Bind the Host

The sensor ships every digest under the address of the machine it runs on. Binding is what decides that address and writes it down where the service can read it. A host that is installed and running but never bound collects normally and sends nothing.

Do it before you install the service.

1. Sign in

whisper login --web

Binding is a keyed step. The key goes to ~/.config/whisper/key, readable only by you.

2. Bind

whisper enroll

whisper: bound 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478  (app-1)

By default the machine is bound under its own hostname; --name binds it under a name you choose instead. The command is idempotent by design: a host that is already bound prints what it is bound to and exits, and a re-run after an upgrade, a rebuild or a lost marker re-finds the same address rather than minting a duplicate. Minting a duplicate would strand the old address and take the telemetry with it, so the default is never to do it. --force re-binds a host that already carries a marker.

Three things are tried, in this order: reuse the agent already registered under this host's name, mint a new agent under that name, or fall back to the address your own key holds. A key with no authority to register still ends up bound.

What lands on disk is the marker at ~/.config/whisper/bound, holding the mode, the address, the name, the agent and the time it was bound. It holds no secrets. On Windows the marker is at %USERPROFILE%\.config\whisper\bound.

3. Install the service with your environment intact

sudo -E whisper service install --now --sensor

sudo resets HOME. Your key and the marker from step 2 both live under your home directory, so plain sudo sends root looking in the wrong place and the service comes up with no identity to report under. -E keeps the environment, and root finds both.

4. If the service was already installed

Bind first, then restart it so it picks the address up:

whisper enroll
sudo -E whisper service restart --sensor
journalctl -u whisper-sensor -n 3

whisper: sensor: reporting as 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478

Until that line appears, the journal says what is missing instead:

whisper: no bound /128 identity - summaries stay local until one is bound

That is the single most common reason a healthy-looking sensor reports nothing, and the fix is this page from step 1. On Windows, run whisper enroll and the service install as the same account, then whisper service restart --sensor.

The address itself, how the name is derived from it and what anyone can check about it without a key are covered in the address as identity.