pub(crate) async fn enrol_if_needed(cfg: &Config) -> Result<()>Expand description
Redeem an enrolment token on start, so provisioning a robot is one step rather than two.
This deliberately also runs when a credential already exists. Enrolment
registers the public half of whatever key the robot holds, so a robot that
predates enrolment — one that joined a dev server by trust-on-first-use —
keeps its identity and simply becomes known. Requiring a missing credential
stranded exactly those robots: they connected fine and the server answered
unknown-robot with nothing to do about it.
With a credential already present the attempt is best-effort: a single-use token left in the config or environment will fail on the second start, and that must not stop a robot that is already enrolled from running.