Metadata-Version: 2.4
Name: veltro-cli
Version: 0.36.6
Summary: Operator CLI for the Veltro security operations suite (Compose + Helm).
Author: Veltro Security
License: AGPL-3.0-only
Project-URL: Homepage, https://github.com/veltrosecurity/veltro
Project-URL: Documentation, https://github.com/veltrosecurity/veltro#readme
Project-URL: Repository, https://github.com/veltrosecurity/veltro
Project-URL: Issues, https://github.com/veltrosecurity/veltro/issues
Keywords: veltro,security,soc,compose,helm
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: GNU Affero General Public License v3
Classifier: Operating System :: POSIX
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.10
Description-Content-Type: text/markdown

# veltro-cli

Stdlib-only operator CLI for the Veltro suite. Every Veltro release publishes
it at the release's version. Install a release with:

```sh
curl -fsSL https://raw.githubusercontent.com/veltrosecurity/veltro/vX.Y.Z/install.sh \
  | VELTRO_RELEASE=X.Y.Z sh -s -- --admin-email you@example.com
```

or `pip install veltro-cli==X.Y.Z` and `veltro install --suite-version X.Y.Z`.
Leave the version out to take the newest release.

While the repositories are private, GitHub answers 404 without a token. Export
`VELTRO_GITHUB_TOKEN` (`GITHUB_TOKEN` and `GH_TOKEN` work too) with a token
that can read `veltrosecurity/veltro`, and fetch the script with it:
`curl -fsSL -H "Authorization: Bearer $VELTRO_GITHUB_TOKEN" …`. `install`,
`upgrade` and `status` then read releases through the GitHub API, and the token
goes nowhere else. The images also need `docker login ghcr.io` with a
`read:packages` token.

`veltro install` asks for the first admin's email (`--admin-email` skips the
question and is required when there's no terminal). After the stack starts, the
admin's one-time sign-in link is in `veltro logs veltro`, on the line starting
`First admin`. For a locked-out admin, run
`veltro admin reset --email you@example.com` to print a fresh link
(`--dry-run` shows the Compose command it runs).

For an existing install with no bootstrap operator assignment, run
`veltro operator-assign --email you@example.com` with an enabled suite admin's
address. `--dry-run` checks email syntax and prints the Compose command. It doesn't
check whether the account exists, is enabled, or is an admin. Re-running prints the existing
operator's email without changing it. Identity delivers the assignment to
VectorFlow automatically and retries until ACK; `bootstrapOperator.status`
in the authenticated `GET /api/suite/peer-reads` response is `ready` when finished.
For Helm, use
`kubectl -n <namespace> exec deploy/<release>-veltro-identity-server -- node operator-assign --email you@example.com`.

Requires Python ≥ 3.10 and Docker Compose ≥ 2.20 on the host.
