Configuration

Global options

The current, complete list of nk commands, flags, and environment variables is maintained in the nk README and in nk --help.

For example:

NK_API_URL=https://api.example.com nk login
nk --key-type ed25519 --ttl 4h login

The requested TTL must be allowed by the certificate authority. The core applies the authority’s configured bounds.

Generated SSH configuration

nk writes its generated configuration to ~/.config/nk/ssh_config and includes it from ~/.ssh/config. It also writes target host verification data to ~/.config/nk/known_hosts.

Add personal SSH options in your own ~/.ssh/config; do not edit the generated file.

Local files

Everything nk needs lives under ~/.config/nk/:

config.json holds your local configuration (including the device ID), cache.json the synchronized identity, workspace, target, and CA data, and signer.json the device signing identity (the TPM public key, or the machine-wrapped software key). The certs/ folder holds the signed SSH certificates. ssh_config is the generated OpenSSH configuration, and known_hosts the generated CA host entries. agent.sock is the embedded SSH agent socket that nk proxy serves while a connection is in flight when the SSH key is TPM-backed.

Use normal filesystem permissions for these files. The SSH private key (nokku) and the software signing key inside signer.json are credentials. With --key-type tpm, the SSH private key is never written to disk: only nokku.pub exists and the key is re-derived from the TPM on every run. Service-account tokens are never written to disk.

Commands