63fc54edc5
authelia now watches the users file, so the restart is redundant -- and it was the wrong shape twice over. It could fail: a login was refused for a user whose record was already correct on disk, with nothing in either log implicating the reload. And it only ever worked for this writer -- swarm-authelia-bridge writes the same file and cannot restart anything, since running unprivileged inside the container is the whole reason it may write it at all. A reload that depends on which process did the writing is not a reload. --machine/--unit and their two env vars existed solely to name a systemctl -M target, so they go with it. That drops two required settings from the operator surface. The three objections previously recorded against watch are all answered now, and are kept next to the decision rather than deleted: the key is verified against the pinned build (validate-config accepts it and rejects a misspelling), the watch is on the directory so a rename is observed, and partial reads are structurally impossible because every writer of this file goes through write_atomic.
120 lines
3.7 KiB
Markdown
120 lines
3.7 KiB
Markdown
# Command-Line Help for `swarmctl`
|
|
|
|
This document contains the help content for the `swarmctl` command-line program.
|
|
|
|
**Command Overview:**
|
|
|
|
* [`swarmctl`↴](#swarmctl)
|
|
* [`swarmctl user`↴](#swarmctl-user)
|
|
* [`swarmctl user add`↴](#swarmctl-user-add)
|
|
* [`swarmctl user update`↴](#swarmctl-user-update)
|
|
* [`swarmctl user list`↴](#swarmctl-user-list)
|
|
* [`swarmctl completions`↴](#swarmctl-completions)
|
|
|
|
## `swarmctl`
|
|
|
|
swarm-level operator CLI
|
|
|
|
**Usage:** `swarmctl [OPTIONS] <COMMAND>`
|
|
|
|
###### **Subcommands:**
|
|
|
|
* `user` — Manage subjects in the swarm's SSO provider
|
|
* `completions` — Generate a shell completion script for `swarmctl` and print it to stdout
|
|
|
|
###### **Options:**
|
|
|
|
* `--authelia-bin <PATH>` — authelia binary used to hash passwords. The argon2 parameters must match the verifier's, so this has to be the *configured* package rather than whatever is on `PATH`
|
|
* `--users-file <PATH>` — Host-side path of authelia's users database — i.e. the path inside the container, prefixed with the container's root
|
|
* `--store <PATH>` — Canonical user store
|
|
|
|
|
|
|
|
## `swarmctl user`
|
|
|
|
Manage subjects in the swarm's SSO provider
|
|
|
|
**Usage:** `swarmctl user <COMMAND>`
|
|
|
|
###### **Subcommands:**
|
|
|
|
* `add` — Add a user, generating a password for them
|
|
* `update` — Change an existing user's attributes
|
|
* `list` — List every user in the canonical store
|
|
|
|
|
|
|
|
## `swarmctl user add`
|
|
|
|
Add a user, generating a password for them
|
|
|
|
**Usage:** `swarmctl user add [OPTIONS] <USERNAME>`
|
|
|
|
###### **Arguments:**
|
|
|
|
* `<USERNAME>` — Login name. Conservative ASCII only — it is a YAML map key and reaches access-control rules and logs
|
|
|
|
###### **Options:**
|
|
|
|
* `--display-name <TEXT>` — Name shown in the SSO UI. Defaults to the username
|
|
* `--email <ADDRESS>`
|
|
* `--group <GROUP>` — Repeatable
|
|
|
|
|
|
|
|
## `swarmctl user update`
|
|
|
|
Change an existing user's attributes.
|
|
|
|
Every flag is optional and they compose, so one call can set several things at once. Deliberately does **not** touch the password: regenerating a credential is a different intent from editing an attribute, and folded together an attribute edit can invalidate a login by accident.
|
|
|
|
**Usage:** `swarmctl user update [OPTIONS] <USERNAME>`
|
|
|
|
###### **Arguments:**
|
|
|
|
* `<USERNAME>` — Login name of an existing user
|
|
|
|
###### **Options:**
|
|
|
|
* `--display-name <TEXT>` — Name shown in the SSO UI
|
|
* `--email <ADDRESS>`
|
|
* `--add-group <GROUP>` — Repeatable. Adding a group the user is already in is not an error
|
|
* `--remove-group <GROUP>` — Repeatable. Fails if the user is not in the group — a revocation that reports success without revoking is the failure nobody re-checks
|
|
|
|
|
|
|
|
## `swarmctl user list`
|
|
|
|
List every user in the canonical store.
|
|
|
|
Reads `store` only — never authelia's rendered `users.yml`, which is a derived artifact this crate writes and never reads back (see the crate doc comment). One line per user: username, display name, email (if set), groups (if any).
|
|
|
|
**Usage:** `swarmctl user list`
|
|
|
|
|
|
|
|
## `swarmctl completions`
|
|
|
|
Generate a shell completion script for `swarmctl` and print it to stdout.
|
|
|
|
Supports bash, zsh, fish, elvish and powershell. The nix package already installs bash/zsh/fish system-wide; this is for ad-hoc or other-shell use.
|
|
|
|
Dispatched before `PathArgs::resolve()` for the same reason as `markdown-docs`: emitting a completion script needs none of the `SWARMCTL_AUTHELIA_*` deployment env vars, and requiring them would make the package's own build-time invocation fail.
|
|
|
|
**Usage:** `swarmctl completions <SHELL>`
|
|
|
|
###### **Arguments:**
|
|
|
|
* `<SHELL>` — Shell to emit completions for
|
|
|
|
Possible values: `bash`, `elvish`, `fish`, `powershell`, `zsh`
|
|
|
|
|
|
|
|
|
|
<hr/>
|
|
|
|
<small><i>
|
|
This document was generated automatically by
|
|
<a href="https://crates.io/crates/clap-markdown"><code>clap-markdown</code></a>.
|
|
</i></small>
|