Releases

Fixes

• The default platform URL is https://api.scrany.net (was https://tis.cap-net.cz). The platform moved to its own hosts in v1.44.0 and serves /api/v1 on the API host too (v1.44.2), so the agent works unchanged. Existing configurations with tis.cap-net.cz keep working while it stays an alias; set platform.url (or TIS_URL) to https://api.scrany.net when convenient.
• Documentation links point to https://developers.scrany.net/agent/.

Documentation: https://developers.scrany.net/agent/configuration/

Packages

Each with its .sha256 in the package registry.

Features

• fail2ban (#6 (closed), !18 (merged)): "fail2ban": { "source": "fw-01-fail2ban", "hits": true } reads fail2ban's log – no change to fail2ban – and every minute sends the new bans ([<jail>] Ban <ip>; Restore Ban, Unban and Found don't count): as indicators imported per jail into the import-only source, tagged fail2ban,jail:<jail>, and as hits for the IPs the TIS lists already have (listedOnly, platform v1.43.0+). Hits go before the import, which waits for them; what couldn't be sent is kept for 24 h. tis-agent hits -dry-run lists the new bans, Report hits now sends them.
• Log lines with Python logging's time (2026-10-24 10:15:01,234) get their own time.

Other

• The e2e test runs against the platform image tis/tis-platform:v1.43.0 and checks fail2ban (tags, hits only for listed IPs, restored bans skipped).

Documentation: https://docs.tis.cnt.cz/agent/configuration/#fail2ban

Packages

Each with its .sha256 in the package registry.

Features

• Hits from NFLOG (#3 (closed), !17 (merged)), Linux: "hits": { "nflog": { "group": 100, "targets": ["tis_v4", "tis_v6"] } } counts the packets nftables rules log to a netlink group (ip saddr @tis_v4 log group 100 drop), each for the element of the listed nftables-set targets its source – or else destination – address falls in, in the hour the kernel logged it. Next to the element counters: nothing is lost when a set is reloaded and the sets need no counter. The agent binds the group itself (128-byte copies); a full receive buffer is warned about once a minute. The elements are re-read every reload_interval (5m); counts are reported every interval like the divert's.

Other

• The documented system-test command (real nft and kernel in a container) runs the packages one at a time (-p 1) – they share the network namespace.

Documentation: https://docs.tis.cnt.cz/agent/configuration/#nflog

Packages

Each with its .sha256 in the package registry.

Features

• Central configuration (#5 (closed), !16 (merged)): with "managed": true the pull jobs come from the platform – the template of the customer's token and the device's own jobs, edited on the Devices page – and replace the local pull jobs; targets, push jobs and hit counting stay local. A central job sets only a name, a schedule and what to pull into which of the device's targets – never a command, a file or a URL (any other field is refused). Central jobs go through the same checks as the file; valid ones are saved to central.saved in the state directory and the jobs restart with them, invalid ones are refused as a whole (the running jobs stay, the reason shows on the platform). Before the first central configuration, or with none, the local pull jobs run. Needs platform v1.42.0+.
• healthchecks: healthcheck URLs of central jobs, by job name (the platform never sets URLs).
• Commands: the platform can ask to pull now (a job or all) and report hits now (logs and nftables sets); the outcome goes back with the next check-in.
• tis-agent status marks central jobs with *, check says which central configuration runs, run takes central jobs.

Other

• The e2e test runs against the platform image tis/tis-platform:v1.42.0 and checks a managed daemon (template applied, pull command acknowledged).

Documentation: https://docs.tis.cnt.cz/agent/configuration/#managed

Packages

Each with its .sha256 in the package registry.

Features

• Check-in with the platform (#4 (closed), !15 (merged)): the daemon reports its state to POST /api/v1/agent/checkin right after it starts, then as often as the platform asks (60 s by default) and shortly after a scheduled job ran – version, host (hostname, OS, release, arch, uptime), a SHA-256 of the configuration, the targets (names and types only) and per job its list or source, schedule, last and next run, result, error, failed runs in a row and entries. The device shows up on the platform's Devices page, which marks it offline after 5 minutes without a check-in and a job failing after 3 failed runs in a row. Needs platform v1.41.0+ and the agent/* right (in the guest and user defaults); an older platform answers 404, retried hourly. "checkin": { "enabled": false } turns it off.
• The job state counts failed runs in a row.
• Durations print as written: 15m, not 15m0s (also in tis-agent status).

