vexa_subscriber.py

usage: vexa_subscriber [-h] {list,add,revoke} ...

Manage credentials on the Vexa channel registry, which runs on a standalone Docker host. Host
coordinates are site configuration: $CHANNEL_REGISTRY_SSH, $CHANNEL_ROOT and $CHANNEL_EDGE_URL,
documented in config/channel.example.env.

positional arguments:
  {list,add,revoke}
    list             show accounts and their scope
    add              mint a credential for an account (also rotates an existing one)
    revoke           remove an account's credential

options:
  -h, --help         show this help message and exit

usage: vexa_subscriber list [-h]

options:
  -h, --help  show this help message and exit

usage: vexa_subscriber add [-h] [--park] [--channel CHANNEL] [--station STATION] [--edge EDGE]
                           [--edge-recipient EDGE_RECIPIENT] [--park-out PARK_OUT]
                           [--park-ssh PARK_SSH] [--ledger LEDGER] [--ttl SECONDS]
                           [--parked-by PARKED_BY]
                           name

positional arguments:
  name                  account name, e.g. 'pilot'

options:
  -h, --help            show this help message and exit

claim-code delivery (--park):
  Seal the minted credential to the edge's key and park it under a 6-digit code you read on a
  call. Line 1 of stdout is still the credential, to vault; line 2 is the six digits, grouped in
  threes for reading aloud.

  --park                park the credential for claiming at the channel edge
  --channel CHANNEL     channel the station belongs to (required with --park; the ledger path)
  --station STATION     station the code is bound to (default: the account name)
  --edge EDGE           claim endpoint URL (default: $CHANNEL_CLAIM_EDGE)
  --edge-recipient EDGE_RECIPIENT
                        age recipients file holding the EDGE's public key — we encrypt to it and
                        cannot decrypt what we wrote (default: $CHANNEL_CLAIM_EDGE_RECIPIENT)
  --park-out PARK_OUT   spool directory this host can write (default: $CHANNEL_CLAIM_SPOOL)
  --park-ssh PARK_SSH   scp target for the edge host's spool, e.g. root@host:/srv/channel/claims
                        (default: $CHANNEL_CLAIM_SPOOL_SSH)
  --ledger LEDGER       checkout of the vexa-stations ledger (default: $VEXA_STATIONS_DIR)
  --ttl SECONDS         how long the code lives (default 900)
  --parked-by PARKED_BY
                        who parked it, for the ledger (default: $USER)

usage: vexa_subscriber revoke [-h] [--force] name

positional arguments:
  name

options:
  -h, --help  show this help message and exit
  --force     allow revoking the publisher or edge-signature-reader account