Quickstart

Create a Nokku account and workspace. A workspace is the boundary for your members, targets, access assignments, and certificate authorities. Workspace creation creates a default SSH certificate authority.

Run this on your workstation:

curl -fsSL https://get.nokku.sh/nk | sh

nk login

The CLI opens a browser-based login flow. When it completes, nk registers the machine’s signing identity and synchronizes the workspaces, targets, principals, and certificate authorities available to your identity.

Generate an enrollment token for the workspace. On the target server, run:

curl -fsSL https://get.nokku.sh/nokkud | sudo sh
sudo nokkud --enroll <TOKEN>

Enrollment creates the target in the core automatically. The daemon receives its credentials, synchronizes the target, and starts an embedded SSH server on port 4022 for certificate authentication. Make sure the target firewall allows TCP 4022 to your users. Depending on workspace settings, an administrator may need to approve the daemon.

On the target, assign your user to the Linux principal you want to use, such as ubuntu or root.

The principal is the requested Linux username. The certificate identifies the Nokku user separately, so multiple people can be assigned to the same Linux account.

After the target is online and access is assigned:

ssh ubuntu@your-target-name

nk uses the generated SSH configuration and its proxy command to connect to the target. It requests a user certificate from the core when a usable local certificate is not available.