Skip to content

alpine-admin-cli command map

Use this page to navigate command depth quickly in {{ product_name }}.

Navigation pattern

  • Start at the top-level command groups
  • Open a command-group page
  • Jump to the leaf command anchor for final syntax and options

Most commands are remote gRPC calls

The CLI is a remote gRPC client. Server-touching commands require a host profile created with profile hosts create and an authenticated session from profile authn login. The only exceptions that need no prior login are init (pre-OIDC, HMAC-signed) and every profile hosts/profile authn command (local, no server). Select a host profile for a single invocation with the global -p/--profile option (default default-admin), placed before the command path.

Full command tree

alpine-admin-cli
├── clear
├── exit
├── init
├── profile
│   ├── hosts {create, update, delete, list, view, set-default}
│   └── authn {login, view, logout, delete, list, set-default}
├── grants {search, add, edit, delete}
├── roles {search, edit, delete, clone}
├── permissions {search}
├── provision
│   ├── dss {reset-key}
│   └── hsm {create, update, delete, list, backup, restore}
├── tenant {create, search, update, delete}
│   ├── db {view, update, delete, backup, restore}
│   ├── oidc {view, update, backup, restore}
│   └── license {assign, list, update, remove}
├── oidc {view, update, backup, restore}
├── ntp {view, update, backup, restore}
├── pkix {view, update, backup, restore}
├── proxy {view, update, backup, restore}
├── server {info}
└── license {search}

Top-level commands

Command Purpose Reference page
clear Clear interactive terminal output clear
exit Exit the interactive shell exit
init One-time, HMAC-signed bootstrap of the global administrator (no login required) init
profile Local host-profile and OIDC-login management (hosts, authn) Profile group, Profile hosts, Profile authn
grants Manage authorization grants (search, add, edit, delete) Grants
roles Manage roles (search, edit, delete, clone) Roles
permissions Query the permission catalog (search) Permissions
provision Provision tenant services — DSS bootstrap (dss, dss reset-key) and the HSM partition registry (hsm) Provision
tenant Tenant lifecycle plus per-tenant db, oidc, and license subcommands Tenant group, Tenant DB, Tenant OIDC, Tenant license
oidc Global administrator OIDC configuration (view, update, backup, restore) OIDC
ntp Administrator NTP configuration (view, update, backup, restore) NTP
pkix Administrator PKIX validation profile (view, update, backup, restore) PKIX
proxy Administrator proxy configuration (view, update, backup, restore) Proxy
server Server metadata (info) Server
license Read-only license-definition catalog (search) License

Leaf command references

Interactive shell commands

init

profile hosts

profile authn

grants

roles

permissions

provision

tenant

tenant db

tenant oidc

tenant license

oidc

ntp

pkix

proxy

server

license

Help traversal shortcuts

bin/admin.sh --help
bin/admin.sh profile --help
bin/admin.sh profile hosts --help
bin/admin.sh profile authn --help
bin/admin.sh grants --help
bin/admin.sh roles --help
bin/admin.sh permissions --help
bin/admin.sh tenant --help
bin/admin.sh tenant db --help
bin/admin.sh tenant oidc --help
bin/admin.sh tenant license --help
bin/admin.sh oidc --help
bin/admin.sh ntp --help
bin/admin.sh pkix --help
bin/admin.sh proxy --help
bin/admin.sh server --help
bin/admin.sh license --help

Interactive built-ins and the one-time bootstrap:

clear
exit
bin/admin.sh init --help

FAQ

Which commands work without a login?

Only init (a one-time, HMAC-signed bootstrap) and the local profile hosts and profile authn commands run without an authenticated session. Every other command is a remote gRPC call that needs a host profile created with profile hosts create and a login from profile authn login.

How do I select a non-default host profile for one command?

Use the global -p/--profile option, placed before the command path. The default profile is default-admin. For example, bin/admin.sh -p prod-admin pkix view runs pkix view against the prod-admin host profile for that single invocation.

Where are host profiles and OIDC logins stored?

Host connection profiles — including their embedded OIDC logins (with PIN-sealed tokens) — are stored under ${HOME}/.config/alpinepki/hosts/. Each login holds the OIDC client config (issuer, client id, flow, scopes) plus access/refresh tokens that are AES-GCM sealed with a PIN, and lives inside its host profile. Manage them with the local profile hosts and profile authn command families.

How do I discover the options for any command group?

Append --help to the group or leaf path, for example bin/admin.sh tenant db --help. Each group page on this site also lists every leaf, its syntax, and its options.