One line, from the company's install page.
Run in the router's shell, as a user who can write to /config. It fetches the signed binary, verifies the checksum, installs the service and connects. Run it again any time; it never overwrites the machine's identity.
curl -fsSL https://hub.[yourdomain]/install/inst_…/vyos.sh | sudo bash
Outbound 443 to the hub only. No inbound rule, no VPN, no SNMP community.
what the agent watches on VyOSSurvives an image upgradeVyOS upgrades by booting a whole new image, and anything outside /config goes with the old one. The agent installs to /config/be-agent and its service is re-created at every boot from the VyOS boot hook, so the router does not silently stop reporting after an upgrade.Who changed the router, and whenThe heartbeat carries the time config.boot last changed and its size. The question actually asked about a firewall, answered without anyone logging in.Which image is bootedThe image this boot is running from, read from the mount table rather than a kernel parameter, so an upgrade that did not take is visible.Reports as VyOSNot as Debian. The fleet shows the VyOS release, so 1.3 and 1.4 are told apart at a glance.Everything a Linux box getsServices and failed units, the journal, CPU, memory, every filesystem, ping and network facts, custom checks, alerts and the nightly BE AI pass.Read-only collectionThe VyOS facts are file reads. No vbash, no operational-mode commands, nothing executed on a router carrying live traffic. questions