Configuration problems

Wrong region, wrong version, edited config files, and multiple workers.

The worker is in the wrong region

Change it in the fleet register rather than in the config file. The register records who changed it and when, and a region is a claim about where measurements came from rather than a local preference.

If the machine has moved rather than the field being wrong, retire the worker and enrol a new one at the new location. That keeps the measurement history attached to where it was actually taken, which editing a field does not.

The worker is below the supported version

It stops being counted. This is not punitive: measurement semantics change between versions, and mixing results from a version that measured differently into a consensus quietly corrupts the verdict.

Update it, or turn on automatic updates so it stays inside the window by itself. Automatic updates are off by default and always have been, which is the fact most often assumed the other way round.

The config file has been edited by hand

Usually recoverable, occasionally not. The failure mode to watch for is a hand-edited compose file that has lost the capability the worker needs to send raw ICMP: the worker starts, enrols, heartbeats, and measures nothing.

If in doubt, vapn uninstall and reinstall. The install is a few minutes and a generated config is known-good.

Two workers on one machine

They will both run and both enrol. They are not two vantage points: they share a path, so consensus treats correlated measurements as less informative than independent ones, and the second one adds much less than it appears to.

If you have two machines in genuinely different places or on genuinely different networks, that is worth doing. Two containers on one host is not.

The name needs changing

Names are set at enrolment. Changing one means retiring and re-enrolling, which is deliberate: the name appears against every measurement the worker has contributed, and a name that changes underneath a historical record makes that record harder to read.

Credentials have leaked

Have them revoked, immediately, and enrol again with a fresh token. Worker credentials authenticate that worker and nothing else, so the blast radius is bounded, but a third party able to upload signed measurements as your worker is exactly the situation the signature exists to prevent.