# noust node

Manage the servers this central manages, through their API over SSH tunnels.

```bash
noust node [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-node-add), [`assign`](#noust-node-assign), [`export`](#noust-node-export), [`inventory`](#noust-node-inventory), [`key`](#noust-node-key), [`label`](#noust-node-label), [`link`](#noust-node-link), [`list`](#noust-node-list), [`migrate-tunnel`](#noust-node-migrate-tunnel), [`pause`](#noust-node-pause), [`rekey`](#noust-node-rekey), [`remove`](#noust-node-remove), [`resume`](#noust-node-resume), [`show`](#noust-node-show), [`ssh`](#noust-node-ssh), [`test`](#noust-node-test), [`unassign`](#noust-node-unassign)

## noust node add

Register NAME from the join code it printed, and check the tunnel and the token.

```bash
noust node add [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--ssh` | USER@HOST[:PORT] the node is reached at. |  |
| `--join-code` | The code 'noust fleet authorize' printed; '-' reads it from stdin. Omitted, it is asked for without echo. |  |
| `--bastion` | Reach the node through this host. Its host key is pinned from --bastion-fingerprint or --bastion-host-key, never learnt on first use. |  |
| `--bastion-fingerprint` | SHA256:... of the bastion's host key. |  |
| `--bastion-host-key` | The bastion's ssh-ed25519 host key line. |  |
| `--timeout` | Seconds to wait for the connection (default 10). |  |
| `--inventory` | An inventory exported by the central the server comes from (noust node export): its labels, placements and the rest are recorded here once the server is added. |  |
| `--include-ssh` | With --inventory: also apply how that central reached the server (its wait, its bastion). |  |
| `--json` | Print the registered node as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node assign

Give NAME to a team.

```bash
noust node assign [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--team` | The team's short name ('noust team list'). |  |
| `--json` | Print the assignment as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node export

Write down what this central knows about NAME, to take it over on another central.

```bash
noust node export [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `-o`, `--output` | Write the inventory to this file instead of printing it. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node inventory

Record, for NAME already added here, the inventory another central exported for it.

```bash
noust node inventory [OPTIONS] NAME FILE
```

Arguments: `name`, `file`

| Option | What it does | Default |
|---|---|---|
| `--include-ssh` | Also apply how the other central reached the server (its wait, its bastion). |  |
| `--json` | Print what was applied as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node key

Print this central's key for NAME and the command that authorizes it on NAME.

```bash
noust node key [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the key and the authorize command as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node label

Show or change NAME's labels: KEY=VALUE sets one, KEY- removes it.

```bash
noust node label [OPTIONS] NAME [CHANGES]...
```

Arguments: `name`, `changes`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the node's labels as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node link

Servers behind NAT that dial in to this central.

```bash
noust node link [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-node-link-add), [`cancel`](#noust-node-link-cancel), [`invite`](#noust-node-link-invite), [`setup`](#noust-node-link-setup), [`status`](#noust-node-link-status)

## noust node link add

Register NAME from the link code it printed, once it connects and answers.

```bash
noust node link add [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--link-code` | The code 'noust fleet link' printed on the server; '-' reads it from stdin. Omitted, it is asked for without echo. |  |
| `--json` | Print the registered node as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node link cancel

Cancel the invitation of NAME, if it was never answered.

```bash
noust node link cancel [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node link invite

Invite the server NAME to dial in, and print the command to run on it.

```bash
noust node link invite [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--host` | The address the server dials to reach this central: a name or an IP address. |  |
| `--ssh-port` | The SSH port it dials. Default: the port sshd listens on here. |  |
| `--port` | The loopback port its link listens on, on this machine. Default: a free one. |  |
| `--json` | Print the invitation as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node link setup

Prepare this central for servers that dial in.

```bash
noust node link setup [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node link status

Say whether this central can take servers that dial in, and which do.

```bash
noust node link status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node list

List the nodes this central manages, with what it last learnt about each.

```bash
noust node list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the nodes as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node migrate-tunnel

Move NAME from root to the unprivileged noust-tunnel account (a node enrolled by 3.0).

```bash
noust node migrate-tunnel [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--join-code` | The code NAME printed; '-' reads it from stdin. Omitted, the command to run on NAME is printed. |  |
| `--json` | Print the command, or the node, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node pause

Pause NAME's monitoring while you work on it.

```bash
noust node pause [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why, in a line: shown beside the node. |  |

## noust node rekey

Give NAME a new key: first the command to run on it, then the join code it prints.

```bash
noust node rekey [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--join-code` | The code NAME printed for the new key; '-' reads it from stdin. Omitted, the rotation starts and the command to run on NAME is printed. |  |
| `--json` | Print the command, or the node, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node remove

Stop managing NAME: revoke its token there, close its tunnel, delete its key and token here.

```bash
noust node remove [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--no-revoke` | Do not ask the node to revoke this central's token. |  |
| `-f`, `--force` | Do not ask for confirmation. |  |
| `--json` | Print the warnings as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node resume

Put NAME's monitoring back, with a clean count of silences.

```bash
noust node resume [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node show

Show one node: its address, pinned host key, tunnel and last status.

```bash
noust node show [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the node and its tunnel as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node ssh

Show or change how this central connects to NAME: its wait and its bastion.

```bash
noust node ssh [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--timeout` | Seconds to wait for the connection (1 to 300). |  |
| `--default-timeout` | Go back to the default wait (10 seconds). |  |
| `--bastion` | Reach the node through this host. Needs --bastion-fingerprint or --bastion-host-key for a new one: a host key is never learnt on first use. |  |
| `--bastion-fingerprint` | SHA256:... of the bastion's host key. |  |
| `--bastion-host-key` | The bastion's ssh-ed25519 host key line. |  |
| `--no-bastion` | Connect to the node directly. |  |
| `--no-test` | Keep the change without opening the tunnel first (a node that is down now). |  |
| `--show` | Print the authorized_keys line to add on the bastion: one stream to the node, no shell. With --bastion it is the line for that bastion, and nothing is changed: ask for it first, then change the bastion once it lets the central in. |  |
| `--json` | Print the options as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node test

Check NAME end to end: the tunnel, the token and the API. Exits 1 when it fails.

```bash
noust node test [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust node unassign

Give NAME back to the instance: no team sees it any more.

```bash
noust node unassign [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |