Operations

Dashboard tour

The embedded operations dashboard is a dark, Cloudflare-inspired ops console served by the daemon itself: no separate process. By default it listens on http://127.0.0.1:9090 (loopback only). Its views:

CLI reference

The bridge CLI talks to the running daemon over its local Unix Domain Socket (/tmp/bridge.sock, configured via [ipc]). It provides subcommands for every day-two operation: health diagnostics, atomic configuration mutations, cluster membership queries, WireGuard mesh inspection, consensus re-evaluation, and route management.

Health & Diagnostics

Quickly probe daemon responsiveness, uptime, and cluster health for automated monitoring scripts:

# Verify daemon status and cluster health in one call
bridge health

# Ping the daemon IPC socket (useful for systemd ExecStartPost or Docker healthchecks)
bridge ping

# Inspect version, git commit, and active subsystems
bridge version

Dynamic Configuration Management

Inspect and mutate configuration without editing files manually or causing downtime. bridge config set modifies the on-disk TOML atomically and automatically triggers a live reload.

# Dump the running configuration
bridge config show

# Validate a configuration file before applying
bridge config validate --path /etc/bridge/bridge.toml

# Read a specific runtime setting
bridge config get node.priority
bridge config get mesh.listen_port

# Atomically update a setting on disk and hot-reload
bridge config set node.priority 150
bridge config set proxy.http_port 8080

# Hot-reload configuration after manual disk edits
bridge config reload

Cluster Membership & Node Inspection

BRIDGE tracks node health via epidemic SWIM gossip. Inspect member states (Alive, Suspected, Dead, Recovered) across the fleet:

# List all nodes with their status, IP, priority, and role
bridge nodes

# Deep-dive into a specific node's gossip telemetry
bridge node inspect node-02

# Administratively drop/evict a node from the cluster and mesh
bridge node drop node-03

WireGuard Mesh & Tunnels

Diagnose the encrypted L3 overlay network directly without needing external wg utilities:

# View local WireGuard interface, local mesh IP (10.8.0.x), and public key
bridge mesh status

# List active peer tunnels, endpoints, and AllowedIPs
bridge mesh peers

# Force kernel WireGuard interface and routing table synchronization
bridge mesh sync

Consensus & Ingress Failover

BRIDGE uses an autonomous bully election algorithm weighted by node priority. Inspect leadership state or manually trigger an election during maintenance windows:

# Check current leader, election term, and whether local node holds the ingress
bridge election status

# Trigger fleet election re-evaluation (e.g. before taking node down for maintenance)
bridge election trigger

# Administratively force a specific node as leader across the cluster
bridge election set-leader node-02

# Administratively resign from leadership on the local node
bridge election step-down

Proxy & Route Management

Manage ingress routes dynamically. Added routes are registered in the daemon's internal radix tree and consistent hash ring immediately:

# Inspect proxy listeners and active route count
bridge proxy status

# List all active routes (static and Docker-discovered)
bridge routes

# Prune stale/orphaned routes targeting dead or evicted nodes
bridge routes prune

# Register a new service route on the fly
bridge add-route api.example.com http://10.8.0.2:8000

# Remove a service route
bridge remove-route api.example.com

# Test upstream resolution and consistent-hash target for a hostname
bridge inspect api.example.com

Docker Auto-Discovery Inspection

Inspect services discovered by Bridge across Docker containers. When the daemon is running, bridge discovery queries the daemon via IPC. If the daemon is offline, it automatically scans the local Docker socket directly:

# List currently discovered Docker services across running containers
bridge discovery

# Output discovered services in JSON format for automation or scripts
bridge discovery --json

# Force a direct scan of Docker socket without querying daemon
bridge discovery scan --docker-socket /var/run/docker.sock

Health endpoint

GET /health on the dashboard listener reports daemon health, suitable for load-balancer or monitoring checks:

curl -fsS http://127.0.0.1:9090/health

JSON API

The dashboard listener also serves a JSON API under /api/v1, plus a WebSocket stream for real-time events:

systemd management

The installer registers bridge.service:

systemctl status bridge     # service state
systemctl restart bridge    # pick up a config change
journalctl -u bridge -f     # follow daemon logs

The unit runs the daemon as the unprivileged bridge user with CAP_NET_BIND_SERVICE and CAP_NET_ADMIN: enough to bind ports 80/443 and configure WireGuard without full root.

Graceful shutdown

On stop or restart, the daemon's shutdown coordinator drains subsystems in order (ingress first, background workers last) and persists state to disk. A restarted node resumes from the last known fleet state instead of rejoining cold.

Upgrading

Bridge features a built-in auto-update command that checks GitHub releases, verifies SHA256 checksums, replaces the binary atomically, and restarts the systemd service. Your existing /etc/bridge/bridge.toml is never overwritten:

# Check if an update is available without modifying files
bridge update --check

# Download, verify SHA256 checksum, and upgrade in-place (restarts systemd service)
sudo bridge update

# Force reinstallation or pin a specific version tag
sudo bridge update --version v0.1.0-8f7998b5

# Alternative: re-run the curl installer pipe
curl -fsSL https://bridgemesh.space/install.sh | sudo sh

Upgrade followers first and the leader last: the fleet re-elects a follower as leader, hands off the ingress, and the old leader rejoins after its upgrade.