Skip to main content
Enroll, list and revoke household devices (CLI token fallback of the State Console ceremony).
Subcommands: stackkit device enroll, stackkit device list, stackkit device overlay, stackkit device revoke

​
stackkit device enroll

Issue a single-use pairing token after Owner step-up, or redeem one with a device CSR. With --owner-session-file, issue a single-use 300-second pairing token; the file holds a PocketID Owner session authenticated within the last 60 seconds (’-’ reads stdin). With --code and --csr, redeem the token for the device-generated key in the CSR and receive a client certificate from the node-local step-ca device provisioner. Both steps also combine in one call. Enrollment is refused from outside the LAN.

​
stackkit device list

List enrolled and revoked household devices.

​
stackkit device overlay

Join enrolled devices to the kit-owned WireGuard overlay for remote-private access. The node generates its WireGuard private key into local custody; it is never printed or rendered. Each device generates its own key pair and registers only its public key. Revoked or expired devices drop out of the rendered interface configuration. No kombify account is involved.
Subcommands: stackkit device overlay bind, stackkit device overlay render

​
stackkit device overlay bind

Register an enrolled device’s WireGuard public key and assign its overlay address.

​
stackkit device overlay render

Render the node’s wg-quick configuration (public keys only; the private key loads from custody).

​
stackkit device revoke

Permanently revoke a household device key.