How the edge talks to the server

Every managed host reaches LinkMesh over one of three channels. They differ in protocol and in how config arrives, but they share the same shape: the host dials outbound to the server, authenticates with a Bearer token over TLS, and exposes no inbound port and no client certificate.

Channel	Runtime	Direction	Protocol / endpoint	Config delivery	Auth
OpAMP	otelcol-contrib + opampsupervisor	Outbound → server	WebSocket over TLS, /v1/opamp	Server pushes RemoteConfig down the live connection	Bearer enrollment token in supervisor.yaml
remotecfg	Grafana Alloy	Outbound → server	Connect-RPC over TLS, /collector.v1.CollectorService	Alloy polls on an interval and fetches its rendered config + hash	bearer_token in config.alloy
agent	linkmesh-agent (optional)	Outbound → server	WebSocket over TLS, /v1/agent	None — carries discovery + host context, not collector config	Bearer LINKMESH_SERVER_TOKEN

The server never dials the edge. Whichever channel a host uses, the connection is initiated from the host, so no managed host needs an inbound firewall rule for LinkMesh.

OpAMP (otelcol-contrib + opampsupervisor)

The supervisor opens a persistent WebSocket outbound to /v1/opamp and holds it open. The server pushes RemoteConfig and own-metrics settings down that live connection; the supervisor applies the config to the collector it manages and reports health and effective-config back up the same socket. A heartbeat keeps the session alive so the server knows the collector is still there.

Authentication is a Bearer enrollment token in supervisor.yaml (Authorization: Bearer …). Server-to-collector certificate offers are not used on this channel — the supervisor works from the Bearer token alone.

See Onboard otelcol-contrib via OpAMP.

remotecfg (Grafana Alloy)

Alloy uses its native remotecfg component to poll the server on an interval over Connect-RPC at /collector.v1.CollectorService. Each poll fetches Alloy’s rendered configuration together with a hash; when the hash is unchanged the poll is effectively free, and when it changes Alloy fetches the new body and reloads. Its own-metrics push goes to /v1/metrics (OTLP/HTTP, Bearer).

Authentication is a bearer_token in config.alloy.

See Onboard Grafana Alloy via remotecfg.

agent (linkmesh-agent, optional)

The agent is an optional edge connector. It opens a WebSocket outbound to /v1/agent, authenticated with the Bearer LINKMESH_SERVER_TOKEN, and its identity is bound server-side on first connect. It carries discovery and host context only — it does not deliver collector configuration. A collector always self-fetches its own config over OpAMP or remotecfg, whether or not the agent is present.

See Install the agent and The agent.

One TLS front door

All three channels reach the same server port and ride the same external TLS termination as the web UI. They differ only in path and protocol, not in how they’re secured — see Security & encryption.

See also

• Native remote config — how config reaches the collector without proprietary middleware in the path.
• Security & encryption — the one-TLS-front-door trust model.
• Credentials & tokens — the Bearer credentials each channel presents.
• Firewall & connectivity — every port, protocol, and direction.