CronFu Agent

The cronfu-agent is a daemon that runs on your server, automatically discovers cron jobs, and optionally enables remote management — all secured by HMAC-signed commands.

Installation

curl -fsSL https://app.cronfu.dev/agent/install | bash

The installer:

1. Downloads the latest binary for your platform (Linux/macOS, amd64/arm64)
2. Verifies the SHA-256 checksum
3. Installs to /usr/local/bin/cronfu-agent
4. Creates a cronfu-agent system user (Linux)
5. Installs and enables a systemd service (Linux with systemd)

Provisioning

Before running the setup wizard, create an agent in the CronFu dashboard:

1. Go to Settings → Agents and click Create Agent
2. The response includes three credentials:
   • Agent key (cfu_agent_...) — authenticates this agent to the gateway
   • Telemetry key (cfu_tel_...) — used for forwarding ping results
   • HMAC secret — the account-level secret for verifying signed commands

Save these credentials — the HMAC secret is only shown once.

Interactive Setup

Run the setup wizard to configure the agent:

cronfu-agent --setup

The default flow uses OAuth 2.1 + PKCE — it prints a URL you open in any browser (works on headless servers):

1. Agent prints an authorization URL
2. Open the URL in any browser and sign in
3. A callback page displays a one-time authorization code
4. Paste the code back into the terminal
5. The agent creates itself via the API and writes config automatically

For environments without browser access, use manual mode:

cronfu-agent --setup --manual

Manual mode prompts for each credential individually:

Configuration is saved to ~/.cronfu/agent.yml with restricted permissions (0600).

systemd Integration

On Linux with systemd, the installer creates /etc/systemd/system/cronfu-agent.service:

[Unit]
Description=CronFu Agent
After=network.target

[Service]
Type=simple
User=cronfu-agent
ExecStart=/usr/local/bin/cronfu-agent
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

Manage the service:

sudo systemctl status cronfu-agent    # Check status
sudo systemctl restart cronfu-agent   # Restart after config changes
sudo journalctl -u cronfu-agent -f    # View logs

Automatic Discovery

The agent periodically scans for cron jobs (default: every 5 minutes) from:

• Current user's crontab
• /etc/crontab
• /etc/cron.d/*
• systemd timers (Linux)

Discovered jobs appear in the dashboard under Settings → Agents → [agent name] as "Discovered" state monitors. From there you can promote them to active monitors with one click.

Remote Control

When enabled, the agent can execute commands sent from the dashboard. Remote control is disabled by default — opt in explicitly during setup or by setting enable_remote_control: true in the config file.

Security Model

All remote commands are secured with HMAC-SHA256 signed payloads:

• Signature format: HMAC-SHA256(id:command_type:nonce:issued_at:expires_at:sha256(payload))
• Nonce replay protection: Each command includes a unique nonce; the agent rejects reused nonces
• 5-minute expiry: Commands expire 5 minutes after issuance; expired commands are rejected
• Metacharacter rejection: Shell metacharacters in command payloads are rejected

Command Allowlist

Restrict which commands can be executed remotely by setting a command_allowlist in the config:

enable_remote_control: true
command_allowlist:
  - /usr/local/bin/backup.sh
  - /opt/scripts/cleanup.py

When a command allowlist is set, only listed commands can be executed. If the allowlist is empty and remote control is enabled, all commands are allowed (use with caution).

Configuration Reference

All settings in ~/.cronfu/agent.yml (environment variables override YAML values):

Duration values accept Go format: 30s, 5m, 1h, or plain seconds.

The config file must have restricted permissions — the agent rejects files readable by group or others.