Skip to content

CLI Reference

exitfleet <command> [args]

Most commands run on the gateway; test and client-config are used from an operator station. There is no config file - the network's architectural constants are compiled into the shared library (see IMPLEMENTATION.md).

Peer lifecycle (gateway)

deploy <public_ip>

Install NixOS on a freshly provisioned VPS and register it as an exit node in one step: pick the next free management IP, mint a WireGuard keypair, run nixos-anywhere with the fleet-nix exit-node config, then add the wg-nodes peer. The daemon builds the tunnel and joins ECMP within 30s.

exitfleet deploy 203.0.113.10

The public_ip must be an IPv4 address. The exit-node flake location defaults to github:StrongWind1/fleet-nix and can be overridden with the EXITFLEET_FLAKE environment variable.

add-peer <pubkey> <wg_ip> <endpoint>

Register a node that was built out of band (recovery, gateway rebuild, external install). Adds the WireGuard peer only - the node's wg0 port and a 5s keepalive are applied automatically, and the daemon handles the tunnel and ECMP.

exitfleet add-peer 'Abc123...=' 10.100.0.12 203.0.113.12

remove-peer <pubkey>

Remove an exit node. The daemon reaps the orphaned ipip-* tunnel, rebuilds ECMP, and drops the node's metadata within 30s.

exitfleet remove-peer 'Abc123...='

Routing (gateway)

pin <last_octet>

Force all operator traffic through a single exit node, identified by the last octet of its management IP (the number in ipip-<octet>). Writes /run/exitfleet.pin so the daemon won't restore rotation until you unpin. Fails if the tunnel doesn't exist. See Pinning & Rotation.

exitfleet pin 11

unpin

Remove the pin; the next daemon tick restores full ECMP rotation.

exitfleet unpin

status

Print a fleet snapshot: operator/node counts, a per-node table (tunnel, management IP, endpoint, ASN, network, health), and the current routing mode (ECMP or pinned).

exitfleet status

Operator station

test [count]

Make count requests (default 10) to an echo service and print the exit IP seen each time - distinct IPs across ASNs confirm rotation is working. Must be run where wg-exitfleet is up.

exitfleet test
exitfleet test 25

client-config [operator_ip]

Print a ready-to-use operator WireGuard config for the given tunnel IP (default 10.100.1.2, valid range .2-.9). The gateway public key and public IP are read live; paste your own private key in place of the placeholder. Run on the gateway.

exitfleet client-config 10.100.1.3 > ~/wg-exitfleet.conf

Other

version

Print the exitfleet version. Also --version / -V.

help

Print usage. Also --help / -h, or any unknown command (which exits non-zero).

Environment variables

Variable Default Effect
EXITFLEET_FLAKE github:StrongWind1/fleet-nix Where deploy fetches the exit-node NixOS config from. Set to a path: for local development.
EXITFLEET_METADATA_DIR /var/lib/exitfleet Where the ASN/network cache is written. Used by the test suite; leave unset in production.