CLI reference

Every command of diffuse-coordinator, generated from the binary itself. If a page here disagrees with what your terminal prints, the page is a bug: a test regenerates all of this and fails on any difference.

`init`

Prepare the state directory and derive the enrolment CA from the deployment root CA

bash

diffuse-coordinator init --org "Klinik Beispiel" --host coordinator.internal

`serve`

Run the coordinator: mTLS gRPC listener plus the node registry

bash

diffuse-coordinator serve --config /etc/diffuse/coordinator.toml

`nodes`

List the nodes this coordinator currently sees

bash

diffuse-coordinator nodes

`token`

Create and manage join tokens

command	what it does
`token create`	Issue a join token and print the line to paste onto a machine
`token list`	List tokens by handle. Secrets are not stored and cannot be shown
`token revoke`	Revoke a token

`node`

Manage node identities

command	what it does
`node revoke`	Revoke a node identity: refuse it at every call and evict it now
`node list-revoked`	List revoked node identities

`apikey`

Create and manage API keys for the public inference endpoint

command	what it does
`apikey create`	Issue a key and print it. Shown once; only its hash is stored
`apikey list`	List keys by handle. Secrets are not stored and cannot be shown
`apikey revoke`	Revoke a key. Effective on the very next request
`apikey rotate`	Issue the next key in place of one, and put the old one on a clock

`identity`

command	what it does
`identity import`	Import people from a CSV file. Idempotent: run it again after a change
`identity list`	List the people this deployment knows
`identity disable`	Stop a gateway acting for somebody, keeping the trail that names them
`identity enable`	Let a gateway act for somebody again

`model`

Acquire, inspect and place models

command	what it does
`model import`	Ingest a model from a directory. The path for a coordinator with no internet route, which is most of them in a regulated deployment
`model pull`	Fetch a model: a name from the catalogue, or a repository on a hub
`model run`	Fetch a model and serve it: the two commands most people want as one
`model list`	List acquired models and their provenance
`model rm`	Remove a model and its index
`model serve`	Place a model on the nodes of a pool

`deployment`

Inspect and tear down deployments

command	what it does
`deployment list`	List deployments and their slices
`deployment rm`	Tear a deployment down

`audit`

Read the audit trail: who did what, when, and what was refused

bash

diffuse-coordinator audit --action inference --limit 3

`dataset`

Import and inspect training data. Customer data, declared not detected

command	what it does
`dataset import`	Ingest a file the coordinator can read
`dataset list`	List datasets and what they were declared as
`dataset rm`	Remove a dataset, unless a job or an adapter still points at it

`finetune`

Fine-tune a model on a file, in one command

bash

diffuse-coordinator finetune qwen2.5-3b berichte.jsonl

`job`

Start, watch and stop fine-tuning runs

command	what it does
`job create`	Start a LoRA fine-tuning run
`job list`	List runs, newest first
`job get`	One run in full, with the sentence explaining where it is
`job watch`	Follow a run until it ends, then say what to do with the result
`job cancel`	Ask a run to stop at the next step boundary, keeping its checkpoint

`adapter`

Inspect the adapters runs produced, with their provenance

command	what it does
`adapter list`	List adapters with the whole chain behind each one
`adapter export`	Write an adapter's own bytes somewhere you keep them
`adapter rm`	Remove an adapter

`eval`

Score a base model against a fine-tune on a suite

bash

diffuse-coordinator eval berichte-test --model qwen2.5-3b+berichte-v1

`distill`

Teach a small model what a large one knows: label, train, and score

bash

diffuse-coordinator distill --teacher qwen2.5-3b --student qwen2.5-0.5b-instruct --as berichte-klein berichte.jsonl

`licence`

What this deployment is entitled to, and until when

command	what it does
`licence show`	Show the licence this coordinator is running under
`licence set`	Install a licence file and bring the deployment up on it

`firewall`

The three ports this machine must expose, and the host firewall in front of them

command	what it does
`firewall status`	Which of the three ports are reachable from the network, and why
`firewall open`	Open the control plane, enrolment and the API in the host firewall
`firewall close-enrolment`	Close enrolment, once every machine has joined

bash

diffuse-coordinator login --endpoint https://coordinator.internal:7446

`logout`

End this session, here and on the coordinator

bash

diffuse-coordinator logout

`whoami`

Who this session belongs to, and what it may do

bash

diffuse-coordinator whoami

`password`

Change this account's own password

bash

diffuse-coordinator password

`account`

Human accounts: who may sign in, and as what

command	what it does
`account list`	List the accounts
`account create`	Create an account with a one-time password
`account role`	Change what somebody may do. Ends their sessions
`account disable`	Switch an account off, and revoke everything it is holding
`account enable`	Switch it back on
`account bootstrap`	Create the first account. Run on the coordinator host.
`account recover`	Reset a password when the identity provider is down and the password is lost. Run on the coordinator host, and audited like `bootstrap`

`session`

Who is signed in, from where, since when

command	what it does
`session list`	Who is signed in
`session revoke`	End somebody else's session, now

CLI reference ​

CLI reference