# noust central

Run and look after a central: the Noust that manages your servers.

```bash
noust central [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`backup`](#noust-central-backup), [`run`](#noust-central-run), [`seal`](#noust-central-seal), [`status`](#noust-central-status), [`unlock`](#noust-central-unlock), [`unseal`](#noust-central-unseal)

## noust central backup

Back up the central's store, secrets and keys into one encrypted file.

```bash
noust central backup [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--output` | Directory to write the backup to (default: central/ under the backups directory). |  |
| `--verify` | Check an existing backup instead: it opens, and every file matches its manifest. |  |
| `--decrypt` | Decrypt an existing backup to its .tar.gz (give the file with --to), to restore it. |  |
| `--to` | Where --decrypt writes the archive (created 0600). |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust central run

Serve the central's console in the foreground (what the container runs).

```bash
noust central run [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--host` | Address to listen on. The console is served over TLS whatever it is. | `0.0.0.0` |
| `--port` | Port to listen on. | `8443` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust central seal

Encrypt every secret (node keys and tokens, integration keys) under a passphrase. After this, the central starts locked until it is given the passphrase. The passphrase cannot be recovered: keep it somewhere else.

```bash
noust central seal [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust central status

Report the central's role, data, certificate, seal, servers and 2FA.

```bash
noust central status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust central unlock

Give the running central the passphrase of its sealed secrets.

```bash
noust central unlock [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust central unseal

Decrypt every secret and remove the seal.

```bash
noust central unseal [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |