sklet agent

Raw command JSON

{
  "path": [
    "sklet",
    "agent"
  ],
  "slug": "agent",
  "name": "agent",
  "short": "Run an empty control-plane node: open the control API and wait for a remote deploy",
  "long": "Start a supervisor with no services and expose the control API on --listen, so a\nremote `sklp deploy <stack> --server https://host:<port>` can push the first\nmanifest over the network. The node generates its own cert + token; nothing is\ndeployed locally. This is the sklp equivalent of a kubelet that boots empty and\nwaits to be scheduled onto.",
  "synopsis": "sklet agent [flags]",
  "flags": [
    {
      "name": "listen",
      "usage": "TCP address to expose the control API on over TLS + a Bearer token (must NOT be the :9443/:9080 front door)",
      "type": "string",
      "default": ":6464"
    },
    {
      "name": "space",
      "usage": "ignored; kept so agent units rendered before its removal still start",
      "type": "string"
    },
    {
      "name": "advertise",
      "usage": "public host/IP written into the generated node config's server field (e.g. 141.94.106.171); empty leaves server blank for the operator to fill in",
      "type": "string"
    },
    {
      "name": "gateway-mode",
      "usage": "REQUIRED: front door for this node: per-space (native mux on :9080/:9443) or singleton (legacy traefik). No default — the mode is a node-level decision, never inferred from a deploy.yaml",
      "type": "string"
    },
    {
      "name": "mesh-authority-url",
      "usage": "meshauthority base URL (e.g. https://mesh.internal:4300); empty disables the cross-VM WireGuard mesh (ADR-006)",
      "type": "string"
    },
    {
      "name": "mesh-authority-url-internal",
      "usage": "ignored; kept so agent units rendered before its removal still start",
      "type": "string"
    },
    {
      "name": "mesh-endpoint",
      "usage": "this node's own dialable IP:port for the WireGuard mesh (its private cloud interface address + the mesh listen port, e.g. 10.70.0.10:51820); required when --mesh-authority-url is set",
      "type": "string"
    },
    {
      "name": "node-relay-domain",
      "usage": "on a front: relay any control API connection whose TLS SNI is <node-id>.<domain> to that mesh peer's own control API over the private network, TLS untouched (ADR-019). Needs the mesh and a wildcard DNS record *.<domain> on this node's public IP",
      "type": "string"
    },
    {
      "name": "advertise-via",
      "usage": "on a private origin: advertise https://<own mesh node-id>.<domain>:<port> as this node's server, the name the front's --node-relay-domain answers for; ignored when --advertise is set",
      "type": "string"
    },
    {
      "name": "public-nic-interface",
      "usage": "public NIC whose policy routing and SMTP egress the node keeps in place (node.yaml public_nic); empty disables it",
      "type": "string"
    },
    {
      "name": "public-nic-source",
      "usage": "source address routed out of the public NIC (the Additional IP); empty uses the NIC's DHCP address",
      "type": "string"
    },
    {
      "name": "public-nic-table",
      "usage": "routing table holding the public NIC's default route",
      "type": "int",
      "default": "100"
    },
    {
      "name": "public-nic-mark",
      "usage": "fwmark steering outbound SMTP into the public NIC's table",
      "type": "int",
      "default": "25"
    },
    {
      "name": "mesh-cert-fingerprint",
      "usage": "SHA-256 fingerprint (hex, colons optional) of meshauthority's self-signed certificate, printed by meshauthority at startup. Required to reach an https:// authority: there is no CA to validate it against, so the node pins this instead. Empty for a plain http:// authority.",
      "type": "string"
    }
  ]
}