CLI commands

atreoAGENT provides CLI subcommands for management and debugging. Run them inside the Docker container:

docker exec atreoagent atreoagent <command>

Commands

run

Start the agent daemon. This is the default command used by the Docker entrypoint.

atreoagent run

Starts all subsystems: WireGuard, proxy, forward auth, notification API, tunnel client, and the maintenance loop.

pair

Manually initiate device pairing with atreoLINK. Normally run does this automatically on first start; you’d only invoke pair directly if you need to re-pair after rotating the data volume.

atreoagent pair --atreolink-url https://api.atreolink.com

Flag	Default	Description
--atreolink-url	https://api.atreolink.com	Override the atreoLINK base URL (only useful for non-production environments).

After running, the command prints a one-time pair URL. Open it in a browser signed in to your atreoLINK account. See Pair your server for the full flow.

status

Show the current agent status and configuration.

atreoagent status

Output includes:

• Pairing status (paired / unpaired) and pinned owner fingerprint.
• Device ID and apps hostname.
• WireGuard interface (wg-atreo) status and peer count.
• Port mapping status (NAT-PMP / UPnP).
• Certificate expiration date.
• atreoLINK control channel state (connected / reconnecting).

apps

List all apps registered in the ACL.

atreoagent apps

Output includes:

• App name and slug.
• Internal URL the agent forwards to.
• Members with access.

Logs

Standard Docker log inspection works fine:

# Follow logs in real time
docker logs -f atreoagent

# Last 100 lines
docker logs --tail 100 atreoagent

# Filter for a specific subsystem
docker logs atreoagent 2>&1 | grep -i wireguard
docker logs atreoagent 2>&1 | grep -i proxy
docker logs atreoagent 2>&1 | grep -i cert
docker logs atreoagent 2>&1 | grep -i tunnel

The agent outputs one line per event.

Reading the notification API key

The current notification API key is stored at <DATA_DIR>/notify_api_key:

docker exec atreoagent cat /var/lib/atreoagent/notify_api_key

Use it as the bearer token when calling POST /v1/notify. Rotate it from the atreoLINK dashboard under your server’s Settings; see the Notification API overview.