Config lives at ~/.config/seikan/config.json (override with SEIKAN_CONFIG), storing the server, admin API key, and a per-tunnel connect-token cache.
| Command | Description |
|---|---|
init |
Save server + admin API key locally. Flags: --server <host|url>, --api-key <sk_…> (both prompted if omitted), --tunnel-port (7000), --insecure. Verifies the key against the server before saving. |
serve <domain[,…]> <port> |
Create/resolve an HTTP frontend, wait for its cert, and tunnel <domain> → local <port> (or host:port). The domain argument may be a comma-separated list, and entries may be wildcards (*.example.com). |
serve --tcp <port> |
TCP frontend (server auto-assigns a public port, printed on connect). --name <key> caches it (default tcp:<target>). |
list |
List configured frontends (type, public endpoint, online, cert status). |
rm <domain|id> |
Delete a frontend and clear its cached token. |
tunnels add |
Declare a tunnel in the config for start: tunnels add <domain> <port> or tunnels add --tcp <port> [--name X]. |
tunnels list / tunnels rm <key> |
List declared tunnels / remove one (the server-side frontend is left intact). |
start [keys…] |
Run all (or named) declared tunnels in a single process, each with its own auto-reconnect. Ideal as the target of an OS service. |
exec-install [--bin D] |
Copy this binary onto your PATH (--bin <dir>, else $SEIKAN_BIN_DIR, /usr/local/bin, ~/.local/bin). The self-install convention the install.sh bootstrap invokes; the binary installs itself under its own filename (install is an accepted alias). |
exec-uninstall [--yes] |
Remove this binary from PATH (the matching convention; --yes skips the prompt). |
uninstall [--purge] |
Remove the per-user background service. --purge also removes the saved config (~/.config/seikan) and this binary. |
configure |
Open the config (~/.config/seikan/config.json) in $EDITOR; on save, restart the background service if one is installed. |
service install|uninstall|status |
Run start as a per-user background service (no root): a systemctl --user unit on Linux, a launchd LaunchAgent on macOS — autostart + crash recovery, pinned to the installed config. Linux: sudo loginctl enable-linger $USER to survive logout. |
apikey create |
Root only. Issue a sub-token (optional --label); prints the key once + an init one-liner for the tenant. |
apikey list |
Root only. List API keys with id, role, label, created and last-used. |
apikey rm <id> |
Root only. Revoke a sub-token — also deletes that tenant's frontends and closes their tunnels. |
connect |
Low-level raw tunnel, no config/admin API: --server <host:port> --token <sk_t_…> --target <host:port>. |
version / help |
Print version / show help. |
Common flags
| Flag | Env | Meaning |
|---|---|---|
--insecure |
SEIKAN_INSECURE |
Skip server TLS verification (dev / staging certs). |
--verbose, -v |
SEIKAN_VERBOSE |
Log each request (method, path, status, timing) — one line per request, even when keep-alive packs many requests onto a single stream. The server access log is also authoritative per request. |
--recreate |
— | serve only: delete + recreate the frontend if it already exists. |
Note: Reconnect —
serve/connectreconnect automatically with backoff if the tunnel drops (e.g. after a server update) and recover within ~1s. A rejected token exits immediately. Ctrl-C stops cleanly.