Revoke, replace and rotate

Cut an agent off, move it to a new machine, or change the database password.

Revoke an agent

Open the dataset settings, find the agent and select Revoke, then Revoke agent.

Concatflow cuts its connection at once. The agent can never reconnect with those credentials, even after a restart. Nothing has to happen on your machine for this to work.

The container itself keeps running and logs connection errors:

ERROR nats.aio.client nats: encountered error
nats.errors.Error: nats: 'Authorization Violation'

Stop and remove it:

docker rm -f cubit-agent
docker volume rm cubit-agent

If you revoke your only agent, the dataset stops answering until you install a new one with a new token.

Replace a machine

1. Install a new agent on the new machine with a new token. See Run two agents.
2. Wait until it shows as Online.
3. Revoke the old agent, then remove its container and volume.

Doing it in this order keeps the dataset online the whole time.

Change the database password

The password only lives in DATABASE_URL, on your machine. Concatflow is not involved.

1. Change the password in the database.
2. Recreate the container with the new DATABASE_URL and the same volume. Leave out CUBIT_ENROLL_TOKEN: the agent is already enrolled.

docker rm -f cubit-agent
docker run -d --name cubit-agent --restart unless-stopped \
  --hostname db-agent-1 \
  -e DATABASE_URL="postgresql://concatflow_reader:<new-password>@<host>:5432/app" \
  -v cubit-agent:/data \
  ghcr.io/usecubit/source-client:0.1.0

Cancel a token

A token you generated but never used stays valid for 7 days. To kill it sooner, select Cancel the token in the dashboard. Generating a new token also cancels the previous one.

A token you did not use

If your agent fails with token_used and you never ran an agent with that token, someone else did. The dashboard shows the machine that used it. Revoke that agent, generate a new token and start your agent with it.