You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
7.[Verify everything is working](#7-verify-everything-is-working)
@@ -51,32 +51,15 @@ done
51
51
echo"Timeplus is ready"
52
52
```
53
53
54
-
> **Docker Compose shortcut:** to run Timeplus and AgentGuard together in one step, skip to [section 4C](#option-c--docker-compose-recommended-for-new-installs).
54
+
> **Docker Compose shortcut:** to run Timeplus and AgentGuard together in one step, skip to [Option C](#option-c--docker-compose-recommended-for-new-installs).
55
55
56
56
---
57
57
58
-
## 3. Create a Timeplus user for AgentGuard
59
-
60
-
AgentGuard connects to Timeplus using dedicated credentials. Skip this section if you are using the default `default` user with no password (acceptable for local dev).
61
-
62
-
### Via Timeplus web console
63
-
64
-
1. Open [http://localhost:8000](http://localhost:8000) in your browser.
65
-
2. Log in with the default admin credentials (set during first-run setup).
66
-
3. Navigate to **Settings → Users → Add User**.
67
-
4. Create a user — for example:
68
-
-**Username:**`User`
69
-
-**Password:**`Password`
70
-
-**Role:** Admin (AgentGuard needs DDL permissions to create streams and views on startup)
71
-
5. Click **Save**.
72
-
73
-
---
74
-
75
-
## 4. Install and run AgentGuard
58
+
## 3. Install and run AgentGuard
76
59
77
60
### Option A — Shell script installer (recommended)
78
61
79
-
The installer downloads the correct binary for your platform from S3, installs it to `/usr/local/bin`, and guides you through Timeplus Enterprise connection configuration interactively.
62
+
The installer downloads the correct binary for your platform, installs it to `/usr/local/bin`, and writes a minimal `~/.agentguard/config.yaml` with the Timeplus host/port.
1. Download the correct binary and install it to `/usr/local/bin/agentguard`
93
-
2. Prompt for your Timeplus Enterprise connection settings and write `~/.agentguard/config.yaml`
94
-
3. Optionally set up AgentGuard as a background service (launchd on macOS, systemd on Linux)
74
+
After installation, start AgentGuard:
95
75
96
-
After installation, start AgentGuard manually with:
97
76
```bash
98
77
agentguard
99
78
```
100
79
101
-
Or use the service that was configured during installation.
80
+
Open [http://localhost:8080](http://localhost:8080) — the **setup wizard** appears on first launch (see [Section 4](#4-first-time-setup-wizard)).
102
81
103
-
Open [http://localhost:8080](http://localhost:8080).
82
+
### Option B — Docker image (standalone)
104
83
105
-
AgentGuard creates all required Timeplus streams and materialized views on first startup. This is non-fatal — the server starts even if Timeplus is temporarily unavailable.
84
+
```bash
85
+
docker run -d \
86
+
--name agentguard \
87
+
-p 8080:8080 \
88
+
-e TIMEPLUS_HOST=<timeplus-host> \
89
+
-e AGENTGUARD_URL=http://<agentguard-host>:8080 \
90
+
-v agentguard-data:/app/data \
91
+
--restart unless-stopped \
92
+
ghcr.io/timeplus-io/agentguard:latest
93
+
```
94
+
95
+
Replace `<timeplus-host>` with the hostname or IP where Timeplus is running (use `host.docker.internal` on macOS/Windows when Timeplus runs on the host machine).
96
+
97
+
Replace `<agentguard-host>` with the address Timeplus will use to call back AgentGuard for alert webhooks — see [Alert UDF webhook](#alert-udf-webhook) below.
106
98
107
-
> **Non-interactive install:** If you pipe the script through `sh` without a terminal (e.g. in CI), configuration prompts are skipped. Edit `~/.agentguard/config.yaml` manually afterwards.
99
+
The `-v agentguard-data:/app/data` volume persists the `config.yaml` written by the setup wizard across container restarts and image upgrades. Without it, setup runs again after every restart.
108
100
109
-
### Option B — Docker Compose (recommended for new installs)
101
+
> **Credentials** are entered in the setup wizard — not via environment variables.
110
102
111
-
This starts Timeplus and AgentGuard together with the correct networking. Save the following as `docker-compose.yaml` and run it:
103
+
### Option C — Docker Compose (recommended for new installs)
104
+
105
+
This starts Timeplus and AgentGuard together with the correct networking:
112
106
113
107
```yaml
114
108
services:
@@ -134,64 +128,48 @@ services:
134
128
start_period: 30s
135
129
136
130
agentguard:
137
-
image: timeplus/agentguard:latest
131
+
image: ghcr.io/timeplus-io/agentguard:latest
138
132
container_name: agentguard
139
133
ports:
140
134
- "8080:8080"
141
135
environment:
142
136
TIMEPLUS_HOST: timeplus
143
137
TIMEPLUS_PORT: 3218
144
-
TIMEPLUS_NATIVE_PORT: 8463
145
-
TIMEPLUS_USER: "proton"
146
-
TIMEPLUS_PASSWORD: "timeplus@t+"
147
138
SERVER_PORT: 8080
148
139
# Timeplus calls this URL for alert webhooks; use the Docker service name.
149
140
AGENTGUARD_URL: "http://agentguard:8080"
141
+
volumes:
142
+
# Persists config.yaml and custom catalog rules across restarts and image upgrades.
143
+
# Mounted at /app/data only — the binary is never shadowed by the volume.
144
+
- agentguard-data:/app/data
150
145
depends_on:
151
146
timeplus:
152
147
condition: service_healthy
153
148
restart: unless-stopped
154
149
155
150
volumes:
156
151
timeplus-data:
152
+
agentguard-data:
157
153
```
158
154
159
155
```bash
160
156
docker compose up -d
161
157
```
162
158
163
-
Open [http://localhost:8080](http://localhost:8080).
