reference cli

⚠️ Auto-generated from the repository — do not edit here. Source: https://github.com/luisgf/ssh-broker/tree/main/docs

broker-ctl CLI

Top-level command reference, captured from broker-ctl itself. Run any subcommand with --help for its flags.

broker-ctl — SSH broker configuration management

Usage:
  broker-ctl [--config f] <command> [args]

Commands:
  broker-ctl host add      [flags]                          Add or update a host
  broker-ctl host list                                      List configured hosts
  broker-ctl host remove   <name>                           Remove a host
  broker-ctl ca-keys add   --name <n> [flags]               Add or update a CA key entry
  broker-ctl ca-keys list                                   List configured CA keys
  broker-ctl ca-keys remove <name>                          Remove a CA key entry
  broker-ctl callers add   --name <cn> [flags]              Add or update a caller
  broker-ctl callers list                                   List configured callers
  broker-ctl callers remove <cn>                            Remove a caller
  broker-ctl reload        [flags]                          Reload the signer
  broker-ctl approval list  [flags]                         List approval requests
  broker-ctl approval allow <id> [--learn --ttl 2h]         Approve a request (--learn waives re-approval for the TTL)
  broker-ctl approval deny  <id> [flags]                    Deny a request
  broker-ctl audit tail    --log <f> [-n N]                 Follow audit log in real time
  broker-ctl audit show    --log <f> [filters]              Search and filter log entries
  broker-ctl audit verify  --log <f> [--key seed]           Verify chain integrity
  broker-ctl policy explain --host <n> [--command c]        Show a host's composed command policy
  broker-ctl policy recommend --audit <f> [filters]         Suggest policy changes from the audit log
  broker-ctl policy add     --host <n> --allow <regex>      Add a command-policy allow rule (signer API, mTLS)
  broker-ctl policy remove  --host <n> --allow <regex>      Remove a command-policy allow rule
  broker-ctl policy grant   --host <n> --allow <regex> [--ttl 2h]  Create a runtime, expiring grant (signer API, mTLS)
  broker-ctl policy grants  [--json]                        List active runtime grants
  broker-ctl policy revoke  <grant-id>                      Revoke a runtime grant
  broker-ctl version       [--verbose]                      Print the build version

Global options:
  --config   Path to signer.json (default: ./signer.json), before the subcommand
  --version  Print the build version and exit (--verbose for details)
exit status 1