Docs / 3 ways to connect the Agent and Center
3 ways to connect the Agent and Center
Each side only declares whether it opens a port; the connection method is chosen automatically for each pair at pairing time.
| Method | Side that opens a port | Center can be mobile | Cost | Best for |
|---|---|---|---|---|
| 1. Agent calls out to the Center | Center (8721) | No | None | A Center fixed in the office or on a VPS |
| 2. Center calls in to the Agent | Agent (8731) | Yes | None | The Center is a laptop, the Agent has a static IP |
| 3. Via a cloud intermediary | Neither | Yes | SaintBackup relay billed by data volume, or free with your own R2/S3 bucket | Both sides behind NAT/firewall |
Version 1.0 has methods 1 and 2. Method 3 arrives in a later version.
How the method is chosen
- The Center has declared a fixed address → method 1.
- The Center has not, but the Agent allows incoming connections → method 2.
- Both are closed → method 3 (paid relay or your own bucket).
The Agent opens no port by default
A freshly installed Agent only makes outbound connections. The Allow the Center to connect in (Cho phép Center kết nối vào) switch is off by default; turning it on restarts the Agent, which then listens on port 8731. That port only answers API requests signed by the exact Center it is paired with — it does not expose the interface.
Data is always end-to-end encrypted
Whichever method is used, the backup is encrypted right on the Agent with the Center's public key. A relay, a bucket or anyone in between sees only encrypted data.