From e7b474f73f4a4aa86a9905532f447f01651eee8b Mon Sep 17 00:00:00 2001 From: Javier Marcos <1271349+javuto@users.noreply.github.com> Date: Sun, 7 Jun 2026 15:25:22 +0200 Subject: [PATCH] Update README with latest changes --- README.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index bd7199e..fb15a93 100644 --- a/README.md +++ b/README.md @@ -53,6 +53,7 @@ Full documentation for the osctrl project is available at [https://osctrl.net](h For this repository, the most useful starting points are: - [service/osctrld-sample.yaml](service/osctrld-sample.yaml) for a YAML configuration example. +- [service/osctrld.yaml](service/osctrld.yaml) and [service/osctrld.json](service/osctrld.json) for additional config examples. - [service/linux/systemd.service](service/linux/systemd.service) for Linux service deployment. - [service/darwin/net.osctrl.daemon.plist](service/darwin/net.osctrl.daemon.plist) for macOS launchd deployment. - [SECURITY.md](SECURITY.md) for vulnerability reporting and operator security guidance. @@ -65,7 +66,7 @@ For this repository, the most useful starting points are: ├── service/ │ ├── darwin/ # macOS launchd service definition │ ├── linux/ # Linux systemd service definition -│ └── osctrld-sample.yaml # YAML configuration example +│ └── osctrld-sample.yaml # Sample YAML configuration ├── tests/ # Test configuration fixtures ├── .github/workflows/ # CI and release automation ├── .goreleaser.yml # Multi-platform release configuration @@ -81,10 +82,12 @@ osctrld is a Go CLI built around a small set of commands: - `flags` and `cert` fetch managed osquery files and write them locally. - `verify` checks whether local osquery configuration matches osctrl. - `service` runs the daemon loop and repeatedly syncs managed state. +- `check-config` validates a configuration file and exits. +- `default-config` prints a generated YAML configuration template. The daemon mode performs a sync cycle on a configurable interval. During each cycle, osctrld retrieves flags, certificates, and extension manifests from osctrl, writes changed content to disk, and restarts osquery through the operating system service manager when a managed artifact changes. -Configuration is loaded from the `osctrld` section of a YAML or JSON file and can be overridden by CLI flags or environment variables. YAML is the default format for new deployments. +Configuration is loaded from the `osctrld` section of a YAML or JSON file and can be overridden by CLI flags or environment variables. YAML is the default format for new deployments. Runtime defaults are applied before commands run, and wrapped commands validate the effective configuration before doing work. ## 📦 Installation @@ -128,6 +131,8 @@ osctrld: JSON configuration files are also supported. Use a `.json` extension and osctrld will detect the format automatically. +`check-config`, `service`, `enroll`, `remove`, `flags`, `cert`, and `verify` all validate the effective configuration before running. + | Field | Description | Default | | --- | --- | --- | | `osctrlSecret` | osctrl enrollment secret value used to authenticate requests | Required for enrollment workflows | @@ -160,6 +165,7 @@ COMMANDS: cert Retrieve server certificate for osquery from osctrl and write it locally service Run as a daemon, periodically syncing flags and certificate check-config Validate configuration and exit + default-config Print a default YAML configuration ``` Validate configuration before launching: @@ -168,6 +174,12 @@ Validate configuration before launching: osctrld check-config --config /etc/osctrld/config.yaml ``` +Generate a fresh config template: + +```shell +osctrld default-config +``` + Retrieve flags and certificates: ```shell