A quick reference for the terminology used throughout these docs.
Accounts & access
Workspace: The top-level security boundary. It contains members, teams, service accounts, targets, certificate authorities, and settings. Access is always scoped to a workspace.
Target: A server or other resource registered in a workspace that people can connect to.
Principal: A Linux username on a target, such as root, ubuntu, or deploy. People are assigned to principals, not to machines.
Subject: The product’s umbrella term for anything that can be assigned to a principal: a user, team, or service account. The docs sometimes say “identity” or “user” loosely; “subject” is the precise term.
Service account: A non-human identity for automation and CI, authenticated with a token instead of a person.
Role: A permission level a member holds in a workspace: owner, editor, or viewer.
Cryptography & certificates
Public / private key pair: Two keys that belong together. The private key stays secret; the public key gets shared. Holding the private key lets you prove who you are without ever showing it.
Certificate: A signed wrapper around a public key that adds useful facts, like an expiry time and a principal. Nokku issues SSH and X.509 certificates.
Certificate authority (CA): The thing that signs certificates. A server trusts the CA’s public key instead of storing everyone’s individual keys.
SSH certificate: A certificate used by OpenSSH to authenticate users and hosts.
X.509 certificate: The standard certificate format used by TLS (the encryption behind HTTPS). Used for mTLS and other TLS client and server workloads.
CSR (PKCS#10): A “certificate signing request”. It’s the message you send to a CA to ask it to sign your public key. Nokku builds the CSR on the client and the core signs it.
mTLS: Mutual TLS. Both the client and the server present certificates, so each side authenticates to the other.
SAN (Subject Alternative Name): The names a X.509 certificate is valid for: DNS names, IP addresses, email addresses, or URIs.
TTL / validity: How long a certificate stays valid. Nokku uses short TTLs so certificates expire quickly.
Key type: The algorithm a key uses. Nokku supports Ed25519, ECDSA, and RSA (RSA minimum 2048 bits).
Components
nk: The workstation CLI. It signs you in, gets SSH certificates, generates ssh config, and issues X.509 certificates.
nokkud: The daemon that runs on a target server. It enrolls the server, owns its host certificate, and serves an embedded SSH server that authenticates certificate-based logins and enforces the principal cache.
Core / control plane: The central service that stores identities, targets, access assignments, and CAs, and signs certificates.
Daemon: A background service. nokkud is a daemon; the system’s sshd is one too. nokkud runs its own embedded SSH server instead of configuring the system sshd.
Control stream: The always-on, outbound connection nokkud keeps to the core to receive policy and certificate updates. Because it’s outbound from the server, the target doesn’t need an inbound Nokku port.
Enrollment token: A one-time credential used to register a new server (target) with a workspace.
Authentication & security
SSO: Single sign-on. You log in once through a company identity provider instead of separately for each service.
OIDC (OpenID Connect): A modern SSO protocol, used with providers such as Google, Okta, or Azure AD.
SAML 2.0: An earlier SSO protocol, common in enterprise environments.
Passkey / WebAuthn: A phishing-resistant, hardware-backed way to sign in (FIDO2), usually with a built-in authenticator or a security key.
RLS (Row-level security): A PostgreSQL feature that restricts which rows a query can see. Nokku uses it to isolate workspaces at the database layer.
Audit log: An append-only, per-workspace record of who did what and when, exported for compliance.
Retention: How long audit logs are kept before deletion: 7 days (Community), 90 days (Flex), 365 days (Enterprise).
Air-gapped: A network physically cut off from the internet. On a self-hosted instance the entire control plane runs locally, so access, certificate signing, and license verification keep working without reaching Nokku’s cloud.
License key: The credential that activates Enterprise features on a self-hosted instance. It’s verified offline against a compiled-in key, so it works air-gapped.