Grok Bot Computer Setup

Connect the computer of your xAI Grok Bot to noBGP, so that you, your AI assistant and your other nodes can reach it. This page tells you how to install the agent, how the node comes back after Update Bot's Computer or a restart, and what the node exposes to your network.

What is different on this computer

The Grok Bot computer is a Debian 13 virtual machine that Grok Bot manages. The agents of the bot run commands on it as the user box, who has sudo. Three properties change how the noBGP agent runs there:

• Update Bot's Computer moves the computer to a new virtual machine. Your files and logins are kept. The installed packages are not, and neither is /etc. So the nobgp package, fuse3, and the node's identity in /etc/nobgp are gone after an update.
• There is no systemd. Nothing starts a service at boot, so after a restart the agent is stopped too.
• The computer pauses when the bot is idle. The node goes offline, and comes back when the bot wakes. This is normal, and you do not have to do anything.

The installer finds a Grok Bot computer by itself (its hostname grok-bot-vm-… and the Grok Bot runtime in /opt/sand). On such a computer it does three more things:

• It keeps the agent's configuration, and with it the node's identity, in /workspace/nobgp. /workspace stays through an update. /etc/nobgp becomes a link to it. An agent that you installed before keeps its identity: the agent moves /etc/nobgp to /workspace/nobgp the first time it runs.

  ⚠ Do not delete /workspace/nobgp. It is the noBGP folder in the shared workspace: it holds this node's identity (its key), so only root can open it. If it goes, the computer comes back as a new node.

• It writes /workspace/nobgp/ensure.sh, which puts the agent back: it installs the package again when it is missing, and starts the agent when it is stopped. It needs no key, because the identity is in /workspace/nobgp. Its log is /workspace/nobgp/ensure.log.

• It adds a few lines at the top of the shell profiles of box (~/.profile, ~/.bashrc, and ~/.bash_profile when it exists) that run ensure.sh once after each boot, in the background and with no output.

So the node comes back as the same node, with the same name and the same id, after an update or a restart. Every file the installer writes, and each ensure.sh command, is listed in Agent installation › Grok Bot computers.

Install the agent

Ask the bot to run this command on its computer (put your registration key in place of YOUR_KEY):

curl -fsSL https://downloads.nobgp.com/agent/install.sh | NOBGP_KEY=YOUR_KEY sh

You can also ask the bot to run the command without a key, and complete the sign-in in a browser. The node gets the name of the computer (grok-bot-vm-…) unless you set NOBGP_NAME.

Then check the node in the app, or ask your assistant: "Is my Grok Bot computer online?"

Bring the node back after an update (Team Setup)

The hook in the shell profiles runs only when a login shell or an interactive shell of box starts. Whether the bot's own commands start such a shell is not documented by Grok Bot, so do not depend on it alone. If your Grok Bot team has Team Setup, add a setup entry instead: Grok Bot then runs it at each boot, as root, before the bot does any work.

Field	Value
check	/workspace/nobgp/ensure.sh --check
setup	the script below

if [ -x /workspace/nobgp/ensure.sh ]; then
    exec /workspace/nobgp/ensure.sh
fi
curl -fsSL https://downloads.nobgp.com/agent/install.sh | sh

• check exits 0 when the agent is installed and runs. Grok Bot runs setup only when the check fails.
• setup puts the agent back. On a computer that has no noBGP agent yet, it installs one.
• Add your registration key as a team secret named NOBGP_KEY. Grok Bot gives team secrets to the setup script as environment variables, and removes their values from its log. The key is used only for a first install: a computer that already has its identity in /workspace/nobgp comes back as the same node, and does not use the key.

The shell-profile hook and Team Setup can both be present. ensure.sh runs one copy at a time, and does nothing when the agent already runs.

What your network can reach on this computer

Read this before you put this node in a network with other nodes.

A Grok Bot computer runs services that are bound only to its loopback address, and some have no password. By default, the noBGP agent lets a node of your network reach a port bound only on loopback, as a local program could (peer-loopback, default true). On a Grok Bot computer, that makes these services reachable by each node in a network that this node is in:

Port	Service	What a peer gets
5900, 5902	x11vnc, no password	Full view and control of the bot's screens
9222 + N, 9600	Chrome DevTools	Control of the bot's signed-in browser
8791	The egress CONNECT proxy	An open proxy through the computer

The bot drives this computer and reads web pages that nobody checked, so decide who may reach it. Reach comes from the network: each node in a network that this node is in reaches its ports, whatever the node's sharing setting is. The node's owner has these options:

• Keep loopback services off the network. On the computer, run:

  sudo nobgp config --peer-loopback=false

  A port that the computer binds on all its addresses stays reachable: this setting does not change that.

• Put the node in a network of its own, or in a network with only nodes that you trust. A network with client isolation (isolated) gives its nodes no reach to each other.

⚠ The node's sharing setting does not close these ports. Private (you and org admins) keeps other members from using the node: running commands and reading files on it, which also reaches each local port. Set it too, in the app or with node_access_set. See Sharing a node with your organization.

Uninstall

sudo nobgp uninstall -f

-f skips the confirmation prompt, which the bot cannot answer. This also removes ensure.sh and the lines in the shell profiles, so the agent does not come back at the next boot. The identity stays in /workspace/nobgp, and a new install comes back as the same node. Add --purge to remove the identity too.

⚠ If your team's Team Setup has the entry above, Grok Bot installs the agent again at the next boot. Remove the entry first.

Troubleshooting

• The node did not come back after an update. Ask the bot to run sudo /workspace/nobgp/ensure.sh, and to show sudo tail -n 20 /workspace/nobgp/ensure.log. The shell-profile hook runs once per boot, so a failure is tried again at the next boot, or at once by ensure.sh.
• sudo is not available to box (a team can turn it off). The shell-profile hook then cannot start the agent. Use Team Setup, which runs as root.
• Two nodes for one computer. An update before this support existed removed the identity in /etc/nobgp, so the next install made a new node. Delete the old node, which stays offline, in the app.