CLI Reference

The rabtly command-line tool connects this device, checks status, and manages the daemon. Run rabtly with no arguments for the full command list, or rabtly <command> --help for detail on any one command.

Commands that create the VPN interface or change connection settings need root the first time (sudo). Once the system service is installed, the daemon runs as root in the background and everyday commands like rabtly status work without sudo.

Connecting

`rabtly up` (alias: `connect`)

Connect this device to your network.


sudo rabtly up --token enrt_...

Flag	Description
`--token <tok>`	Enrollment token (`enrt_...`) or personal access token (`rabtly_...`)
`--control <url>`	Control plane URL (default: `https://api.rabtly.cloud`) — set this for self-hosted servers
`--relay <host:port>`	Relay server for NAT fallback (default: `relay.rabtly.cloud:7777`)
`--name <name>`	Device display name (default: the system hostname)
`--group <name>`	Group to join on first enrollment (default: the `default` group)
`--advertise-routes <cidrs>`	Comma-separated subnets to route into the tunnel for peers, e.g. `192.168.1.0/24`. Pass `""` to stop advertising
`--state-dir <path>`	Directory for keys, config, and state

Settings you pass (name, relay, group, advertised routes) are saved to the daemon’s config, so a device running as a service keeps them across reboots.

`rabtly down` (alias: `disconnect`)

Stop the tunnel. The device stays registered and won’t auto-reconnect until you run rabtly up again.


sudo rabtly down

Status & diagnostics

`rabtly status`

Show connection state, your connectivity profile (direct vs. relay), and the peer table.


rabtly status            # one-shot
rabtly status --watch    # refresh continuously until Ctrl+C
rabtly status --json     # machine-readable

`rabtly ip`

Print this device’s VPN IP with no decoration — handy in scripts:


ssh user@$(rabtly ip)

`rabtly ping <peer>`

Ping a peer by name or VPN IP through the tunnel.


rabtly ping prod-server-01
rabtly ping 100.64.0.2

`rabtly doctor`

Diagnose common connectivity and setup problems — checks internet access, the control-plane connection, and the data plane, then points at the likely cause.


rabtly doctor

`rabtly logs`

Stream daemon logs.

Flag	Description
`--tail <n>`	Show the last `n` lines before following (default: 50)
`--since <dur>`	Show entries newer than `dur`, e.g. `10m`, `2h` (Linux)
`--no-follow`	Print and exit instead of following

Identity

`rabtly login` (alias: `auth login`)


rabtly login                          # interactive: browser, password, or token
rabtly login --method password
rabtly login --token rabtly_...       # sign in directly with a PAT
rabtly login --control https://vpn.example.com   # self-hosted server

Flag	Description
`--method <m>`	`browser` (default), `password`, or `token`
`--control <url>`	Control plane URL for self-hosted servers
`--token <pat>`	Authenticate directly with a personal access token (`rabtly_...`)

`rabtly logout` (alias: `auth logout`)

Delete local credentials. Does not affect the server or the running daemon.

`rabtly whoami` (alias: `auth whoami`)

Show the current identity, network, and session expiry. Add --json for machine-readable output.

`rabtly rename <new-name>`

Change this device’s MagicDNS name.


rabtly rename laptop-2

Devices

`rabtly devices` (alias: `device list`)

List all devices in your network.


rabtly devices
rabtly device list --json

Service management

`rabtly service <action>`

Manage the daemon as a system service (systemd on Linux, launchd on macOS, a Windows service on Windows). Root required for everything except status.


sudo rabtly service install     # register + start at boot
sudo rabtly service restart
rabtly service status

Actions: install, uninstall, start, stop, restart, status.

Updating & removing

`rabtly update` (aliases: `upgrade`, `self update`)

Self-update the CLI to the latest (or a pinned) version.


rabtly update
rabtly update --version 1.4.10

On Windows, Scoop owns the binary — rabtly update detects this and prints the scoop update steps instead of replacing the binary itself.

`rabtly version`

Print the CLI and daemon versions. Add --json for machine-readable output.

`rabtly uninstall` (alias: `self uninstall`)

Fully remove Rabtly from this machine — disconnects, removes the service, and deletes config, keys, and state. This is irreversible.


sudo rabtly uninstall          # asks for confirmation
sudo rabtly uninstall --yes    # skip the prompt

Shell completion

`rabtly completion <shell>`

Print a completion script for bash, zsh, fish, or powershell.


rabtly completion zsh > "${fpath[1]}/_rabtly"

Environment variables

Most settings have an environment-variable equivalent, useful for containers and automation. Common ones:

Variable	Equivalent of
`RABTLY_CONTROL_URL`	`--control`
`RABTLY_ENROLL_TOKEN`	`--token` (enrollment token)
`RABTLY_DEVICE_NAME`	`--name`
`RABTLY_RELAY_ADDR`	`--relay`
`RABTLY_GROUP`	`--group`
`RABTLY_ADVERTISE_ROUTES`	`--advertise-routes`

CLI Reference

Connecting

rabtly up (alias: connect)

rabtly down (alias: disconnect)

Status & diagnostics

rabtly status

rabtly ip

rabtly ping <peer>

rabtly doctor

rabtly logs