CLI Reference¶
Most commands run on the gateway; test and client-config are used from an operator station. There is no config file - the network's architectural constants are compiled into the shared library (see IMPLEMENTATION.md).
Peer lifecycle (gateway)¶
deploy <public_ip>¶
Install NixOS on a freshly provisioned VPS and register it as an exit node in one step: pick the next free management IP, mint a WireGuard keypair, run nixos-anywhere with the fleet-nix exit-node config, then add the wg-nodes peer. The daemon builds the tunnel and joins ECMP within 30s.
The public_ip must be an IPv4 address. The exit-node flake location defaults to github:StrongWind1/fleet-nix and can be overridden with the EXITFLEET_FLAKE environment variable.
add-peer <pubkey> <wg_ip> <endpoint>¶
Register a node that was built out of band (recovery, gateway rebuild, external install). Adds the WireGuard peer only - the node's wg0 port and a 5s keepalive are applied automatically, and the daemon handles the tunnel and ECMP.
remove-peer <pubkey>¶
Remove an exit node. The daemon reaps the orphaned ipip-* tunnel, rebuilds ECMP, and drops the node's metadata within 30s.
Routing (gateway)¶
pin <last_octet>¶
Force all operator traffic through a single exit node, identified by the last octet of its management IP (the number in ipip-<octet>). Writes /run/exitfleet.pin so the daemon won't restore rotation until you unpin. Fails if the tunnel doesn't exist. See Pinning & Rotation.
unpin¶
Remove the pin; the next daemon tick restores full ECMP rotation.
status¶
Print a fleet snapshot: operator/node counts, a per-node table (tunnel, management IP, endpoint, ASN, network, health), and the current routing mode (ECMP or pinned).
Operator station¶
test [count]¶
Make count requests (default 10) to an echo service and print the exit IP seen each time - distinct IPs across ASNs confirm rotation is working. Must be run where wg-exitfleet is up.
client-config [operator_ip]¶
Print a ready-to-use operator WireGuard config for the given tunnel IP (default 10.100.1.2, valid range .2-.9). The gateway public key and public IP are read live; paste your own private key in place of the placeholder. Run on the gateway.
Other¶
version¶
Print the exitfleet version. Also --version / -V.
help¶
Print usage. Also --help / -h, or any unknown command (which exits non-zero).
Environment variables¶
| Variable | Default | Effect |
|---|---|---|
EXITFLEET_FLAKE |
github:StrongWind1/fleet-nix |
Where deploy fetches the exit-node NixOS config from. Set to a path: for local development. |
EXITFLEET_METADATA_DIR |
/var/lib/exitfleet |
Where the ASN/network cache is written. Used by the test suite; leave unset in production. |