Skip to content
GitHub 6 Install 
curl -fsSL https://noust.dev/install.sh | sh

Language

Esta página solo está en inglés: abre la portada de la documentación.

Theme
Install GitHub 6
Pages in Reference

noust node

Manage the servers this central manages, through their API over SSH tunnels.

Reference Updated View as Markdown
Shell
noust node [OPTIONS] COMMAND [ARGS]...

Subcommands: add, assign, export, inventory, key, label, link, list, migrate-tunnel, pause, rekey, remove, resume, show, ssh, test, unassign

noust node add

Register NAME from the join code it printed, and check the tunnel and the token.

Shell
noust node add [OPTIONS] NAME

Arguments: name

Option What it does Default
--ssh USER@HOST[:PORT] the node is reached at.
--join-code The code 'noust fleet authorize' printed; '-' reads it from stdin. Omitted, it is asked for without echo.
--bastion Reach the node through this host. Its host key is pinned from --bastion-fingerprint or --bastion-host-key, never learnt on first use.
--bastion-fingerprint SHA256:... of the bastion's host key.
--bastion-host-key The bastion's ssh-ed25519 host key line.
--timeout Seconds to wait for the connection (default 10).
--inventory An inventory exported by the central the server comes from (noust node export): its labels, placements and the rest are recorded here once the server is added.
--include-ssh With --inventory: also apply how that central reached the server (its wait, its bastion).
--json Print the registered node as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node assign

Give NAME to a team.

Shell
noust node assign [OPTIONS] NAME

Arguments: name

Option What it does Default
--team The team's short name ('noust team list').
--json Print the assignment as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node export

Write down what this central knows about NAME, to take it over on another central.

Shell
noust node export [OPTIONS] NAME

Arguments: name

Option What it does Default
-o, --output Write the inventory to this file instead of printing it.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node inventory

Record, for NAME already added here, the inventory another central exported for it.

Shell
noust node inventory [OPTIONS] NAME FILE

Arguments: name, file

Option What it does Default
--include-ssh Also apply how the other central reached the server (its wait, its bastion).
--json Print what was applied as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node key

Print this central's key for NAME and the command that authorizes it on NAME.

Shell
noust node key [OPTIONS] NAME

Arguments: name

Option What it does Default
--json Print the key and the authorize command as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node label

Show or change NAME's labels: KEY=VALUE sets one, KEY- removes it.

Shell
noust node label [OPTIONS] NAME [CHANGES]...

Arguments: name, changes

Option What it does Default
--json Print the node's labels as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Servers behind NAT that dial in to this central.

Shell
noust node link [OPTIONS] COMMAND [ARGS]...

Subcommands: add, cancel, invite, setup, status

Register NAME from the link code it printed, once it connects and answers.

Shell
noust node link add [OPTIONS] NAME

Arguments: name

Option What it does Default
--link-code The code 'noust fleet link' printed on the server; '-' reads it from stdin. Omitted, it is asked for without echo.
--json Print the registered node as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Cancel the invitation of NAME, if it was never answered.

Shell
noust node link cancel [OPTIONS] NAME

Arguments: name

Option What it does Default
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Invite the server NAME to dial in, and print the command to run on it.

Shell
noust node link invite [OPTIONS] NAME

Arguments: name

Option What it does Default
--host The address the server dials to reach this central: a name or an IP address.
--ssh-port The SSH port it dials. Default: the port sshd listens on here.
--port The loopback port its link listens on, on this machine. Default: a free one.
--json Print the invitation as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Prepare this central for servers that dial in.

Shell
noust node link setup [OPTIONS]
Option What it does Default
--json Print what was done as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Say whether this central can take servers that dial in, and which do.

Shell
noust node link status [OPTIONS]
Option What it does Default
--json Print the status as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node list

List the nodes this central manages, with what it last learnt about each.

Shell
noust node list [OPTIONS]
Option What it does Default
--json Print the nodes as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node migrate-tunnel

Move NAME from root to the unprivileged noust-tunnel account (a node enrolled by 3.0).

Shell
noust node migrate-tunnel [OPTIONS] NAME

Arguments: name

Option What it does Default
--join-code The code NAME printed; '-' reads it from stdin. Omitted, the command to run on NAME is printed.
--json Print the command, or the node, as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node pause

Pause NAME's monitoring while you work on it.

Shell
noust node pause [OPTIONS] NAME

Arguments: name

Option What it does Default
--reason Why, in a line: shown beside the node.

noust node rekey

Give NAME a new key: first the command to run on it, then the join code it prints.

Shell
noust node rekey [OPTIONS] NAME

Arguments: name

Option What it does Default
--join-code The code NAME printed for the new key; '-' reads it from stdin. Omitted, the rotation starts and the command to run on NAME is printed.
--json Print the command, or the node, as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node remove

Stop managing NAME: revoke its token there, close its tunnel, delete its key and token here.

Shell
noust node remove [OPTIONS] NAME

Arguments: name

Option What it does Default
--no-revoke Do not ask the node to revoke this central's token.
-f, --force Do not ask for confirmation.
--json Print the warnings as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node resume

Put NAME's monitoring back, with a clean count of silences.

Shell
noust node resume [OPTIONS] NAME

Arguments: name

Option What it does Default
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node show

Show one node: its address, pinned host key, tunnel and last status.

Shell
noust node show [OPTIONS] NAME

Arguments: name

Option What it does Default
--json Print the node and its tunnel as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node ssh

Show or change how this central connects to NAME: its wait and its bastion.

Shell
noust node ssh [OPTIONS] NAME

Arguments: name

Option What it does Default
--timeout Seconds to wait for the connection (1 to 300).
--default-timeout Go back to the default wait (10 seconds).
--bastion Reach the node through this host. Needs --bastion-fingerprint or --bastion-host-key for a new one: a host key is never learnt on first use.
--bastion-fingerprint SHA256:... of the bastion's host key.
--bastion-host-key The bastion's ssh-ed25519 host key line.
--no-bastion Connect to the node directly.
--no-test Keep the change without opening the tunnel first (a node that is down now).
--show Print the authorized_keys line to add on the bastion: one stream to the node, no shell. With --bastion it is the line for that bastion, and nothing is changed: ask for it first, then change the bastion once it lets the central in.
--json Print the options as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node test

Check NAME end to end: the tunnel, the token and the API. Exits 1 when it fails.

Shell
noust node test [OPTIONS] NAME

Arguments: name

Option What it does Default
--json Print the result as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust node unassign

Give NAME back to the instance: no team sees it any more.

Shell
noust node unassign [OPTIONS] NAME

Arguments: name

Option What it does Default
--json Print the result as JSON.
--reason Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Something on this page is wrong or unclear? Report it on GitHub.

Help, contributing and the project’s policies are under Project.

Search the documentation

Type to search every page.

↑ ↓ to move, Enter to open, Esc to close