The server's commands

Before you start

• When it applies. Users, rights, shares and settings apply at once, with no restart. The ports and max-connections-per-session apply at the next start (restarting it).
• Every command: help lists them all, with their options.
• For scripts: the commands that list or show take --json; user add and user passwd take --password-stdin (one line, read from standard input) instead of asking. The exit code says how it went: 0 done, 1 failed, 2 a wrong command or a change refused, 3 the server could not start, 4 it needs root or an administrator, 5 no such user, share or setting.
• Registered with WabiOne, the server's settings are WabiOne's: the commands that change them are refused, saying so, and they are changed in WabiOne's console. What stays the machine's own still works here: passwords of the server's own accounts, database passwords, user unlock and share grant.
• From your desk instead: Server settings, in the WabiLink app (port 8010, an administrator's account), change the same, except what is marked this machine only below. For an AI assistant, wabilink mcp in the command-line client does it too.

sudo wabilink-server help
sudo wabilink-server config show

Users

The server's own accounts: a name and a password of WabiLink's, not the machine's.

sudo wabilink-server user list
sudo wabilink-server user add ann                 # asks for a password, twice
sudo wabilink-server user add ann --admin         # and an administrator: may open Server settings
sudo wabilink-server user add bob --must-change   # chooses a new password at the first login
sudo wabilink-server user passwd ann              # a new password
sudo wabilink-server user passwd bob --must-change
sudo wabilink-server user unlock ann              # locked after too many failed logins
sudo wabilink-server user disable bob             # kept, but may not log in; user enable bob lets them again
sudo wabilink-server user remove bob

From a script, the password from a file or a secret store, never on the command line:

sudo wabilink-server user add carol --password-stdin < password.txt

Get-Content password.txt | .\wabilink-service user add carol --password-stdin

--no-password makes an account with no password: it cannot log in until it gets one with user passwd. An account has no shares until it is given some (Shares).

Rights and groups

What each account may use beyond its shares. Each needs its part of the server turned on as well (Settings).

sudo wabilink-server user admin ann yes            # Server settings, in the app, on port 8010
sudo wabilink-server user terminal ann yes         # terminals, once terminals-enabled is yes
sudo wabilink-server user login-terminal ann yes   # login terminals, once login-terminals-enabled is yes
sudo wabilink-server user desktop ann yes          # this machine's desktop, once desktop-enabled is yes
sudo wabilink-server user desktop-login ann yes    # a login screen of its own (Linux, GNOME with GDM 46 and later)
sudo wabilink-server user tunnel ann nas-web yes   # a tunnel, by its name
sudo wabilink-server user db ann reporting read    # a database connection, at a level
sudo wabilink-server user rights ann               # what each part gives them, their groups' too

Each of these is a right of one of the server's parts (modules), and can also be given by its own name: user right NAME MODULE RIGHT VALUE. The terminals' rights are open and login, the desktop's use and login, the tunnels' tunnels.

sudo wabilink-server user right ann terminals open yes

Groups

Groups are made, and given their shares, in Server settings, in the WabiLink app. Here, what every member is given:

sudo wabilink-server group list
sudo wabilink-server group rights support
sudo wabilink-server group right support desktop use yes

Shares

A folder of this machine, under a name, for one account. Each account also has a private share of its own, kept in private-share-path.

sudo wabilink-server share list ann
sudo wabilink-server share add ann Files /srv/files --default        # the share the app opens first
sudo wabilink-server share add ann Photos /srv/photos --read-only --description "Family photos"
sudo wabilink-server share add ann Projects /home/ann/projects --grant-access --confirm-path /home/ann/projects
sudo wabilink-server share remove ann Photos

.\wabilink-service share list ann
.\wabilink-service share add ann Files C:\Users\Public --default      # the share the app opens first
.\wabilink-service share add ann Photos D:\Photos --read-only --description "Family photos"
.\wabilink-service share remove ann Photos

The server's access to the folders

The server reads and writes the folders as the account it runs as: wabilink on Linux, root on macOS, LocalSystem on Windows. On Linux, and wherever the server runs as an account of its own, that account needs to read each share's folder, and write where people upload.

sudo wabilink-server share check           # can it use every share's folder? exit 1 if not; --json for scripts
sudo wabilink-server share check ann
sudo wabilink-server share grant ann Files # give it what the share needs, and no more
sudo wabilink-server share grant --group support Manuals

• share grant gives the server's account search on the folders above the share, and read and write on it and in it (read only, for a read-only share). --grant-access on share add does the same.
• A folder inside a person's home, or a hidden one, is granted only with its path typed out: --confirm-path PATH.
• Where the server's account cannot be found by itself: --account NAME.
• By hand on Linux: sudo setfacl -R -m u:wabilink:rwX,d:u:wabilink:rwX /path. On macOS, a share in Documents, Desktop or Downloads needs Full Disk Access for /usr/local/wabilink-server/wabilink-server (System Settings → Privacy & Security).
• System folders (/, /etc, C:\Windows and the like) are refused as shares unless shares-allow-system-folders is yes.