159
+
Open [http://localhost:8080](http://localhost:8080) — the **setup wizard** appears on first launch.
164
160
165
161
- AgentGuard waits for Timeplus to pass its health check before starting.
166
-
-`AGENTGUARD_URL=http://agentguard:8080` ensures Timeplus Enterprise can call back AgentGuard for alert webhooks using the Docker service name.
167
-
-Change `TIMEPLUS_USER` / `TIMEPLUS_PASSWORD` if you created a different user in step 3.
162
+
-`AGENTGUARD_URL=http://agentguard:8080` ensures Timeplus Enterprise can call back AgentGuard using the Docker service name.
163
+
-Credentials are entered in the setup wizard, not in the compose file.
168
164
169
-
To stop and remove volumes:
165
+
To stop and remove all data (requires re-setup):
170
166
```bash
171
167
docker compose down -v
172
168
```
173
169
174
-
### Option C — Docker image (standalone)
175
-
176
-
```bash
177
-
docker run -d \
178
-
--name agentguard \
179
-
-p 8080:8080 \
180
-
-e TIMEPLUS_HOST=<timeplus-host> \
181
-
-e TIMEPLUS_USER=proton \
182
-
-e TIMEPLUS_PASSWORD="timeplus@t+" \
183
-
-e AGENTGUARD_URL=http://<agentguard-host>:8080 \
184
-
--restart unless-stopped \
185
-
timeplus/agentguard:latest
186
-
```
187
-
188
-
Replace `<timeplus-host>` with the hostname or IP where Timeplus is running (use `host.docker.internal` on macOS/Windows when Timeplus runs on the host machine).
189
-
190
-
Replace `<agentguard-host>` with the address Timeplus will use to call back AgentGuard for alert webhooks — see [Alert UDF webhook](#alert-udf-webhook) below.
191
-
192
170
### Alert UDF webhook
193
171
194
-
AgentGuard creates a Timeplus Python UDF (`notify_agentguard_udf`) at startup. When a security rule fires, Timeplus calls this UDF, which HTTP-POSTs the alert back to AgentGuard at:
172
+
When a security rule fires, Timeplus executes a Python UDF (`notify_agentguard_udf`) that HTTP-POSTs the alert back to AgentGuard at:
195
173
196
174
```
197
175
<AGENTGUARD_URL>/api/alerts/webhook
@@ -208,6 +186,22 @@ This is a **Timeplus → AgentGuard** call, so `AGENTGUARD_URL` must be the addr
208
186
209
187
---
210
188
189
+
## 4. First-time setup wizard
190
+
191
+
On first launch, AgentGuard shows a 3-step setup wizard instead of the dashboard.
192
+
193
+
**Step 1 — Connection:** Enter your Timeplus host, HTTP port (3218), native TCP port (8463), and the AgentGuard URL (used for alert callbacks). Defaults are pre-filled from environment variables if set.
194
+
195
+
**Step 2 — Credentials:** Enter your Timeplus username and password. Click **Test Connection** to verify — the Next button is disabled until the test passes. Credentials are never stored on disk or in the config file; they live only in the server's in-memory session.
196
+
197
+
**Step 3 — Provision:** Click **Provision Resources** to create all required Timeplus streams, materialized views, UDFs, and seed data. Progress is streamed live in a terminal-style log. On success, you are automatically logged in and redirected to the dashboard.
198
+
199
+
After setup completes, `config.yaml` is written with `setup_complete: true` and the connection details (no credentials). Subsequent server restarts skip directly to the login page.
200
+
201
+
> **Re-running setup:** Setup runs only once. To reset, delete `config.yaml` (or remove the Docker volume) and restart the server.
202
+
203
+
---
204
+
211
205
## 5. Connect OpenClaw
212
206
213
207
### 5a. Install the plugin
@@ -233,8 +227,8 @@ Add the plugin to your `openclaw.json`:
233
227
"stream": "agentguard_hook_events",
234
228
"flushMs": 2000,
235
229
"batchSize": 50,
236
-
"username": "proton",
237
-
"password": "timeplus@t+"
230
+
"username": "default",
231
+
"password": ""
238
232
}
239
233
}
240
234
}
@@ -248,8 +242,8 @@ Or set environment variables before starting OpenClaw:
`Setup complete: false` means the setup wizard will run — navigate to [http://localhost:8080](http://localhost:8080) to complete it. After setup and restart:
403
+
```
404
+
Setup complete: true
406
405
```
407
406
408
407
### Check Claude Code hook events are arriving
@@ -425,4 +424,7 @@ curl -s -X POST http://localhost:3218/proton/v1/query \
425
424
426
425
### Open the dashboard
427
426
428
-
Navigate to [http://localhost:8080/onboarding](http://localhost:8080/onboarding) for the guided setup wizard, or go straight to [http://localhost:8080/dashboard](http://localhost:8080/dashboard) to see live agent activity.
427
+
Navigate to [http://localhost:8080](http://localhost:8080):
428
+
-**First launch:** the setup wizard runs automatically
429
+
-**After setup:** the login page appears; sign in with your Timeplus credentials
430
+
-**After login:** you land on the dashboard; use the **Onboarding** wizard (`/onboarding`) to connect your first agent
0 commit comments