# Hosts and agents

> A host is a server (or container) running the Rowsafe agent. How hosts enroll, report in, update and go offline.

Source: https://rowsafe.sh/docs/concepts/hosts-and-agents

A **host** is a server running the Rowsafe agent. With Docker, it is the agent container next to your database container. One host can protect several databases (PostgreSQL clusters).

```sh
rowsafe hosts list
```

```text
HOST  ID                  AGENT  PLATFORM     CHANNEL  PIN  LAST UPDATE  LAST SEEN
db-1  host_9h8g7f6e5d4c3  0.4.2  linux/amd64  stable   -    confirmed    12s ago
```

## Enrollment

A new host joins your organization with a one-time **enrollment token** (`rse_...`):

```sh
rowsafe hosts enroll-token            # valid for 1 hour
rowsafe hosts enroll-token --ttl 24h  # 1 minute to 7 days
```

The token works **once**. On its first start, the agent trades it for its own identity, saved in `/var/lib/rowsafe/agent.json`. After that you can delete the token from the agent's configuration.

The dashboard does the same under **Hosts**, then **Add host**.

## What the agent does

- Runs as the `postgres` system user, never as root.
- Connects to PostgreSQL over the local Unix socket only.
- Makes only outbound HTTPS requests. Nothing listens for Rowsafe on your server.
- Runs only a fixed set of tasks: inspect, adopt, check, backup, drill and restore point.
- Uses at most half the default CPU and IO weight, and the kernel's out-of-memory killer picks it before PostgreSQL.

See [Security](https://rowsafe.sh/docs/security#what-runs-on-your-server) for the full list.

## Online and offline

The agent sends a heartbeat every 30 seconds. If Rowsafe hears nothing for **5 minutes**, it raises the critical `agent_offline` alert.

While the agent is offline:

- **PostgreSQL keeps archiving its changes** to your bucket. Point-in-time recovery keeps working.
- Scheduled backups and drills don't run, and metrics stop.
- After 10 minutes, the database stops counting as [protected](https://rowsafe.sh/docs/concepts/protection-status), because its archiving status is unknown.

See [Agent offline](https://rowsafe.sh/docs/troubleshooting#agent-offline) to find out why.

## Updates

On servers, the agent **updates itself** with signed releases, tests the new version first and rolls back if it fails. In Docker, you update by changing the image tag. See [Updating and uninstalling the agent](https://rowsafe.sh/docs/guides/agent-updates).

## Removing a host

```sh
rowsafe hosts remove db-1
```

This revokes the agent's access. Remove the host's databases first (`rowsafe db remove`). It doesn't change anything on the server: [uninstall the agent](https://rowsafe.sh/docs/guides/agent-updates#uninstall) there.