Tunnels

A TCP service on this machine or near it, reached by the people you allow through a local port of theirs. Tunnels are made here only; Server settings, in the app, give them to people.

sudo wabilink-server tunnel presets                  # the common services on this machine, with their ports
sudo wabilink-server tunnel add ssh ssh              # this machine's SSH, as the tunnel "ssh"
sudo wabilink-server tunnel add nas-web 192.168.1.20:443 --description "The NAS's web page"
sudo wabilink-server tunnel list
sudo wabilink-server user tunnel ann nas-web yes
sudo wabilink-server tunnel remove nas-web

Then, on someone's computer: wabilink tunnel -p work nas-web --local-port 8443, or the app's Tunnels. A tunnel hands over the port itself: for a database, a database connection keeps its password on the server and holds each person to a level.

Databases

PostgreSQL and MySQL (and MariaDB), opened by the server for the people you give a connection to. The database's address and password stay on the server. Connections are made on this machine only.

sudo wabilink-server db add reporting postgres db.internal:5432 --user wabilink_reporting --database reporting
                                                         # asks for the account's password
sudo wabilink-server db add shop mysql /run/mysqld/mysqld.sock --user wabilink_shop --database shop
sudo wabilink-server db test reporting                   # logs in as people's sessions will: version, TLS, what the account may do
sudo wabilink-server db list
sudo wabilink-server db password reporting               # a new password for the account
sudo wabilink-server db remove shop

Giving it to people

sudo wabilink-server user db ann reporting read                # may query it
sudo wabilink-server user db bob reporting write --export yes  # and change rows, and export them
sudo wabilink-server user db ann reporting none                # taken away

--export yes lets rows out whole (export, dump); --import yes lets them in whole (a CSV import with write, a restore with schema). Give the connection's account no more than the most anyone should do: the database holds every session to that account's rights too.

A connection's options

sudo wabilink-server db set reporting --tls verify-full --ca /etc/ssl/db-ca.pem
sudo wabilink-server db set reporting --databases sales,stats   # other databases sessions may move to; * for all
sudo wabilink-server db set reporting --max-rows 50000 --timeout 120 --log-text yes

0 for a limit is its default.

Settings

The server's own settings, and those of its parts.

sudo wabilink-server config show            # all of them, as they are now; --json for scripts
sudo wabilink-server config set terminals-enabled yes
sudo wabilink-server config set max-sessions-per-user 5

this machine only: Server settings, in the app, show it and cannot change it, so that an administrator elsewhere cannot turn off a protection of the machine and of the person at it.

Modules

The server's parts: files, terminals, tunnels, desktop and databases. Each is on unless turned off here.

sudo wabilink-server module list
sudo wabilink-server module off tunnels   # refused from the next login, and taken from sessions open
sudo wabilink-server module on tunnels    # offered again from the next login

A part turned off is gone from the apps altogether, whatever rights people have: on a server that should never offer it, turn it off rather than giving it to nobody.

The desktop

This machine's own screen, seen and used from the app, inside the WabiLink session.

sudo wabilink-server config set desktop-enabled yes
sudo wabilink-server user desktop ann yes

On Windows that is all. On macOS the server also needs Screen & System Audio Recording and Accessibility in System Settings → Privacy & Security. On Linux a desktop agent runs in each session (the packages and the install script set it up), and GNOME on Wayland or any X11 session is shown.

Linux: after a restart, and with no monitor Linux, GNOME

sudo wabilink-server desktop-setup ann --login   # ann logged in at boot on the machine's screen, locked at once
sudo wabilink-server desktop-setup ann           # or: ann's own session at boot, on a virtual monitor, locked
sudo wabilink-server desktop-setup --off         # either, stopped, and not at boot
sudo wabilink-server user desktop-login ann yes  # or a login screen of its own for each viewer (GDM 46 and later)
sudo wabilink-server login-probe                 # whether this machine can show one

These are for Linux; switch to Linux and macOS above to see them.

Checking, on Linux: desktop-check in a desktop session opens it as the agent would and takes one picture; sudo wabilink-server console-probe says whether the machine's screen can be read for its login and lock screens. To turn the console helper off, with anyone connected cut off within a second: sudo mkdir -p /etc/wabilink && sudo touch /etc/wabilink/console.disabled; the login helper, likewise, with /etc/wabilink/login.disabled.

