corbie controller enrol <card | - | name> [--ceiling <list>] [--allow <entry>] [--deny <entry>] [--tags <list>] [--replace]
trust a runner or a client, and print what it needs to trust this controller
It takes a runner's or a client's card, writes to the store that the controller trusts it, and prints the controller's card and the store's address. corbie runner trust and corbie client trust take those two lines.
<card>the card, as corbie runner card or corbie client card prints it
-the card is read from standard input, so the commands join in a pipe
<name>a runner or client already enrolled: sets its ceiling or tags again
--ceiling <list>sets a client's ceiling, the most any run it starts may be allowed: entries separated by commas; none removes it; without the flag it stays as it is
--allow <entry>adds one entry to the client's ceiling; repeatable
--deny <entry>adds one permission the client's ceiling refuses, whatever it allows; repeatable
--tags <list>sets a runner's tags, separated by commas; a job's tags: selects a runner that has every one; none removes them; without the flag they stay as they are
--replaceaccept a card with another key under a name already enrolled; by default it is refused
A runner takes no ceiling here, and a client no tags. A runner sets its own ceiling with corbie runner trust.
- Served directory the three commands as one pipe
- Permissions the entries of a ceiling
Every command takes --json, --config and --store: see corbie --help.