports
Required targets only: 443, 875, 8123, 22.
- 04
Assign roles and rules
Roles and ACL. LAN is closed by default.
- 05
Open and observe
Overlay or endpoint, first response, audit log.
Before connection
Questions that matter on site
Short answers about runtime roles, data paths, access boundaries, terminal, and diagnostics.
What is shd-agent?
It is one Go runtime with several roles. Controller-agent runs in the property network, user-agent on the engineer workstation, and server-agent on a server with dedicated modules.
Do we need a VPN or an inbound port?
No. Controller-agent creates an outbound secure connection. Users reach only saved services, not the entire local network.
What happens when P2P is unavailable?
After the direct QUIC attempt fails, user-agent activates relay fallback. The first request is preserved and data moves in binary frames through relay and controller-agent.
Can access cover the whole subnet?
No, that is not the module model. Access is an exact service/host/port; broadcast, multicast, metadata, backend, and relay addresses are blocked, and hostnames are checked against every resolved IP.
Which services can be opened?
Any explicitly saved TCP service the agent can reach locally: HTTP/HTTPS, WebSocket, SSH, Loxone, Home Assistant, and other exact ports.
Does terminal work from a browser?
Yes. Browser SSH terminal needs no local user-agent on a phone or computer. It requires terminal role, saved SSH username and credential; SFTP additionally requires sftp role.
What is Exit Network?
It is a server-agent path: Routing gateway accepts a route group, relay connects it to an Exit-node, and the Exit-node releases allowed traffic to the destination from its own IP.
How quickly can access be revoked?
Remove or change the rule, port, endpoint, or role. Backend closes active sessions, updates the agent allowlist, and records the action; there is no old session to wait out.
How do we locate a failure?
Check controller-agent online, user-agent, route policy, target reachability from the agent, shd99, and 100.126.0.0/16. For transport inspect p2p_first_byte, last_path, p2p_sent, and relay_sent.
Can an already running property be connected?
Yes. Review the network, controllers, target ports, service method, and required roles first. Then add the smallest service set without automatic access to the remaining LAN.
Connect the property
Design the access boundary
Tell us which controllers, devices, and operations need remote service. We will map the property network, runtime roles, exact ports, transport choice, and launch plan.
Before the first call, prepare a network sketch, controller list, service host:ports, terminal/SFTP requirements, and the organization access model.