CLI and scripts

Operators do most things through the MSSP UI or the REST API. The CLI surface is small and exists for bootstrap, dev environments, and offline operations.

In-pod entry points

These run inside soctalk-system-api (or a one-shot Job). They use the pod's mounted Postgres credentials and chart config, no external state.

Bootstrap

There is no separate bootstrap CLI in this release, the chart's API pod init command runs the bootstrap inline (migrations, role passwords, organization row, optional admin user). See Install, Migrations and bootstrap.

LLM smoke test

There is no soctalk.llm.smoke_test CLI in this release. To sanity-check that a configured LLM is reachable, see LLM providers, Sanity test for the one-liner Python expression.

soctalk-auth (in-pod helper)

The only first-class CLI helper in this release. Single subcommand: set-password.

kubectl -n soctalk-system exec -it deploy/soctalk-system-api -- \
  soctalk-auth set-password user@example.com

Prompts for a new password (or reads from SOCTALK_PASSWORD), looks up the user, sets the hashed password, and audits auth.password.reset.admin. Useful for forced resets without going through the API. The user row must already exist; soctalk-auth does not create rows.

soctalk (orchestrator entry point)

soctalk is the orchestrator entry point, runs the LangGraph supervisor + workers. In V1 the API pod embeds the orchestrator (no separate soctalk-system-orchestrator Deployment). Not typically invoked by hand outside of dev.

No general-purpose soctalk-cli yet

The earlier draft of this page listed tenant management commands under a soctalk-cli binary that does not exist in the current release. Tenant actions (suspend, resume, decommission, rotate-admin) today go through the REST API. The CLI surface for tenant operations is tracked for a future release.

Repo-side: justfile recipes

justfile in the repo root has recipes used during development and release:

Recipe	What it does
just build-api	Build the API container image
just build-orchestrator	Build the orchestrator container image
just build-frontend	Build the SvelteKit frontend container image
just build-mock-endpoint	Build the mock endpoint sim image
just run	Run the dev stack via docker-compose
just push-all	Push all images to the configured registry
just release	Build and push all images (build-all + push-all). The versioned chart publish, git tag, and GitHub Release are cut separately by the Cut k8s Release GitHub Action, not by this recipe.

Repo-side: scripts/

Script	Purpose
scripts/dev-up.sh	Bring up a single-node k3d dev cluster with SocTalk and a seeded tenant
scripts/local-up.sh	Same, but on the host's k3s instead of k3d
scripts/local-down.sh	Tear down a local-up.sh cluster
scripts/e2e-l1-l2-k3d.sh	Two-cluster k3d setup (MSSP L1 + tenant L2) for full e2e validation
scripts/seed-mssp-demo-data.py	Populate Postgres with fixture tenants (acme-corp, wayne-industries, stark-defense) and replay Wazuh alerts via the indexer for screenshot prep
scripts/dump_openapi.py	Dump the FastAPI OpenAPI schema to JSON; the source of truth the docs REST API reference is generated from
scripts/verify-pages-visual.py	Playwright visual regression check against the dev SocTalk UI

These all expect to run from the repo root. Read the script header for the exact arguments.

Repo-side: Packer

For VM image builds, see Downloads → Build it yourself.

Air-gapped operations

For installs without internet access, the API + soctalk-auth are sufficient to run SocTalk without touching the UI:

# Bootstrap happens automatically in the API pod's init command — no
# extra step. Just install the chart with install.bootstrapAdmin.* set.

# Or, if those weren't supplied, set the admin password after install:
kubectl -n soctalk-system exec deploy/soctalk-system-api -- \
  soctalk-auth set-password admin@example
# Read the admin credentials.
kubectl -n soctalk-system get secret soctalk-system-bootstrap-admin \
  -o jsonpath='{.data.password}' | base64 -d; echo

# Onboard a tenant via the API.
curl -k -c jar -X POST http://soctalk-system-api:8000/api/auth/login \
  -d '{"email":"admin@example","password":"..."}'
curl -k -b jar -X POST http://soctalk-system-api:8000/api/mssp/tenants/onboard \
  -d '{"slug":"acme","display_name":"Acme","profile":"persistent"}'

For the bootstrap admin's existing password the bootstrap Job emits, see Install → Migrations and bootstrap.

Source pointers

Concept	File
Bootstrap (inline)	charts/soctalk-system/templates/30-api.yaml (init command)
LLM provider factory	src/soctalk/llm.py
soctalk-auth source	src/soctalk/core/cli/auth.py
soctalk orchestrator entry	src/soctalk/main.py
justfile	justfile
scripts/	scripts/