Agent Configuration File (agent.yaml)

docker run ... netboxlabs/orb-agent:latest run -c /opt/orb/agent.yaml

version: 1.0          # Optional
orb:
  labels: ...         # Agent identity labels
  config_manager: ... # How policies are loaded (required)
  backends: ...       # Which backends are enabled (required)
  policies: ...       # Inline policies (only with config_manager.active: local)
  secrets_manager: .. # Optional: Vault secret resolution

orb:
  labels:
    region: EU
    pop: ams02
    environment: production

orb:
  config_manager:
    active: local   # or: git
    sources:
      local: ...
      git: ...

orb:
  config_manager:
    active: local

orb:
  config_manager:
    active: git
    sources:
      git:
        url: "https://github.com/myorg/policyrepo"
        branch: main
        schedule: "*/5 * * * *"
        auth: basic
        username: myuser
        password: ${GIT_TOKEN}

orb:
  backends:
    common:
      diode:
        target: grpc://192.168.0.100:8080/diode
        client_id: ${DIODE_CLIENT_ID}
        client_secret: ${DIODE_CLIENT_SECRET}
        agent_name: agent01
    device_discovery:   # enabled, using defaults
    snmp_discovery:     # enabled, using defaults

orb:
  policies:
    device_discovery:
      my_policy:
        config:
          schedule: "0 * * * *"
          defaults:
            site: New York NY
        scope:
          - hostname: 192.168.0.5
            username: admin
            password: ${PASS}
            driver: ios
    network_discovery:
      scan_policy:
        config:
          schedule: "0 */2 * * *"
        scope:
          targets: [192.168.1.0/24]

password: ${vault://kv/myapp/db/password}

password: ${vault://kv//myapp/db/password}

password: ${vault://foo/bar//myapp/db/password}

orb:
  secrets_manager:
    active: vault
    sources:
      vault:
        address: "https://vault.example.com:8200"
        auth: token
        auth_args:
          token: ${VAULT_TOKEN}
        schedule: "*/5 * * * *"

# Short form — uses sources.doppler.project and sources.doppler.config defaults
password: ${doppler://API_KEY}

# Fully qualified — useful with Service Account / Personal tokens spanning configs
password: ${doppler://orb/prd/API_KEY}

orb:
  secrets_manager:
    active: doppler
    sources:
      doppler:
        token: ${DOPPLER_TOKEN}
        project: orb
        config: prd
        schedule: "*/5 * * * *"

# Short form — returns the Content (password) field
password: ${cyberark://<Safe>/<Object>}

# Short form with field selector
username: ${cyberark://<Safe>/<Object>/UserName}

# Fully qualified, overriding the configured AppID
password: ${cyberark://<AppID>//<Safe>/<Object>}

orb:
  secrets_manager:
    active: cyberark
    sources:
      cyberark:
        url: https://ccp.corp.example.com
        app_id: orb-agent
        client_cert: /opt/orb/secrets/orb.crt
        client_key:  /opt/orb/secrets/orb.key
        schedule: "*/5 * * * *"

password: ${dsv://servers/prod-db/password}

orb:
  secrets_manager:
    active: dsv
    sources:
      dsv:
        tenant: acme
        client_id: ${DSV_CLIENT_ID}
        client_secret: ${DSV_CLIENT_SECRET}
        schedule: "*/5 * * * *"

# Git config (resolved by Go agent)
password: ${GIT_TOKEN}

# device_discovery policy scope (resolved by Python backend)
scope:
  - hostname: 192.168.0.5
    username: admin
    password: ${DEVICE_PASS}