shc · arch

Run it on the node, or reach it over the network

The daemon's local door is a unix socket — a file on the node's own disk. A file has no IP and no port, so nothing off the box can dial it. That single fact, not a policy setting, is why running shc on the node is admin with no login, and why running it from your laptop starts at 401.

simulated · mirrors internal/core/api/server.go + internal/core/daemonclient/client.go

I am running shc
Network diagram: the shc local socket versus the remote HTTP door A dashed boundary marks one node. Inside it sit the shc CLI, the unix socket at /run/shc/shc.sock, and the shcd daemon; the local path runs entirely inside the boundary and never touches the network. Outside the boundary a laptop has no route to the socket, so its only way in is one TCP hop that crosses the boundary into the daemon's HTTP listener on port 8000, which requires a Keycloak bearer token. A third listener, the internal peer API on port 4003 over mTLS, is reachable only by other cluster nodes and by neither client. Inside the box: the socket is right there. Admin, no token. NODE · ONE MACHINE OFF-BOX · THE NETWORK no route to the socket: it is a file, not an address. nothing to dial, nothing to firewall, nothing to leak. shc on my laptop endpoint: https:// context sends Authorization: Bearer shc on the node endpoint: the socket sends no auth header /run/shc/shc.sock 0660 root:shc the wall's only opening one TCP hop over the network shcd the daemon · one process local door · unix socket caller is admin, always no Authorization header remote door · 0.0.0.0:8000 Keycloak bearer required no /internal/* served here THE THIRD LISTENER internal peer API · :4003 · mTLS other cluster nodes only neither door above can drive it shcd another cluster node OTHER CLUSTER NODES they dial :4003 with a cluster-CA client cert
the same work, from each side

One state that cannot exist. An explicit SHC_URL beats a ctx login'd cluster in the resolver and deliberately replays no auth header — so "SHC_URL set plus a logged-in bearer" never happens, and the diagram never draws it.

internal/core/api/server.go internal/core/api/auth.go internal/core/daemonclient/client.go docs →