stackkit host

stackkit host [flags]

stackkit host attach-conformance [flags]

stackkit host conformance [flags]

stackkit host delivery [flags]

stackkit host delivery detach [flags]

stackkit host delivery detach --owner-approve

stackkit host delivery recipient [flags]

stackkit host delivery recipient --challenge "$CHALLENGE" --authority-key "$WALLET_KEY" --authority-key-id wallet-1 --owner-approve
stackkit host delivery recipient --challenge "$CHALLENGE" --rotate --owner-approve

stackkit host delivery status [flags]

stackkit host environment [flags]

# Show whether this host looks like a home network or a public server
stackkit host environment

# The same observation as JSON
stackkit host environment --json

# Override a wrong detection for the next command, here Basement Kit init on a home host
STACKKIT_NETWORK_ENV=home stackkit init basement-kit --catalog-defaults --owner-source=local --owner-email you@example.com

stackkit host migrate-browser-ca [flags]

stackkit host preflight [flags]

# Check this host against the kit selected in the current deployment directory
stackkit host preflight

# Also refuse on warnings and unknown facts, and print the report as JSON
stackkit host preflight --policy strict --json

stackkit host prepare [flags]

# Converge the execution-channel account after an interrupted Cloud Kit install (run as root in the Cloud Kit deployment directory)
cd my-cloud
stackkit host prepare

stackkit host reboot [flags]

# Reboot this node in 30 seconds
sudo stackkit host reboot --yes

# Reboot in two minutes and report the boot ID to compare against
sudo stackkit host reboot --yes --delay 2m --json

stackkit host remediate [flags]

# List the fixes for this host's preflight findings without changing anything
stackkit host remediate

# Carry out one fix by the ID the list printed
stackkit host remediate --apply <resolution-id> --yes

# Carry out every undoable fix that may run unattended
stackkit host remediate --auto-reversible --yes

stackkit host security [flags]

  - the firewall always keeps admitting the ssh sessions in use and every
    --management-source on every sshd port, and a policy that would not is
    refused before it is loaded;
  - password logins are disabled only when an account holds an authorized key;
    without one they stay on, the step is refused with reason no_authorized_key
    and the rest of the baseline is still repaired. The previous sshd and
    firewall configuration is restored if the new one does not validate or does
    not take effect;
  - fail2ban never bans the management path.

stackkit host security repair [flags]

# See what would be repaired
sudo stackkit host security repair --site-kind home

# Restore only the firewall, keeping a jump host reachable
sudo stackkit host security repair --apply --control firewall.default_inbound --management-source 198.51.100.0/24

stackkit host security status [flags]

stackkit host security verify [flags]

# Verify this host and record the evidence
sudo stackkit host security verify

# Machine-readable, advanced mode, exit non-zero on any drifted control
sudo stackkit host security verify --mode advanced --json --fail-on-drift

# What the Techstack host pre-step runs: only the controls the baseline enforces decide the exit code; patch lag, pending reboot, exposure and certificates are still observed and reported
sudo stackkit host security verify --mode advanced --json --fail-on-drift --drift-scope enforced

# Judge exposure against the ports the verified plan declares
sudo stackkit host security verify --resolved-plan plan.json --local-node node-1

stackkit host ssh [flags]

  - ssh-ca-trust installs the owner's user CA keys as TrustedUserCAKeys
    (/etc/ssh/stackkit/trusted_user_ca_keys) and one AuthorizedPrincipalsFile
    per local user (/etc/ssh/stackkit/principals/<user>). Root is never a
    target. An empty key list revokes like ssh-ca-revoke.
  - ssh-ca-revoke removes that trust. Revocations take effect at once and are
    never rolled back; one sshd cannot reload for is recorded as cleanup
    pending and finished by 'host security repair'.
  - ssh-host-certificate installs a host certificate beside the host key it
    certifies, only if it names every --host-name (default: the system
    hostname) and is currently valid.

stackkit host ssh apply [flags]

sudo stackkit host ssh apply --tenant-ref "$TENANT" --owner-approve < envelope.json

stackkit host updates [flags]

stackkit host updates apply [flags]

# Apply the plan you reviewed
sudo stackkit host updates apply --plan-digest sha256:<digest> --yes

stackkit host updates plan [flags]

# Show the pending updates of this node
sudo stackkit host updates plan

# Machine-readable plan with its plan_digest
sudo stackkit host updates plan --json