CLI configuration¶
Flags win over environment variables. Omitted flags are not serialized as defaults (argparse.SUPPRESS).
Globals¶
| Flag | Environment | Role |
|---|---|---|
--url |
EVE_IAC_URL |
HTTPS eve-iac-agent URL |
--token |
EVE_IAC_TOKEN |
Bearer token |
--ca-file |
EVE_IAC_CA_FILE |
Pinned CA certificate file |
--ca-pem |
EVE_IAC_CA_PEM |
Pinned CA PEM text |
--username |
EVE_IAC_USERNAME |
Login only |
--password |
EVE_IAC_PASSWORD |
Login only (prefer the env var in CI) |
--json |
SDK result JSON on stdout | |
--yes |
Confirm destroy / prune / replace / wipe | |
--timeout-ms |
Override the operation timeout | |
--insecure |
(none) | Skip TLS certificate verification (lab/dev only; never the default) |
--version prints the package version (X.Y.Z, currently 0.4.3).
Precedence¶
- CLI flag if present
- Environment variable
- Empty / omitted
CA: if --ca-file / EVE_IAC_CA_FILE is set, that file is read. Otherwise --ca-pem / EVE_IAC_CA_PEM. --insecure skips verification and the fingerprint pin; HTTPS is still required. There is no TOFU, no SecretStorage, and no EVE_IAC_INSECURE environment variable. Repeat --insecure on every command that needs it.
Pin a CA (normal / CI)¶
On the EVE host:
sudo openssl x509 -in /opt/unetlab/addons/eve-iac-agent/tls.crt -outform PEM
Copy the PEM to the runner or laptop, then:
export EVE_IAC_URL=https://eve.example:8787
export EVE_IAC_CA_FILE=./eve-iac-ca.pem
Non-interactive login¶
export EVE_IAC_URL=https://eve.example:8787
export EVE_IAC_CA_FILE=./eve-iac-ca.pem
export EVE_IAC_USERNAME=admin
export EVE_IAC_PASSWORD
eve-iac login --json
Human login omits the token on stdout. --json emits LoginData including token. Store that token as EVE_IAC_TOKEN for later commands. Do not print tokens in CI logs.
export EVE_IAC_TOKEN
eve-iac session
Lab/dev without a saved PEM (not for CI):
export EVE_IAC_URL=https://192.168.48.112:8787
eve-iac --insecure health
eve-iac --insecure --username admin --password "$EVE_IAC_PASSWORD" --json login
Project commands take a lab directory that contains .eve-iac.yml, plus optional --lab to override eve.lab (must start with /).
Large labs: deploy / import / reconcile default to a 300s semantics timeout; pass --timeout-ms if the ZIP import needs longer. exec start|stop|wipe return after the bulk batch is accepted.
If deploy reports lab_exists, use plan then reconcile. Recreate only with deploy --replace --yes.
Full tables: CLI reference. Security: CLI security.