# noust web

Run the browser panel for this server.

```bash
noust web [OPTIONS] COMMAND [ARGS]...
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |

Subcommands: [`disable`](#noust-web-disable), [`enable`](#noust-web-enable), [`expose-hooks`](#noust-web-expose-hooks), [`install`](#noust-web-install), [`refresh-unit`](#noust-web-refresh-unit), [`restart`](#noust-web-restart), [`start`](#noust-web-start), [`status`](#noust-web-status), [`stop`](#noust-web-stop), [`token`](#noust-web-token)

## noust web disable

Stop the panel's systemd service and remove it.

```bash
noust web disable [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust web enable

Run the panel as a systemd service that survives reboots.

```bash
noust web enable [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-H`, `--host` | Interface to bind to. Anything but loopback needs TLS (--tls-cert/--tls-key or --self-signed) or --insecure-http. | `127.0.0.1` |
| `-p`, `--port` | Port to listen on. | `8080` |
| `--require-https` | Serve TLS from the panel and refuse cleartext. Needs --tls-cert and --tls-key, or --self-signed. |  |
| `--tls-cert` | Certificate chain to serve. |  |
| `--tls-key` | Private key for the certificate. |  |
| `--self-signed` | Serve TLS with a self-signed certificate, minted under /etc/noust/panel-tls and reused while it is valid. |  |
| `--insecure-http` | Serve cleartext HTTP beyond loopback. The access token and the session cookie cross the network unencrypted. |  |
| `--allow-ip` | Only answer this address or network. Repeat to allow several. Restricts who connects; encrypts nothing. |  |
| `--trusted-proxy` | Believe forwarding headers from this peer. Declare the proxy that terminates TLS so the session cookie is issued with Secure. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust web expose-hooks

Receive webhooks on DOMAIN, a name of its own, without exposing the console.

```bash
noust web expose-hooks [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--remove` | Remove the hooks site of DOMAIN. |  |
| `--no-ssl` | Serve plain HTTP instead of obtaining a certificate. |  |
| `--port` | The console's port on loopback; read from noust-web.service by default. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the outcome as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust web install

Install the packages the panel needs.

```bash
noust web install [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--apt` | Install the distribution packages. |  |
| `--pip` | Install into this Python with pip. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust web refresh-unit

Rewrite noust-web.service for this version, keeping where it listens (run by the package).

```bash
noust web refresh-unit [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust web restart

Stop the panel and start it again.

```bash
noust web restart [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-H`, `--host` | Interface to bind to. Anything but loopback needs TLS (--tls-cert/--tls-key or --self-signed) or --insecure-http. | `127.0.0.1` |
| `-p`, `--port` | Port to listen on. | `8080` |
| `--require-https` | Serve TLS from the panel and refuse cleartext. Needs --tls-cert and --tls-key, or --self-signed. |  |
| `--tls-cert` | Certificate chain to serve. |  |
| `--tls-key` | Private key for the certificate. |  |
| `--self-signed` | Serve TLS with a self-signed certificate, minted under /etc/noust/panel-tls and reused while it is valid. |  |
| `--insecure-http` | Serve cleartext HTTP beyond loopback. The access token and the session cookie cross the network unencrypted. |  |
| `--allow-ip` | Only answer this address or network. Repeat to allow several. Restricts who connects; encrypts nothing. |  |
| `--trusted-proxy` | Believe forwarding headers from this peer. Declare the proxy that terminates TLS so the session cookie is issued with Secure. |  |
| `-d`, `--daemon` | Run in the background, until 'noust web stop' or the next reboot. 'noust web enable' survives reboots. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust web start

Start the panel and print an access token.

```bash
noust web start [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-H`, `--host` | Interface to bind to. Anything but loopback needs TLS (--tls-cert/--tls-key or --self-signed) or --insecure-http. | `127.0.0.1` |
| `-p`, `--port` | Port to listen on. | `8080` |
| `--require-https` | Serve TLS from the panel and refuse cleartext. Needs --tls-cert and --tls-key, or --self-signed. |  |
| `--tls-cert` | Certificate chain to serve. |  |
| `--tls-key` | Private key for the certificate. |  |
| `--self-signed` | Serve TLS with a self-signed certificate, minted under /etc/noust/panel-tls and reused while it is valid. |  |
| `--insecure-http` | Serve cleartext HTTP beyond loopback. The access token and the session cookie cross the network unencrypted. |  |
| `--allow-ip` | Only answer this address or network. Repeat to allow several. Restricts who connects; encrypts nothing. |  |
| `--trusted-proxy` | Believe forwarding headers from this peer. Declare the proxy that terminates TLS so the session cookie is issued with Secure. |  |
| `-d`, `--daemon` | Run in the background, until 'noust web stop' or the next reboot. 'noust web enable' survives reboots. |  |
| `--under-systemd` | Run as noust-web.service does: print no token, write no PID file. Written into the unit by 'noust web enable'; not for interactive use. |  |
| `--keep-token` | With --daemon: serve the access token already issued and print none. How 'noust fleet authorize' puts a background console back; not for interactive use. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust web status

Show whether the panel is running, and whether as a service or in the background.

```bash
noust web status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust web stop

Stop the panel started with 'noust web start -d'.

```bash
noust web stop [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust web token

Show the state of the access token, or issue a new one with --new.

```bash
noust web token [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--new`, `--rotate` | Issue a new access token. The token currently in use stops working. |  |
| `-r`, `--regenerate` | Issue a new token and rotate the signing key, logging out every open session and invalidating every API token and TOTP backup code. |  |
| `-y`, `--yes` | Do not ask for confirmation. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |