headmesh-cellagent

Overview ¶

Command headmesh-cellagent runs beside a Headscale server and applies Headmesh's desired state to it under local guardrails. It talks to Headscale over the local unix socket and dials the Headmesh server outbound, so the cell host never exposes Headscale's API or opens an inbound port.

headmesh-cellagent run       [-config /etc/headmesh/cellagent.json]
headmesh-cellagent status    — print mode, freeze state and active policy revision
headmesh-cellagent freeze    — refuse every change until unfreeze (works while the agent runs)
headmesh-cellagent unfreeze
headmesh-cellagent rollback  — re-apply the last policy that applied cleanly (no server needed)
headmesh-cellagent version