Appearance
theseus-node CLI
theseus-node runs on each server installed with an install command. It keeps one outbound HTTPS connection to the Theseus control plane and acts on the stack only through ./theseus. It never listens on a port.
| Command | What it does |
|---|---|
theseus-node uninstall [--keep-data] [--yes] | Take the stack down and remove theseus-node. See Uninstall |
theseus-node version | Print the version |
theseus-node enroll ... | Used by the install command; you do not run it yourself |
theseus-node run | What the systemd service runs |
There is no status command: use systemctl status theseus-node and the journal.
Service and files
| Item | Location |
|---|---|
| systemd service | theseus-node.service |
| Binary | /var/lib/theseus-node/bin/theseus-node (updated by the node itself; /usr/local/bin/theseus-node links to it) |
| Configuration and key | /etc/theseus-node/node.json, /etc/theseus-node/node.key |
| Job state | /etc/theseus-node/state/ |
| Control plane CA (private CA only) | /etc/theseus-node/control-ca.pem |
| Install progress | /var/lib/theseus-node/progress.log |
| Logs | journalctl -u theseus-node |
| Stack | /opt/theseus (default) |
What it can do
theseus-node accepts only a fixed list of jobs, each signed by the control plane and refused if the signature, the target, the time or the job id is wrong:
| Job | Runs |
|---|---|
install | Download and check the release, write theseus.env, ./theseus install --non-interactive |
apply_config | ./theseus config merge, modules enable/disable, config apply |
status, machines | ./theseus status --json, ./theseus agents --json |
restart | ./theseus restart <services> |
logs | ./theseus logs-tail <service> <lines> |
license | Write the signed licence to runtime/license/license.json |
uninstall | theseus-node uninstall |
node_update | Download a new theseus-node binary, check its SHA-256 and version, and replace itself (updates) |
breakglass_grant, breakglass_revoke | ./theseus support-access grant / revoke: a temporary support administrator; sent only while you allow provider support access |
There is no "run a command" job. Every 5 minutes it reports status and the agent list.
Updates
theseus-node keeps itself up to date: when your provider offers a newer version, it downloads the binary, checks its SHA-256 and that it runs, keeps the current one as theseus-node.prev, and restarts on the new one about 10 seconds later. Jobs already queued finish first.
The new version is on trial until it has run for a minute and reached the control plane. If it stops twice before that, or has not reached the control plane after 15 minutes, the previous version is put back and runs again. Avoid restarting the service twice in the minute after an update. To see what happened:
bash
journalctl -u theseus-node | grep 'node update'