Connect a service or agent.

# In a new directory; skip init if your project already has go.mod.
go mod init example.com/private-agent
go get github.com/layervai/qurl-go/qurl@v0.12.0

# Use the deployment file supplied for your environment.
export QURL_DEPLOYMENT=/path/to/deployment.json
mkdir -p .qurl
chmod 700 .qurl

package main

import (
	"bufio"
	"context"
	"fmt"
	"io"
	"log"
	"os"
	"os/signal"
	"strings"

	"github.com/layervai/qurl-go/qurl"
)

func main() {
	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
	defer stop()

	// Durable state. Keep this file across restarts: it is where the device
	// credential lands once enrollment completes.
	store, err := qurl.OpenFileAgentState("./.qurl/agent-state.json")
	if err != nil {
		log.Fatal(err)
	}
	defer store.Close()

	hostname, _ := os.Hostname()

	client, binding, err := qurl.ConnectAgentRuntime(ctx, store,
		qurl.WithAgentRuntimeEnrollmentCredential(os.Getenv("QURL_API_KEY")),
		qurl.WithAgentRuntimeMetadata(hostname, "example"),
		qurl.WithAgentRuntimeOTPProvider(readOneTimeCode),
	)
	if err != nil {
		log.Fatal(err)
	}
	defer binding.Destroy()

	_ = client // use it to create portals and share resources
	<-ctx.Done() // keep the runtime alive until interrupted
}

// Read the emailed code. For unattended services, replace the
// terminal prompt with your own mailbox or operator workflow.
// Reuse the reader so a retry retains buffered input. This CLI example exits
// if enrollment is cancelled; a pending terminal read ends with the process.
var otpInput = bufio.NewReader(os.Stdin)

func readOneTimeCode(ctx context.Context, challenge qurl.AgentOTPChallenge) (string, error) {
	type result struct {
		code string
		err  error
	}
	input := make(chan result, 1)
	fmt.Fprint(os.Stderr, "Email one-time code: ")
	go func() {
		line, err := otpInput.ReadString('\n')
		if err == io.EOF && len(line) > 0 {
			err = nil
		}
		input <- result{strings.TrimSpace(line), err}
	}()
	select {
	case <-ctx.Done():
		return "", ctx.Err()
	case reply := <-input:
		return reply.code, reply.err
	}
}

package main

import (
	"context"
	"log"
	"os"
	"os/signal"

	"github.com/layervai/qurl-go/qurl"
)

func main() {
	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
	defer stop()

	// Mount durable, owner-only storage at this path.
	store, err := qurl.OpenFileAgentState("/var/lib/layerv/qurl/agent-state.json")
	if err != nil {
		log.Fatal(err)
	}
	defer store.Close()

	hostname, _ := os.Hostname()
	client, binding, err := qurl.ConnectAgentRuntime(ctx, store,
		qurl.WithAgentRuntimeEnrollmentCredential(os.Getenv("QURL_ENROLLMENT_TOKEN")),
		qurl.WithAgentRuntimeMetadata(hostname, "example"),
		qurl.WithAgentRuntimeHeadlessEnrollment(),
	)
	if err != nil {
		log.Fatal(err)
	}
	defer binding.Destroy()

	_ = client // use it to create portals and share resources
	<-ctx.Done()
}

client, binding, err := qurl.ConnectAgentRuntime(ctx, store,
	qurl.WithAgentRuntimeEnrollmentCredential(credential),
	qurl.WithAgentRuntimeMetadata(hostname, "example"),
	qurl.WithAgentRuntimeOTPProvider(readOneTimeCode),
)
switch {
case errors.Is(err, qurl.ErrAgentOTPRequired):
	// The default path needs a way to read the emailed code. Install
	// WithAgentRuntimeOTPProvider, or say this runtime has no mailbox with
	// WithAgentRuntimeHeadlessEnrollment.
	return err
case errors.Is(err, qurl.ErrRegistrationKeyKindDisallowed):
	// The credential is a different kind than this enrollment path accepts.
	// The error message names the credential the platform actually saw and
	// the remedy for it.
	return err
case err != nil:
	return err
}

// On the success path, use the enrolled runtime.
_ = client
defer binding.Destroy()