Nodes

Enroll a worker on the WireGuard mesh with no address of its own (ADR 055)

Changed on

The worker sends its WireGuard public key with a join token; the control plane reserves it a mesh address and answers with what it needs to dial the control plane and register over the mesh node API.

post/internal/nodes/mesh-enroll

Request

  • Base URL: /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/internal/nodes/mesh-enroll
  • Auth: none declared

Request body

join_tokenstring password

A credential. Write-only: it is never returned, and the AI assistant supplies it through a secret slot instead of typing it into the conversation.

labelsunknown
namestring required

The name the worker will register under.

wg_public_keystring required

The worker's base64 WireGuard public key. The private key never leaves the worker.

Response

Pairing created; register over the mesh next

ca_fingerprintstring required

SHA-256 fingerprint of the cluster CA the node API presents.

control_plane_addressstring required

The control plane's mesh address; the node API listens there.

control_plane_endpointstring required

ip:port the worker dials.

control_plane_public_keystring required
expires_atstring required

When the pairing and its token expire (RFC 3339).

join_tokenstring required

Single-use join token bound to name, accepted only over the mesh node API from node_address.

listen_portinteger required

The mesh UDP port.

namestring required

The name the pairing's join token is bound to.

node_addressstring required

The worker's mesh address, reserved for it. It registers under it.

node_api_portinteger required

TCP port of the node API on the control plane's mesh address.

pairing_idinteger required

The pairing created for the worker.

prefix_leninteger required

Changes