Admin CLI (lindir-admin)

Thin Bearer-API client for day-to-day IdM and fleet tasks without hand-written curl.

For the browser UI (Vue 3 at /admin/), see Admin Web UI.

Build

cd cli && dub build --compiler=ldc2
# → cli/lindir-admin

Auth

export LINDIR_URL=https://id.example.com
export LINDIR_TOKEN=…   # bootstrap or API token (ldt_…)
# or: --url … --token …
# lab TLS: --insecure   custom CA: --ca-file /path/ca.pem

Command reference

health
ops attention
user list
user create --username NAME [--password P] [--email E] [--display-name N] [--admin]
user password --user-id ID --password P
user enable|disable --user-id ID
group list
group create --name NAME [--description D]
group add-member --group-id ID --user-id ID
group remove-member --group-id ID --user-id ID
group members --group-id ID
host list
host enroll --hostname NAME [--os-family F] [--os-pretty P] [--tag TAG]… [--skip-vpn]
enroll-token list
enroll-token create [--name N] [--ttl-hours H] [--max-uses N] [--hostname-hint H]
enroll-token revoke --id ID
account-policy get
account-policy set [--min-password-length N] [--password-max-age-days N]
                   [--lockout-threshold N] [--lockout-minutes N] [--require-change-on-create]
token list
token create --name NAME [--role admin]
oidc client list
oidc client create --name NAME --redirect-uri URI [--public]
passkey list --user-id ID
passkey revoke --id CREDENTIAL_ROW_ID
policy hbac list
policy hbac check --host-id ID [--group-id ID]…
vpn sync-acls
fleet labels [list]
fleet labels create --name NAME [--description D]
fleet labels assign --host-id ID --label-id ID
fleet labels unassign --host-id ID --label-id ID
fleet labels hosts --label-id ID
fleet inventory
fleet upgrades [--host-id ID]
fleet queries
fleet scripts
fleet runs
fleet sync-hbac
fleet packages list
fleet packages pending
fleet packages cancel --id JOB_ID
fleet packages install|remove|upgrade|refresh|reboot|update-client
    (--host-id ID | --label-id ID) [--package NAME]…
fleet energy list
fleet energy create --name NAME [--idle-action suspend] [--idle-delay-sec N]
    [--screen-blank-sec N] [--screen-off-sec N] [--lid-close suspend]
    [--lid-close-docked ignore]
fleet energy assign --policy-id ID (--host-id ID | --label-id ID)
fleet energy unassign --policy-id ID (--host-id ID | --label-id ID)
fleet energy delete --policy-id ID
fleet vulns list [--host-id ID]
fleet vulns scan
fleet vulns refresh [--force]
fleet vulns job
mdm compliance
mdm policies
mdm policy create --name NAME
mdm assign --policy-id ID (--host-id ID | --label-id ID)
mdm unassign --policy-id ID (--host-id ID | --label-id ID)
mdm targets --policy-id ID
mdm lock --host-id ID
mdm retire --host-id ID
audit [--actor A] [--action A] [--resource-type T] [--resource-id ID] [--since T] [--limit N]

Also: lindir-admin help.

Passkey registration needs a browser WebAuthn ceremony — use Admin Directory → Passkeys, or the API begin/finish flow. CLI covers list/revoke.

Examples

lindir-admin health
lindir-admin ops attention
lindir-admin user create --username alice --password '…' --email alice@example.com
lindir-admin user disable --user-id UUID
lindir-admin group create --name admins
lindir-admin group add-member --group-id UUID --user-id UUID
lindir-admin host enroll --hostname box1 --tag tag:lindir
lindir-admin host enroll --hostname box1 --skip-vpn   # already on Tailscale
lindir-admin enroll-token create --name lab --ttl-hours 24 --max-uses 1
lindir-admin account-policy get
lindir-admin account-policy set --min-password-length 12 --lockout-threshold 5
lindir-admin oidc client create --name grafana --redirect-uri 'https://grafana/…'
lindir-admin oidc client create --name spa --redirect-uri 'https://spa/cb' --public
lindir-admin vpn sync-acls
lindir-admin fleet packages list
lindir-admin fleet packages pending
lindir-admin fleet packages cancel --id JOB_UUID
lindir-admin fleet packages install --host-id UUID --package nginx
lindir-admin fleet packages install --label-id UUID --package curl
lindir-admin fleet packages reboot --host-id UUID
lindir-admin fleet packages update-client --host-id UUID
lindir-admin fleet upgrades --host-id UUID
lindir-admin fleet energy list
lindir-admin fleet energy create --name laptop --idle-action suspend --idle-delay-sec 1800
lindir-admin fleet energy assign --policy-id UUID --label-id UUID
lindir-admin fleet energy unassign --policy-id UUID --label-id UUID
lindir-admin fleet labels assign --host-id UUID --label-id UUID
lindir-admin fleet labels hosts --label-id UUID
lindir-admin group remove-member --group-id UUID --user-id UUID
lindir-admin policy hbac check --host-id UUID --group-id UUID
lindir-admin mdm assign --policy-id UUID --host-id UUID
lindir-admin mdm unassign --policy-id UUID --host-id UUID
lindir-admin passkey list --user-id UUID
lindir-admin fleet vulns refresh --force
lindir-admin fleet vulns scan
lindir-admin fleet vulns list
lindir-admin audit --action auth --since '2026-01-01 00:00:00'