Hi Folks, Is it possible to separate the agent connections from the API/UI connections? I’d like to allow an agent to connect from many places but only give access to the API/UI from a few.

You could have more than one fleet servers and configure the nodes to talk to one, and the API using things the other.

There was a topic on the FAQ page that mentioned this, but for some reason it was removed. Today in my deployment I do this by exposing only these paths to the internet:

/api/v1/osquery/*
/api/osquery/*
/api/fleet/orbit/*

Everything else is only accessible internally

Thanks @Saulo Guilhermino, thats what I was hoping for!

@Saulo Guilhermino seems like the old FAQ has been moved... https://fleetdm.com/guides/what-api-endpoints-to-expose-to-the-public-internet

@Ali ☝️