Skip to main content

hunt serve

Run the service: hunt's JSON API and its web UI, on one address. Every other command talks to a running hunt serve.

Examples​

hunt serve                                   # http://127.0.0.1:4848, database ~/.hunt/hunt.db
hunt serve --addr 0.0.0.0:4848 --db /data/hunt.db
hunt serve --db postgres://hunt:secret@localhost/hunt
hunt serve --tenants --admins you@example.com --access-team yourteam --access-aud <AUD tag>

Good to know​

  • --addr says where it listens: 127.0.0.1 keeps it to this computer. Anywhere else, give it a sign-in: --password (or HUNT_PASSWORD) for one person; for several, Cloudflare Access, or a sign-in proxy's header (--auth-header, from --trusted-proxies). See What's public, and what needs signing in.
  • --db is a SQLite file (made if new), or a PostgreSQL or MySQL address: see The database.
  • --tenants serves several people, each with their own search, signing in through Cloudflare Access: see Several people.
  • Every option can be set in the environment instead (HUNT_ADDR, HUNT_DB, …), as containers do.

Help​

Run the service: the API and the web UI

Usage: hunt serve [OPTIONS]

Options:
      --addr <ADDR>
          [env: HUNT_ADDR=] [default: 127.0.0.1:4848]
      --url <URL>
          Where the service runs [env: HUNT_URL=] [default: http://127.0.0.1:4848]
      --db <DB>
          The database: a SQLite file, or a postgres://user:pass@host/db or mysql://user:pass@host/db address [default: ~/.hunt/hunt.db] [env: HUNT_DB=]
      --tenants
          Several people, each with their own applications in the one database, signing in through Cloudflare Access. New people ask for an account; admins approve them [env: HUNT_TENANTS=]
      --admins <ADMINS>
          With --tenants: the admins, by email, comma-separated. The first keeps what the database held before [env: HUNT_ADMINS=]
      --access-team <ACCESS_TEAM>
          With --tenants: your Cloudflare Zero Trust team (its name, or name.cloudflareaccess.com) [env: HUNT_ACCESS_TEAM=]
      --access-aud <ACCESS_AUD>
          With --tenants: the Access application's audience (AUD) tag [env: HUNT_ACCESS_AUD=]
      --password <PASSWORD>
          One person's hunt, with a sign-in: this password, at /login (the CLI sends its own HUNT_PASSWORD). 8 characters or more [env: HUNT_PASSWORD]
      --auth-header <AUTH_HEADER>
          With --tenants, instead of Access: a sign-in proxy (Authelia, Authentik, oauth2-proxy, Tailscale) names who's asking in this header (e.g. Remote-Email), taken only from --trusted-proxies [env: HUNT_AUTH_HEADER=]
      --trusted-proxies <TRUSTED_PROXIES>
          With --auth-header: the addresses the sign-in proxy's requests come from, or ranges (10.0.0.0/8), comma-separated [default: this machine, 127.0.0.1 and ::1] [env: HUNT_TRUSTED_PROXIES=]
      --experiment <EXPERIMENTS>
          Turn on an experiment, a feature still being tried out: `name` for everyone, or `name=you@example.com,…` for those accounts. Repeat it for several (in HUNT_EXPERIMENTS, separate them with `;`). There are none now (take-home has become a feature, and is still taken) [env: HUNT_EXPERIMENTS=]
  -h, --help
          Print help