@echo off
REM KEYLESS reconnect: reuses saved tsnet state -> same tenant/IP across restarts.
cd /d "%~dp0"
set ARGUS_BETA_SESSIOND=127.0.0.1:8099
set ARGUS_CONTROL_FALLBACK=https://192-3-153-161.sslip.io
set "ARGUS_BETA_TOKEN_FILE=%~dp0.token"
REM pentest #11: DC_TRUST_XFF intentionally NOT set on this EDGE listener — a tsnet peer can spoof
REM X-Forwarded-For to evade the per-IP rate limiter, so this process keys on the real RemoteAddr. Only the
REM loopback sessiond trusts XFF (it sets DC_TRUST_XFF on itself programmatically when auto-spawned).
set "DCLOG=%LOCALAPPDATA%\Ormur"
if not exist "%DCLOG%" mkdir "%DCLOG%" 2>nul
REM machine-wide state (buyer): survives the admin-install vs user-run profile split so pairing
REM and tsnet-serve share ONE node identity. dev.cmd (if present) overrides these for a dev box.
set "DCSTATE=%ProgramData%\Ormur\state"
set "ARGUS_BETA_PAIRING_DIR=%DCSTATE%"
set "ARGUS_BETA_TSNET_DIR=%DCSTATE%\tsnet"
set "ARGUS_BETA_AGENT_KEY=%DCSTATE%\agent_ed25519"
if not exist "%DCSTATE%\tsnet" mkdir "%DCSTATE%\tsnet" 2>nul
if exist "%~dp0dev.cmd" call "%~dp0dev.cmd"
"%~dp0agent.exe" tsnet-serve >> "%DCLOG%\tsnet.log" 2>&1
