Operations

Invites

One invite = one tenant. Revoking removes the tenant.

towonel invite create --name alice --hostnames '*.alice.example.eu'
towonel invite create --name bob   --hostnames 'app.bob.example.eu' --expires 48h
towonel invite list
towonel invite revoke --id <invite-id>

Default --expires is never.

Tenants

Tenants manage their own hostnames:

# from the agent side
towonel entry submit --op upsert-hostname --hostname new.alice.example.eu

Operator cleanup:

towonel tenant remove --tenant-id <hex>
# or, tenant-side
towonel tenant leave --key-path tenant.key --hub-url https://hub.example.eu:8443

Operator auth

export TOWONEL_HUB_URL=https://hub.example.eu:8443
export TOWONEL_OPERATOR_KEY=$(docker exec towonel cat /data/operator.key)

If the operator key is supplied via env (TOWONEL_HUB_OPERATOR_API_KEY), read it from your secret manager instead.

Backup

What needs to survive a restore depends on the database driver.

SQLite (default):

• /data — hub.db, node.key, operator.key, ACME cert cache.

Postgres:

• The Postgres cluster — pg_dump or barman-cloud. No /data to back up if every key comes from env.

Either way, these keys must be preserved:

• TOWONEL_HUB_KEK — encrypts the secrets table. Losing it loses the ability to decrypt secrets.
• TOWONEL_INVITE_HASH_KEY — losing it invalidates every outstanding invite.
• TOWONEL_IDENTITY_KEY (or /data/node.key) — the hub’s iroh identity. Losing it forces every edge and agent to re-trust the new hub.

Privileged ports

TCP/UDP listen ports below 1024 are blocked. Allow on the hub:

-e TOWONEL_HUB_ALLOW_PRIVILEGED_PORTS=true