cloudtaser-cli demo serve

Runs the demo orchestrator HTTP server on loopback. Manages visitor sessions, executes demo steps via 'demo run --step N' subprocesses, and streams events to the browser via Server-Sent Events.

The hosted demo server requires Linux for safe subprocess-group cancellation and joining. Other CLI commands support macOS and Linux.

API endpoints: GET /api/demo/state — session state snapshot POST /api/demo/claim — claim the driver session POST /api/demo/release — release session, trigger reset POST /api/demo/next — advance to next step GET /api/demo/events — SSE stream (all channels) GET /api/demo/stream — SSE per channel (?channel=cluster|beacon|vault) POST /api/demo/probe — run a probe (?id=) GET /api/demo/probes — probe descriptor list GET /api/demo/manifest — step manifest POST /api/demo/dispatch-step — dispatch a step with args POST /api/demo/admin/release — unconditional session release (CI self-heal) GET /healthz — liveness (always 200 unless process is dead) GET /readyz — readiness (200 only when upstream deps are fresh; 503 + failed-deps JSON otherwise)

Listens on 0.0.0.0 by default — GCP HTTPS LB terminates TLS.

Usage

cloudtaser-cli demo serve [flags]

Examples

# Default (HTTPS): use https:// endpoints — no additional flags needed.
  cloudtaser-cli demo serve \
    --vm3-relay https://192.0.2.11:8443 \
    --beacon-relay https://192.0.2.10:8443/stream

  # VPC-internal HTTP: when both endpoints are on the same private VPC
  # (no external exposure), pass the explicit --*-relay-insecure flags.
  cloudtaser-cli demo serve \
    --vm3-relay http://192.0.2.11:8300 --vm3-relay-insecure \
    --beacon-relay http://192.0.2.10:8301/stream --beacon-relay-insecure

  # Env-driven (production OS Config systemd unit uses this form):
  DEMO_VM3_RELAY_ADDR=http://192.0.2.11:8300 \
  DEMO_BEACON_RELAY_ADDR=http://192.0.2.10:8301/stream \
    cloudtaser-cli demo serve --port 8080 --vm3-relay-insecure --beacon-relay-insecure

Flags

Flag	Type	Default	Required	Description
--admin-token	string	(empty)	no	bearer token required for POST /api/demo/admin/* endpoints (falls back to DEMO_ADMIN_TOKEN env)
--beacon-log	string	/var/log/cloudtaser-beacon.log	no	path to beacon log file for SSE streaming (legacy fallback; --beacon-relay is required)
--beacon-relay	string	(empty)	no	beacon-log-relay SSE URL, e.g. https://192.0.2.10:8443/stream (required; falls back to DEMO_BEACON_RELAY_ADDR env). No default — preflight refuses to start without an explicit endpoint.
--beacon-relay-insecure	bool	false	no	allow http:// scheme for --beacon-relay (VPC-internal only; default false)
--bind-addr	string	0.0.0.0	no	IP address to bind the HTTP listener to (default: all interfaces)
--chart-version	string	(empty)	no	helm chart version to pass to demo run subprocesses
--help, -h	bool	false	no	help for serve
--kubeconfig	string	(empty)	no	path to kubeconfig file
--port	int	7684	no	HTTP listen port
--pprof-addr	string	(empty)	no	enable pprof debug endpoint on this address (loopback only, e.g. 127.0.0.1:6060); disabled when empty
--secretstore-address	string	(empty)	no	secret store address for target migrate in step 6 (falls back to DEMO_VAULT_ADDR env)
--unprotected-admin	bool	false	no	allow startup without DEMO_ADMIN_TOKEN (local dev only; NEVER for production)
--vm3-relay	string	(empty)	no	Secret-store relay address (required; falls back to DEMO_VM3_RELAY_ADDR env). No default — preflight refuses to start without an explicit endpoint.
--vm3-relay-insecure	bool	false	no	allow http:// scheme for --vm3-relay (VPC-internal only; default false)
--vm3-relay-token	string	(empty)	no	bearer token for vm3-relay authentication (falls back to DEMO_VM3_RELAY_TOKEN env); required by vm3-relay v0.2.0+ on non-health endpoints

All commands