Linux CLI
The firezone CLI can be used to control a running Linux GUI Client from the terminal.
It is automatically installed as part of the .deb and .rpm packages from version 1.5.18 and above.
Sign in as usual using the GUI Client's tray menu.
Once you are signed in, you can access your resource list using firezone resources and toggle the Internet Resource using firezone internet-resource enable|disable.
Non-interactive sign-in
The firezone CLI allows non-interactive sign-in and control of the tunnel.
To bring up the tunnel, run firezone connect.
It uses the token stored when you signed in through the GUI Client's tray menu and returns once the tunnel is up.
firezone disconnect takes the tunnel down and keeps the token.
firezone sign-out takes the tunnel down and also removes the token.
A service account token can be used to bring up the tunnel without signing in through the browser.
The token is read from standard input when piped, otherwise from the FIREZONE_TOKEN environment variable.
It is never read from the command line.
firezone connect < /path/to/token
The GUI Client stores the token, so later firezone connect reuses it.
Never put a token on the command line itself, for example by prefixing
firezone with FIREZONE_TOKEN=. Your shell writes the whole command to its
history file, where the token stays readable long after the session ends.
Service account tokens are long-lived, so treat one as you would a password.
For a machine with no desktop session at all, such as a server, use the Linux Headless Client, which signs in with a token and runs on its own.
Need help? See all support options.