Command Index
zwallctl command index
Global flags (commands/root.go): --config (hidden; default ~/.zwallctl/config.yml), --manager-url (config default http://localhost:8080), --token (do not put live JWTs in argv in examples), --pin-dir (default /sys/fs/bpf/fw), --output/-o (table|json|quiet), --verbose/-v, --quiet/-q, --json.
Enterprise zwallctl also intercepts --build-info-json on the executable (not a cobra subcommand). Community zwallctl does not.
Verified per-command flags (cobra, not README folklore — in-tree zwallctl READMEs mention firewall list / map dump which are not cobra commands):
Scroll sideways to see the full table. Use the arrow keys when focused.
| Command | Extra flags / args |
|---|---|
login | --username/-u, --password/-p (not recommended), --no-save |
list-events | --hours default 24, --limit default 100 |
log [lines] | --lines default 50; --follow/-f prints not implemented |
allow / deny | --direction/-d default inbound; --priority/-p default 100; --scope/-s default global; --duration default 0 |
rate-limit | --burst/-b default 10; --duration/-t default 0 |
block-port | --protocol default tcp; --direction/-d default inbound |
temp-block / temp-allow | --port/-p default 0; --protocol default tcp |
license challenge | --out required |
license import | --file required |
license activate | --key required (do not publish live keys) |
update apply / upgrade | --release-id required; --agents; --component default agent; --rollout-mode default canary; batch/canary/SLO flags |
Implemented in both editions
login, logout, start, stop, restart, flush, enable, disable, status, reload, allow, deny, remove, grep, whitelist, unwhitelist, rate-limit, block-port, temp-block, temp-allow, unblock, test-flush, test-flush-disable, test-flush-status, list, list-rules, list-agents, list-events, info, agent-info, rule-info, log, version, ping, map ls/clear/pin, check, stats, profile-save/restore/list/delete, reset, backup, secret-list, secret-generate, signing-key create/list/revoke
secret-rotate exists in both trees but is not the same command:
- Enterprise: cobra
secret-rotatewith no args; RunE explains API rotation is retired and points operators atsetup.sh --manager-secret-custody rotate. - Community:
secret-rotate [jwt|db|all]still performs live API rotation (--secret,--generate,--grace-perioddefault5m,--force).
Do not put generated secrets on argv in public examples.
Enterprise-only cobra files
license subtree, local-tracker, update / upgrade campaign commands.
Do not document as working remote power control
start and stop print that remote start/stop is not implemented; they tell the operator to use systemd.
Do not document as production upgrade
update apply / upgrade talk to in-product updater APIs which are not the supported production path.
Every public operator command in this book is covered in:
Scroll sideways to see the full table. Use the arrow keys when focused.
| Area | Document |
|---|---|
| login/logout/config | Auth and Config |
| allow/deny/restart/testing mode | Rule Workflows |
| inspect/status/ping/profiles/reset/backup/secrets/updater | Operator Commands |
| map / local-tracker | Local Map Commands |
| license | Enterprise-only. CLI details are provided separately to Enterprise customers. See Editions. |
| install binary | Installation |
| failures | Troubleshooting |
Exit: cobra/command errors print Error: ... and os.Exit(1) via exitWithError.
Where to read each command
Scroll sideways to see the full table. Use the arrow keys when focused.
| Command | Operator page |
|---|---|
login logout | Auth and Config |
allow deny remove whitelist unwhitelist rate-limit block-port temp-* unblock flush enable disable reload restart test-flush* | Rule Workflows |
status list* info agent-info rule-info log version ping check stats grep profile-* reset backup signing-key secret-* start stop | Operator Commands |
map local-tracker | Local Map Commands |
license | Enterprise-only; provided separately to Enterprise customers. Enterprise edition |
update upgrade | Overview (not production) |
| install / first ping | Installation |
| failures | Troubleshooting |
zwallctl backup → Operator Commands and Backup (distinct from backup_db.sh).
Enterprise secret-rotate is retired API rotation; Community still rotates via API. See Operator Commands.