Cluster API

Cluster membership, mesh (Nebula), lighthouse, certificate, and node lifecycle operations. The routes are split across several router files under modules/cluster/ (ce module; ee overlays in modules/cluster/) and mounted on one chi sub-router by buildRouter in router.go.

Hand-maintained notes against modules/cluster/*_router.go (ce module). Route inventory (generated): routes.md. Response models (generated): response-models/cluster.md.

Method	Path	Source
POST	/api/method/shc.cluster.token	token_router.go
GET	/api/method/shc.cluster.status	nodes_router.go
GET	/api/method/shc.cluster.nodes	nodes_router.go
GET	/api/method/shc.node.ls	nodes_router.go
GET	/api/method/shc.node.status	nodes_router.go
GET	/api/method/shc.cluster.ping	admin_router.go
POST	/api/method/shc.cluster.repair	admin_router.go
DELETE	/api/method/shc.cluster.rm	admin_router.go
GET	/api/method/shc.cluster.logs	admin_router.go
POST	/api/method/shc.cluster.leave	lifecycle_router.go
POST	/api/method/shc.cluster.drain	lifecycle_router.go
POST	/api/method/shc.cluster.forget	lifecycle_router.go
POST	/api/method/shc.cluster.force_leader	lifecycle_router.go
GET	/api/method/shc.cluster.certs.list	certs_router.go
POST	/api/method/shc.cluster.certs.rotate	certs_router.go
POST	/api/method/shc.cluster.certs.rotate_now	certs_router.go
POST	/api/method/shc.cluster.mesh.enable	mesh_router.go
POST	/api/method/shc.cluster.mesh.disable	mesh_router.go
GET	/api/method/shc.cluster.mesh.status	mesh_router.go
GET	/api/method/shc.cluster.mesh.diagnose	mesh_router.go
POST	/api/method/shc.cluster.lighthouse.add	lighthouse_router.go
GET	/api/method/shc.cluster.lighthouse.ls	lighthouse_router.go
DELETE	/api/method/shc.cluster.lighthouse.rm	lighthouse_router.go

These run on the mTLS-or-LAN-token-secured internal listener, not the public API. Used for enrollment and peer certificate exchange.

Method	Path	Purpose	Source
POST	/internal/enroll	Node enrollment (join)	router.go
GET	/internal/certs/info	Cert info	certs_internal_router.go
POST	/internal/certs/install	Cert install	certs_internal_router.go
POST	/internal/certs/renew	Cert renew	certs_internal_router.go
POST	/internal/certs/rotate	Cert rotate	certs_internal_router.go

• summary: mint a cluster join token.

• summary: per-node TCP probe of every registered member.
• query params: node, count, timeout

• summary: sweep unreachable / stale members (tidy). --force (force_leader) is the destructive escalation when a removal would break quorum.
• body: { dry_run, verbose, yes } (all optional)

• summary: remove a node from the cluster.
• query params: node (required), force

• summary: tail a daemon log file.
• query params: service (required, bare filename), node, lines

enable / disable orchestrate Nebula across all nodes and return a MeshClusterResult (per-node rows + cluster-level success). status returns installed/running state per node; diagnose adds per-peer reachability probes.