innerwall

Overview ¶

Command innerwall is the control plane: one binary containing the API service, agent gateway, policy compiler, flow ingestion, and signing authority. All durable state lives in Postgres; replicas are stateless and interchangeable. The signing authority's key is the one exception: operator-provisioned configuration, identical on every replica (ADR-0017).

Subcommands:

serve          run the agent gateway (enrollment, renewal, the sync stream)
               and the operator surface (REST/JSON façade, console)
migrate        apply pending database migrations
ca init        create the file-backed signing authority and a server certificate
ca issue-server
               issue a new server certificate for the agent gateway from
               the existing authority, for a new host list
token          mint, list, and revoke provisioning tokens
operator       set the operator password; mint, list, and revoke
               operator tokens (ADR-0021)
service        author reusable protocol/port sets
address-group  author named CIDR sets
ruleset        author rulesets from JSON documents
workload       inspect workloads; set labels and enforcement mode; retire
policy         force a render; show a workload's rendered policy
flows          query stored flow records: a workload's windows, a rollup
               over a label scope, a workload's totals since first seen
dev            development-only commands, compiled in with the dev build
               tag: seed loads the recognizable review fleet into a
               disposable database so the console can be reviewed

Authoring commands write Postgres directly and render there; the running control plane learns of changed policy through the database and pushes it to connected agents (ADR-0018). The operator surface serves the session and identity endpoints of the REST surface (ADR-0021), the read model behind the console's screens (flow rollups, flow pages, workloads, rendered policy), and the write paths (authoring, label edits, bulk mode changes, selector preview, dry-run render, token management). Every command here and every handler there calls the same domain functions, so the two transports cannot drift.