Skip to content
SHC Docs

shc init

shc init

Section titled “shc init”

initialize a new cluster

Synopsis

Section titled “Synopsis”

Bootstrap a new cluster on this node: detect the container runtime (compose/swarm/podman), generate the cluster CA and node certificate, initialise Docker Swarm when applicable, enable and start the shc service, set the vault master password, and install the platform’s system apps. On a terminal an interactive wizard collects the settings; for scripted installs every step can instead come from flags (—vault-password-file, —yes). Providers and connections are configured after bootstrap (shc connection connect, shc config).

Re-running init on a bootstrapped node is safe: it resumes an unfinished system-app install and is a no-op when everything already completed; —force wipes local cluster state and re-initializes from scratch. Grow the cluster with shc node token here, then shc cluster join on the new node.

shc init [flags]

Examples

Section titled “Examples”
  shc init
  shc init --runtime swarm --vault-password-file /root/vault.pw --yes
  shc init --host cloud.example.com --acme-provider letsencrypt --acme-email ops@acme.com

Options

Section titled “Options”
      --acme-directory string            ACME directory URL for --acme-provider (blank = Let's Encrypt production; e.g. the LE staging URL)
      --acme-email string                ACME contact email (the global acme.email fallback contact)
      --acme-provider string             name of a named ACME provider to define + set as the cluster default (acme.providers.<name> + acme.default)
      --fabric string                    cluster-scoped cross-node data plane: swarm (docker overlay, today's model), shc (routed WireGuard fabric; excludes the swarm runtime), none (single node). Unset preserves today's behavior
      --fabric-cidr string               supernet the shc fabric carves node /24 subnets from (default 10.84.0.0/16); only with --fabric shc — pick one that avoids k3s/docker ranges on shared hosts, renumbering later re-renders the whole cluster
  -f, --force                            wipe local cluster state and re-initialize even if this node is already clustered
  -h, --help                             help for init
      --host string                      public host where Traefik fronts SHC's apps
      --modules-config string            system-app selection + per-app overrides as a compact JSON object keyed by app name, e.g. '{"keycloak":{"host":"auth.example.com"},"traefik":{}}'. The key set is the install selection (an empty object '{}' installs none); each value seeds system.apps.<name>.{host,base_path,vars.*} before the install pass. Unset falls back to the daemon's SHC_MODULES default set.
  -n, --name string                      node name
      --nebula shc cluster mesh enable   bring the Nebula mesh overlay up after bootstrap (same path as shc cluster mesh enable)
      --nic string                       network interface for all cluster-internal traffic (swarm advertise, raft, internal API, nebula underlay); blank = auto-detect (private-preferred)
      --public-address string            public IP or stable public hostname internet traffic reaches this node at (recorded on the node row; managed DNS for internet exposure reads it)
  -r, --runtime string                   container runtime (compose|swarm|podman)
      --vault-password string            set the vault master password non-interactively
      --vault-password-file string       read the vault master password from a file (mode 0600 expected); use '-' to read from stdin. Takes precedence over --vault-password and SHC_VAULT_PASSWORD
  -y, --yes                              skip confirmation prompt

Options inherited from parent commands

Section titled “Options inherited from parent commands”
      --config stringArray   extra YAML config file to layer on top of auto-discovered config; repeatable, later files win
  -d, --debug                enable debug mode (default: $SHC_DEBUG)
  -e, --environment string   environment name (default: $SHC_ENVIRONMENT)
      --exclude string       comma-separated dotted paths to drop
      --fields string        comma-separated columns/keys to show (and their order)
      --filter string        comma-separated dotted paths to keep (drops everything else)
  -o, --output string        output format: tty|text|json|yaml (default: $SHC_OUTPUT)
  -s, --stack string         stack name (default: $SHC_STACK)
  -t, --tenant string        tenant name (default: $SHC_TENANT)
  -v, --verbose              verbose output (default: $SHC_VERBOSE)

SEE ALSO

Section titled “SEE ALSO”
  • shc - Selfhosted Cloud CLI