enumeray connector enroll

Enroll a host identity using a one-time connector enrollment credential.

Use when: A connector owner created an enrollment file, or a stopped connector is undergoing planned credential replacement.

Role and prerequisites: Connector host operator with the one-time enrollment file. Install the CLI on the connector host and obtain its one-time enrollment credential from the connector administrator. User profiles and interactive login are unnecessary.

Example

enumeray connector enroll --directory ./connector-state --api-base-url https://enumeray.example.org --enrollment-file enrollment.json

Retry an uncertain enrollment using the same directory and enrollment file, even after its original deadline if it committed and its credential remains active. For an expired unused enrollment, an identity that never enrolled can use a replacement with the same directory. After successful enrollment, stop the existing daemon and use a new private credential directory for replacement while retaining the original execution journal.

Inputs and options

Input	Meaning and use
--directory <DIRECTORY>	Private durable enrollment-identity directory containing identity.json, enrollment.json and the long-lived token after enrollment. Retain the same directory and enrollment credential for an uncertain retry. This is separate from the execution journal and remote job/work roots.
--api-base-url <API_BASE_URL>	Enumeray API origin. Use HTTPS, or loopback HTTP for local testing; enrollment/run can explicitly allow a trusted private HTTP network. A retained identity is bound to its original origin.
--enrollment-token-file <ENROLLMENT_TOKEN_FILE>	Private regular file containing only the one-time enrollment token text. Use either this or --enrollment-file; this is not the long-lived connector token.
--enrollment-file <ENROLLMENT_FILE>	Private JSON receipt from enumeray connector create/enrollment containing enrollment_token. Use either this or --enrollment-token-file.
--allow-insecure-http	Allow sending credentials over HTTP to a trusted container/private network. Omit for HTTPS; this choice is retained in the run journal.

Host commands use explicit connector credentials or the private journal and emit JSON results; compute-runner uses only its stdin protocol and directory. User profile and API override options do not apply.

Result and next step

Saves identity.json before contacting the API, then retains enrollment.json and the long-lived private token file on success. Repeating an uncertain attempt with the same directory preserves its identity.

Start run with the enrolled connector ID and ./connector-state/token; see credential replacement.

Exact syntax, defaults and accepted values

Enroll using a single-use credential, retaining identity across retries

Usage: enumeray connector enroll [OPTIONS] --directory <DIRECTORY> --api-base-url <API_BASE_URL>

Options:
      --api <API>
          User API origin override; credentials never cross origins. Host/runner commands use explicit configuration
      --directory <DIRECTORY>
          Private durable identity directory; reuse after an uncertain reply to retain the same enrollment
      --api-base-url <API_BASE_URL>
          API origin using HTTPS or loopback HTTP; non-loopback HTTP requires --allow-insecure-http
      --profile <PROFILE>
          Named local user API/login profile; host/runner commands use explicit configuration [default: default]
      --config <CONFIG>
          Private user profiles file; defaults to $XDG_CONFIG_HOME/enumeray/profiles.json or ~/.config/enumeray/profiles.json
      --enrollment-token-file <ENROLLMENT_TOKEN_FILE>
          Private file containing only the one-time enrollment token; alternative to --enrollment-file
      --enrollment-file <ENROLLMENT_FILE>
          Private JSON document from connector create/enrollment; alternative to --enrollment-token-file
      --json
          Emit user API results as JSON (NDJSON for following logs) and runtime errors on stderr; host/runner output follows its own protocol
      --allow-insecure-http
          Permit enrollment credentials over HTTP to a trusted private network; HTTPS and loopback need no flag
      --timeout <TIMEOUT>
          User API HTTP timeout in seconds; live logs use it for read inactivity. Does not limit execution time [default: 60]
  -h, --help
          Print help