CLI reference

The two scripts kilasec hosts at short URLs on kilasec.com, meant to be piped into a shell on the collector host. Both are POSIX sh (no bashisms), safe to curl-to-shell, and expect to be run as root.

Every command exits non-zero on failure and prints a one-line reason.

install — enroll and start a collector

Downloads, enrolls, and starts the collector container.

curl -fsSL https://kilasec.com/install | sudo sh -s -- --enroll klsc_xxxxxxxx

What it does, in order:

0. If Docker is missing, installs it (apt or dnf). Interactive shells are asked first; curl-piped runs proceed automatically. Refuse with --no-install-docker.
1. POST /api/v1/collectors/enroll with the one-time code.
2. Receives a per-collector token + private GHCR credentials.
3. Writes /etc/kilasec/collector.env (mode 600, root-only).
4. Waits for the admin to click Approve in the dashboard (up to --approval-timeout seconds).
5. docker login → docker pull of ghcr.io/blox-24/kilasec-collector.
6. Installs kilasec-collector.service as a systemd unit and starts it.
7. Polls /api/v1/collectors/{id}/status until the cloud sees the first heartbeat.

Flags

Flag	Default	Description
--enroll <code>	required	One-time enrollment code from Collectors → Add collector. Codes are single-use with a short TTL.
--name <string>	hostname	Human label shown in the dashboard.
--cloud <url>	https://kilasec.com	Override the cloud endpoint (self-hosted / staging).
--diagnose	off	Run pre-flight checks and exit without enrolling. See below.
--install-docker	auto (yes when piped)	Force-install Docker via apt/dnf if it's missing.
--no-install-docker		Refuse to touch the package manager; fail if Docker isn't already present.
--approval-timeout <sec>	300	How long to wait for admin approval before giving up.
--help, -h		Print built-in usage.

Pre-flight — --diagnose

Read-only compatibility check: DNS, TLS to the cloud, Docker availability, and that ports 8080 / 9443 are free. Installs nothing, enrolls nothing — safe to hand to a customer before you send them an enrollment code.

curl -fsSL https://kilasec.com/install | sh -s -- --diagnose

Exits non-zero if any check fails, with a per-check [PASS] / [FAIL] line so the failure is obvious in the output.

uninstall — remove the collector from a host

Stops the service, removes the container, deletes the systemd unit, and (by default) clears the collector's state and config.

curl -fsSL https://kilasec.com/uninstall | sudo sh

Deleting a collector in the dashboard removes its cloud row and signals it to stop, but doesn't clean the host — this does. It also clears the /var/lib/kilasec/.shutdown sentinel that a dashboard-deleted collector leaves behind, so the host is ready for a clean re-enroll.

Safe to re-run. Does not touch cloud data — audit history lives in the cloud, not on the box.

Flags

Flag	Description
--keep-data	Remove the service + container but leave /var/lib/kilasec (the mitmproxy CA and audit tail) and /etc/kilasec (the token) in place. Use this when you're planning to reinstall on the same host without re-trusting the CA on every client device.
--help, -h	Print built-in usage.

What gets removed

Path	Removed by default?
kilasec-collector.service (systemd)	yes
kilasec-collector (container)	yes
/etc/kilasec/ (per-collector token)	yes — kept with --keep-data
/var/lib/kilasec/ (mitmproxy CA + audit tail + .shutdown sentinel)	yes — kept with --keep-data
GHCR image ghcr.io/blox-24/kilasec-collector:latest	no — remove manually with docker rmi

Exit codes

Both scripts follow the same convention:

Code	Meaning
0	Success.
1	Runtime failure (network, permission, container state). Reason printed to stderr.
2	Bad arguments, or uninstall invoked without root.