Agent flags

Usage of keystone:
  -allow-no-eku-signers
    	Transition only: accept signing certificates that carry no extended key usage. Signers must be issued for codeSigning; certificates made before that was required have no EKU and are refused without this. Logged loudly every time it admits one. Will be removed
  -api-token string
    	Bearer token required for the HTTP API (or KEYSTONE_API_TOKEN); required to bind a non-loopback address
  -clock-policy string
    	What to do when the system clock is behind known-good time: high-water (verify against the later of the two) or strict (refuse to verify) (default "high-water")
  -demo
    	Run a built-in demo: start a mock 3-component stack
  -enrol-dir dir
    	Identity directory written by keystone enrol. The MQTT client certificate, key, broker CA, tenant and device ID come from it, and the certificate is renewed automatically. Conflicting --mqtt-* values are refused
  -http string
    	HTTP listen address (empty to disable) (default "127.0.0.1:8080")
  -insecure-skip-verify
    	Disable mandatory artifact integrity checks (sha256 + signature). Dev/demo only (or KEYSTONE_INSECURE_SKIP_VERIFY=true)
  -mqtt-broker string
    	MQTT broker URL (empty to disable MQTT adapter)
  -mqtt-client-id string
    	MQTT client ID (defaults to keystone-{device-id})
  -mqtt-command-dedupe-ttl duration
    	How long a commandId is remembered, so a redelivery of the same command is executed once. Raise it on links where a device can be offline longer than this (default 10m0s)
  -mqtt-device-id string
    	Device ID for MQTT topics (required if MQTT enabled)
  -mqtt-health-interval duration
    	Interval for publishing health events (0 to disable) (default 30s)
  -mqtt-pass string
    	MQTT password
  -mqtt-qos int
    	Default QoS level for commands and responses (0, 1, or 2) (default 1)
  -mqtt-state-interval duration
    	Interval for publishing state events (0 to disable) (default 10s)
  -mqtt-tenant string
    	Tenant for MQTT topics, keystone/<tenant>/<device>/...: a DNS label (lowercase letters, digits, inner hyphens). Required with --mqtt-broker unless --enrol-dir provides it
  -mqtt-tls-ca string
    	Path to MQTT CA certificate
  -mqtt-tls-cert string
    	Path to MQTT client TLS certificate
  -mqtt-tls-key string
    	Path to MQTT client TLS key
  -mqtt-tls-verify
    	Verify MQTT server TLS certificate (default true)
  -mqtt-user string
    	MQTT username
  -reconcile-interval duration
    	Re-apply the plan in effect on this interval so dead components are restarted (0 disables it)
  -reconcile-jitter duration
    	Spread reconcile passes across a fleet by this much (defaults to 10% of the interval)
  -self-update-confirm-timeout duration
    	How long a newly installed version has to confirm itself (plan healthy and, with a remote control plane, heard from) before it restarts so the pre-start gate counts the attempt; the gate rolls back after its limit of starts. Only applies while a version is on trial. 0 disables it, and then a version that starts fine but cannot reach its control plane is never rolled back (default 5m0s)
  -self-update-root string
    	Directory holding the A/B install (versions/, current, state/). Setting it enables the confirmation half of self-update: this run marks itself confirmed once the plan is healthy and, where a remote control plane is configured, once that control plane has heard from the device. Empty disables it
  -version
    	Print version and exit

keystoneserver --addr :9000 --root ./dist

task build     # all three binaries, with version ldflags
task run       # agent with HTTP on :8080
task dev       # live reload via air
task test      # go test -v ./...
task fmt       # go fmt ./...
task vet       # go vet ./...
task hooks     # install the go fmt pre-commit hook
task openapi   # regenerate the OpenAPI document
task cli-docs  # regenerate this page