Other

• The e2e test runs against the platform image tis/tis-platform:v1.41.0 and checks the check-in.

Documentation: https://docs.tis.cnt.cz/agent/configuration/#checkin

Packages

Each with its .sha256 in the package registry.

Features

• Hits from nftables set counters (!14 (merged)): "hits": { "nftables": ["tis_v4", "tis_v6"] } reads the per-element counters of the listed nftables-set targets every interval and reports what they grew by, for the listed address or network – no logging needed. Sets the agent creates get counter; a set declared in nftables.conf needs counter;. The counters read are kept until a report is accepted, like log positions.
• nftables-set updates keep counters (!14 (merged)): a filled set gets only the changes (deleted and added elements) in one transaction; a failed update falls back to flush and fill.
• Deployment counts in the log (!11 (merged)): deployed 20125 entries to nftables set inet filter tis_v4 (+14 -14), also in dry runs.

Other

• The e2e test runs against the platform image tis/tis-platform:v1.40.1 (!12 (merged), !13 (merged)).

Documentation: https://docs.tis.cnt.cz/agent/configuration/#nftables-sets

Packages

Each with its .sha256 in the package registry.

Features

• Backoff after failed runs (!10 (merged)): a scheduled job waits longer after failures in a row – the first failure keeps the interval, then 2×, 4×, … every up to an hour (or every when it is longer); a success brings the interval back. The log says when the next run comes. A run that finds the job busy (a tis-agent run of it) doesn't count. The passes over the hit logs back off the same way.
• Retry-After (!10 (merged)): a 429 (the platform's export limit per token) or 503 with Retry-After is retried after the time asked for, up to a minute; a longer one ends the attempts and the backoff takes over.

This completes phase 1 of the agent (#2 (closed)).

Packages

Each with its .sha256 in the package registry.

Features

• nftables-set target (!9 (merged)): an nftables set (Linux) replaced in one nft -f transaction – rules using it see the old or the new list. A missing set is created with its table; a set declared in nftables.conf keeps its definition; a set emptied by a reload of the ruleset is noticed and loaded again. Networks inside others are left out, as interval sets refuse overlaps. One family per set: the job's type is ipv4 or ipv6.

  "targets": { "tis_v4": { "type": "nftables-set", "table": "filter", "set": "tis_v4" } }

• The Linux sample configuration (/usr/share/doc/tis-agent/examples/config.json) uses an nftables set; the deb suggests nftables.

Documentation: https://docs.tis.cnt.cz/agent/configuration/#firewall-tables

Packages

Each with its .sha256 in the package registry.

The first release with jobs – the agent replaces tis-pull.sh, tis-push.sh, tis-hits.sh and tis-cron.sh of tis-scripts. Documentation: https://docs.tis.cnt.cz/agent/ (with a migration guide from tis-cron.d).

Features

• Pull jobs (!3 (merged)): exports deployed to files, BIND (zone/rpz), Unbound and dnsmasq configuration, ipfw and pf tables and ipsets – checked, replaced atomically, reloaded and rolled back; ETags skip unchanged lists; run, check, status commands with the exit codes of tis-pull.sh.
• Push jobs (!4 (merged)): a file, a URL or a command's output sent to an import-only source when it changed and at least once a day (refresh), so the indicators don't expire.
• Hits from logs (!5 (merged)): the BIND RPZ log and the ipfw log counted incrementally, per hour of the line's timestamp, positions kept until the report is accepted; tis-agent hits [-dry-run]. The ipfw divert socket as before.
• Healthchecks (!6 (merged)): Healthchecks.io-style pings around each run with the run's output.
• Packages (!7 (merged)): FreeBSD .pkg with rc.d, Debian/Ubuntu .deb (amd64, arm64) with a systemd unit.
• End-to-end test in CI against the platform image (!8 (merged)).

Breaking changes

The configuration has a new structure (platform, targets, jobs, hits); the flat keys, flags and tis_agent_* rc.conf variables of the earlier hit reporter are gone. See the configuration reference.

Packages

Each with its .sha256 in the package registry.