admin.flexfs

Note

admin.flexfs is an Enterprise-only component. Community deployments use free.flexfs instead.

admin.flexfs is the central management server for flexFS Enterprise. It stores accounts, volumes, block stores, metadata stores, proxy groups, and volume tokens. Mount clients connect to it for volume settings and binary updates, and configure.flexfs uses its REST API to manage resources.

Persistent Flags

These flags apply to every subcommand.

Flag	Type	Default	Description	Visibility
--reportErrors	bool	false	Report errors and panics to Paradigm4. Governs what this server reports about itself only — to require reporting on mount clients, see --reportMountErrors below	Public

Subcommands

Subcommand	Description	Visibility
deinit creds	Remove the credentials file	Public
deinit systemd	Remove the systemd service unit	Public
init creds	Initialize the credentials file	Public
init systemd	Create and enable a systemd service unit	Public
license	Print license information	Public
start	Start the admin server	Public
version	Print the build version	Public

deinit creds

admin.flexfs deinit creds [flags]

Removes the credentials file for the admin server. If the credentials file is referenced by a systemd unit, the command refuses unless --force is passed, in which case it removes the references too.

Flag	Type	Default	Description	Visibility
--credsFile	string	~/.flexfs/admin/creds	Credentials file path	Public
--force	bool	false	Remove creds even if referenced by systemd (removes references too)	Public

deinit systemd

sudo admin.flexfs deinit systemd

Removes the systemd service unit (flexfs-admin.service) for the admin server. Requires root.

init creds

admin.flexfs init creds [flags]

Initializes a credentials file for the admin server. If --token is omitted, the command prompts for an admin server token interactively.

Flag	Type	Default	Description	Visibility
--credsFile	string	~/.flexfs/admin/creds	Credentials file path	Public
--force	bool	false	Overwrite existing credentials file	Public
--statAddr	string	stat.flexfs.io	Stat server address	Public
--token	string	""	Admin server auth token (will prompt if omitted)	Public

init systemd

sudo admin.flexfs init systemd [flags]

Creates and enables a systemd service unit (flexfs-admin.service) for the admin server. Requires root.

Flag	Type	Default	Description	Visibility
--force	bool	false	Overwrite existing systemd unit file	Public
--now	bool	false	Start the service immediately after enabling	Public
--startFlags	string	""	Additional flags to pass to the start command	Public

start

admin.flexfs start [flags]

Starts the admin server, binding the HTTPS management endpoint.

Flag	Type	Default	Description	Visibility
--accessFile	string	~/.flexfs/admin/access	API access file path — whitelists the source addresses allowed to reach each endpoint. Absent = all endpoints unrestricted	Public
--basicStats	bool	false	Relay only basic stats to the stat server	Public
--bindAddr	string	0.0.0.0:443	Address and port to bind	Public
--credsFile	string	~/.flexfs/admin/creds	Credentials file path	Public
--dbFolder	string	~/.flexfs/admin	Database folder path	Public
--deployFolder	string	~/.flexfs/admin/deploy	Folder for mount client deploy binaries	Public
--noSSL	bool	false	Disable SSL for the REST API	Public
--noStatSSL	bool	false	Disable SSL for stat server connections	Internal
--pprof	bool	false	Enable pprof profiler	Internal
--pprofPort	int	6060	Pprof server port	Internal
--reportMountErrors	bool	false	Require error reporting on the mount clients of every volume this server serves. The reporterrors flag is added to the volume settings the server hands out (see Accepted Volume and Token Flags). Independent of --reportErrors, which covers only this server’s own panics	Public
--sqliteOpts	string	_journal=WAL&_cache_size=10240&_fk=true&_timeout=5000	SQLite database connection options	Internal
--sslCert	string	~/.flexfs/ssl/cert	SSL certificate file path	Public
--sslKey	string	~/.flexfs/ssl/key	SSL private key file path	Public
--statAddr	string	""	Stat server address (overrides credentials file)	Internal
--token	string	""	Admin server auth token (overrides credentials file)	Internal
--verbose, -v	bool	false	Enable verbose logging	Public

API access control

--accessFile names a TOML file listing the IP addresses and CIDR blocks allowed to reach each endpoint. There is no file by default and nothing creates one, so every endpoint is unrestricted until you write it. It is re-read every two seconds, so a change takes effect within seconds without a restart; deleting it lifts all restrictions.

Most callers of this API are machines rather than people — mount clients fetch volume settings and rotate secret ids, the metadata server posts stats and reads rate bins, and the CSI driver provisions volumes. A rule written to fence off configure.flexfs gates those endpoints too unless they are opened back up, so read the global rule gates: line the server logs whenever it loads a file with a global list. The /deploy/ tree is the exception: its URLs are baked into published install commands, so it is reached only by a rule naming it explicitly — and one [endpoint."/deploy/"] rule covers the whole tree, the installer script included.

A file that cannot be parsed, or that names an endpoint this server does not serve, is refused: the server will not start on one, and a running server keeps the rules already in force. Blocked requests are answered 403 with the usual {"code":403,"text":"forbidden"} body.

See API Access Control for the file format and the rule precedence.

Deploy Endpoints

The admin server serves mount client binaries and an installer script for auto-update and client deployment:

Endpoint	Description
/deploy/install-mount.sh	Shell script that downloads and configures the mount client
/deploy/production/	Production channel mount client binaries
/deploy/staging/	Staging channel mount client binaries