Insecure Development Mode

Local Dev OnlyNo TLSRapid Prototyping

Insecure mode allows running the PiVirt Agent and pvcli without TLS certificates, streamlining local feature development and testing.

Security Warning

Insecure mode disables all TLS authentication and encryption. NEVER use insecure mode in production or on untrusted networks.

---

1. Agent Configuration

To start the agent in insecure mode, copy the provided agent.conf.dev template or configure insecure = true:

Using Dev Template

# Copy dev config template
cp agent.conf.dev agent.conf

# Run the agent binary
./bin/agent -config agent.conf

Manual Configuration (agent.conf)

# Set insecure mode
insecure = true

# Network listeners
listen_address = "localhost:5001"
director_address = "localhost:5000"

# Hypervisor connection
hypervisor_type = "pivirtd"
pivirtd_socket = "/var/lib/pivirt/daemon/pivirtd.sock"

# Storage paths
image_dir = "/var/lib/pivirt/images"
instance_dir = "/var/lib/pivirt/vms"

When insecure = true:

• TLS certificates and cert_path are not required.
• Client authentication is bypassed.
• gRPC / ConnectRPC transport runs over plain HTTP/2 or HTTP/1.1.

---

2. CLI Setup (pvcli)

Configure pvcli to communicate with the insecure development agent:

1. Add a Development Context:

   pvcli context add dev localhost 5001

2. Enable Insecure Mode for Context:

   pvcli context set dev --insecure=true

3. Switch to Dev Context:

   pvcli context switch dev

4. Verify Connectivity:

   pvcli vm list

---

3. Switching Back to Secure Mode

Before deploying or pushing changes:

1. In agent.conf, set insecure = false.
2. Ensure valid TLS / PiTrust PKI certificates reside in the configured cert_path.
3. In pvcli, switch back to a secured context or toggle --insecure=false:

   pvcli context set dev --insecure=false