shc init
initialize a new cluster
Reference for the init command (module modules/cluster). Source: modules/cluster/commands/init.go.
This is a single-action command (no subcommands). Init is pure
bootstrap: CA + node cert, swarm/runtime bring-up, daemon start,
vault unlock, then the system-app install pass. Provider/LB/connection
setup happens post-init (shc connection …).
| Flag | Type | Required | Help |
|---|---|---|---|
--name / -n | str | no | node name |
--runtime / -r | str | no | container runtime (compose, swarm, or podman) |
--nic | str | no | network interface for ALL cluster-internal traffic (swarm advertise, raft bind+advertise, node-row internal address, internal API bind, nebula underlay). Blank = auto-detect: deterministic name-sorted candidates, RFC1918/private preferred over public, default-route interface preferred within the class. |
--nebula | bool | no | bring the Nebula mesh overlay up after bootstrap (same path as shc cluster mesh enable) |
--acme-provider | str | no | name of a named ACME provider to define + set as the cluster default (acme.providers.<name> + acme.default) |
--acme-directory | str | no | ACME directory URL for --acme-provider (blank = Let’s Encrypt production; e.g. the LE staging URL) |
--acme-email | str | no | ACME contact email (the global acme.email fallback contact) |
--host | str | no | public host where Traefik fronts SHC’s apps |
--modules-config | str | no | system-app selection + per-app overrides as a compact JSON object keyed by app name, e.g. '{"keycloak":{"host":"auth.example.com"},"traefik":{}}'. The key set is the install selection (an empty object {} installs none); each value seeds system.apps.<name>.{host,base_path,vars.*} before the install pass. Unset falls back to the daemon’s SHC_MODULES default set. |
--public-address | str | no | public IP or stable public hostname internet traffic reaches this node at (recorded on the node row; managed DNS for internet exposure reads it) |
--yes / -y | bool | no | skip confirmation prompt |
--vault-password | str | no | set the vault master password non-interactively |
--vault-password-file | str | no | read the vault master password from a file (mode 0600 expected); use - to read from stdin. Takes precedence over --vault-password and SHC_VAULT_PASSWORD |
--force / -f | bool | no | wipe local cluster state and re-initialize even if this node is already clustered |
shc@docs:~$