WabiOne

Registered with WabiOne, the server is managed in WabiOne's console: its people, shares and every setting, and people sign in with their WabiOne account. The console's Servers → Add server gives the code, good once for 15 minutes.

sudo wabilink-server register K7M2-QX9P-4HRT --name build-box   # its name in the console; else the host name
sudo wabilink-server home                                       # registered, with whom, managed, connected? --json for scripts
sudo wabilink-server unregister                                 # forgotten: the server's own settings are back

From a release script or a CI pipeline, with no code to copy: an API token that may Register servers, made by an admin of the organization in the console's API tokens. It registers any number of servers until it expires (after 30 to 365 days, or never) or is revoked there. It goes on standard input, never on the command line, where every account on the machine could read it. Registered already, the server is left as it is: registering again would drop what the console set.

sudo wabilink-server home >/dev/null || printf '%s\n' "$WABIONE_REGISTRATION_TOKEN" | sudo wabilink-server register --token-stdin

.\wabilink-service home *> $null
if ($LASTEXITCODE -ne 0) { $env:WABIONE_REGISTRATION_TOKEN | .\wabilink-service register --token-stdin }

The token is a secret of the pipeline's, given to the step as an environment variable: in GitHub Actions, env: WABIONE_REGISTRATION_TOKEN: ${{ secrets.WABIONE_REGISTRATION_TOKEN }}. A token WabiOne refuses - revoked or expired - fails with exit 1, saying so. On AWS, the first-boot scripts do all of this, the token read from Parameter Store.

• Nothing changes on registering: the server's settings become WabiOne's first version, and the server's own accounts keep their passwords. Unregistering, or being removed in the console, brings back the settings it had before it registered.
• It dials home and keeps the connection open, proving itself with its identity key; WabiOne can send it settings over it, and nothing else: it cannot run anything on the server.
• No restart: the running server takes a registration up within seconds.
• Another WabiOne: --home https://wabione.example.com.

Behind a router

The apps connect straight to the server where they can. Where they can't, a rendezvous introduces them, and both connect to each other through the routers (hole punching), with no port forwarded and no traffic through the rendezvous.

Registered with WabiOne, the server uses WabiOne's rendezvous, with nothing to set. Otherwise, with a rendezvous of your own:

sudo wabilink-server config set rendezvous-url https://rv.example.com:8443   # none takes it away
sudo wabilink-server home                                                   # the rendezvous, and whether it is connected

The server needs UDP 3478 out to the rendezvous. Some networks (some mobile and carrier networks) let no punch through: from those, forward TCP 8009 on the router to the server, or use a VPN.

Waking it

Let the app wake this machine from sleep (Wake-on-LAN), for good: its wired network cards' waking turned on, and kept on.

sudo wabilink-server wake-setup
sudo wabilink-server wake-setup --status   # say how it is, change nothing
sudo wabilink-server wake-setup --off

Updates

A server updates itself: each night, between 03:00 and 05:00 its own time, it installs a newer version if there is one. The service restarts, so anyone connected is dropped for a few seconds and their app connects again.

sudo wabilink-server update --check             # this version, the newest, and how this server is updated
sudo wabilink-server update                     # install the newest now
sudo wabilink-server config set auto-update no  # never by itself; update still installs it

• Nothing is installed that WabiLink's key did not sign: the server carries the key, and checks the signature of the site's list of downloads before it uses it, and each download against that list.
• Linux: a timer of the system's, wabilink-update.timer, runs it as root, through dnf or apt for the packages. macOS: a launchd job, com.wabilink.update; its log is /Library/Logs/WabiLink/update.log.
• A server installed by hand, from an archive or a zip, says in its log that a newer version is out, and is updated by hand.

The service

Installed as the guides say, the server runs as a service that starts at boot.

systemctl status wabilink
sudo systemctl restart wabilink           # for the ports, and max-connections-per-session
journalctl -u wabilink -f                 # its log

sudo launchctl print system/com.wabilink.server | grep state
sudo launchctl kickstart -k system/com.wabilink.server   # restart it
tail -f /Library/Logs/WabiLink/server.log

.\wabilink-service status
.\wabilink-service restart                # for the ports, and max-connections-per-session
.\wabilink-service stop
.\wabilink-service start

& '.\wabilink-setup-1.1.29-windows.exe' --quiet | Out-Host                     # install, or update what is installed
& '.\wabilink-setup-1.1.29-windows.exe' --quiet --account service | Out-Host   # as NT SERVICE\WabiLink
'P@ssw0rd' | & '.\wabilink-setup-1.1.29-windows.exe' --quiet --account alex --password-stdin | Out-Host
& 'C:\Program Files\WabiLink\WabiLink Setup.exe' --uninstall --quiet | Out-Host   # --delete-data: its users, settings and identity too

In a terminal instead

sudo wabilink-server run --port 9009 --admin-port 9010 -v

Until stopped, to try settings before installing it, with the service stopped (only one can hold the ports). While it runs, type status, sessions, disconnect ID or disconnect USER, and stop. --no-admin opens no admin port at all; --data-dir DIR runs it on another data folder.

Its identity and files

sudo wabilink-server identity   # the fingerprint the apps check
sudo wabilink-server paths      # where the data, identity and logs are
sudo wabilink-server version

The data folder holds the accounts, the settings and the identity key: keep it in your backups. A server reinstalled without it has a new identity, which every app is then asked to accept again.

In the app's Server settings only

A few things have no command here, and are set in the WabiLink app (This PC's server, on this machine; or Server settings, from your desk, on port 8010):

• making groups, and their shares;
• speed limits, for the server and for each account;
• quotas of private shares;
• IP filters: from where each account may log in;
• the mail server the server sends its mail through.