its been a while

agent/README.md

@@ -16,12 +16,28 @@ go build -o keywarden-agent ./cmd/keywarden-agent
 ./keywarden-agent -config /etc/keywarden/agent.json -server-url https://keywarden.example.com -enroll-token <token>
 ```
 
+To rotate/re-enroll an existing agent identity, add `-force-enroll` with a fresh token.
+
 You can also pass `KEYWARDEN_SERVER_URL` and `KEYWARDEN_ENROLL_TOKEN` as environment variables.
 
 ## Config
 
 On first boot, the agent will create a config file if it does not exist. Only `server_url` is required for bootstrapping.
+Do not prefill `server_id` or `agent_api_token` with placeholders; those are written by enrollment.
 
 If the Keywarden server uses a private TLS CA, set `server_ca_path` (or `KEYWARDEN_SERVER_CA_PATH`) to the CA PEM file so the agent can verify the server certificate.
+`agent_api_token` is issued by `/agent/enroll` and persisted into `agent.json` automatically.
+Use the raw token value (no `Bearer ` prefix). If `KEYWARDEN_AGENT_API_TOKEN` env var is set, it overrides `agent_api_token` in `agent.json`.
+When no `log_sources` are configured, the agent defaults to journald collection via `go-systemd/sdjournal` and backfills from the start of the current boot on first sync.
+If journald is unavailable, the agent falls back to common system log files (`/var/log/auth.log`, `/var/log/secure`, `/var/log/syslog`, `/var/log/messages`).
+
+`log_sources` can be defined locally for service/file monitors. These are used as:
+- fallback if central `/agent/servers/{id}/log-config` cannot be fetched
+- additive sources when central config defines one or more explicit sources
+
+If central `log-config` returns an empty list, the agent uses default journald
+collection from the current boot and ignores local `log_sources` for that run.
 
 See `config.example.json`.
+
+For package alternatives and external collector options, see `LOGGING_PACKAGES.md`.