CLI Reference

Command Dispatch

Conflux has a small, fixed set of commands. It passes every other command unchanged to the anchorctl it embeds, so conflux peers works but conflux stop does not.

Conflux decides what to do from the first argument:

Four names belong to both conflux and anchorctl. Conflux resolves them like this:

Commands

Conflux has these commands: up, proxy, enrol, start, down, renew, install, uninstall, status, version, help, anchorctl and the hidden serve. Run them with sudo, or from an elevated PowerShell on Windows.

• Commands that change the machine exit with code 13 without root.
• status and anchorctl's commands need root in practice, because only root can read the directories.
• proxy needs root only to register the boot service.
• version and help need no root.

conflux up

Enrols the machine if it has no credential, saves the settings in conflux.json, registers the boot service and starts the anchor with a network interface.

conflux up [--taint T]... [--ipv4 ADDRESS | --no-ipv4] [--subnet SPEC... | --no-subnet]
           [--interface NAME] [--uplink DEV | --no-uplink] [--peers HOST:PORT]... [--no-peers]
           [--api URL] [--port N | --no-port] [--low-latency | --no-low-latency]
           [--lan-discovery yes|no|auto] [--serve-exit | --no-serve-exit] [--use-exit | --no-use-exit]

For the flags, see up and proxy.

$ sudo conflux up --taint brhk-2mq9-tzva-6pjs-k4xe-nw7d-qf --ipv4 10.128.0.2/24

conflux proxy

Does what up does, in userspace and with no network interface, and publishes the ports you name from the anchor.

conflux proxy PORT[/NETWORK]=BACKEND ... [the flags of up, except --interface]

A spec takes the form OVERLAYPORT[/NETWORK]=BACKEND. The network is tcp or udp, and defaults to tcp. The backend is host:port, with an IPv6 host in brackets.

Each run replaces the whole list of specs, and specs and flags can come in any order. You can leave out the specs when --subnet or --serve-exit gives the machine something to route. For the flags, see up and proxy. To learn more, see Publishing Services.

$ sudo conflux proxy 8080=127.0.0.1:3000

conflux enrol

Installs a credential that the machine was given, such as one that a guardian issued.

conflux enrol --manifest FILE|- [--api URL] [--ipv4 ADDRESS]

Enrol checks everything before it writes anything, and refuses to replace an existing credential. It has no --taint flag, because only a credential's issuer grants its taints.

$ sudo conflux enrol --manifest node-14.b64

conflux start

Starts the anchor now from conflux.json, in the mode that the file names, or restarts it if it is already running.

conflux start

It first copies this conflux binary to the location the boot service runs it from. It does not change the configuration or enrol. To bring a machine back after down, use start, not up. On a machine in proxy mode, up would switch the mode and drop the proxies.

$ sudo conflux start

conflux down

Stops the anchor now, and keeps the boot service, the configuration and the identity, so a reboot brings the machine back.

conflux down

$ sudo conflux down

conflux renew

Fetches a new credential and installs it on the running anchor, without a restart.

conflux renew

$ sudo conflux renew

conflux install

Registers the boot service, and starts it if a configuration exists.

conflux install

$ sudo conflux install

conflux uninstall

Removes the boot service, the configuration, the state, the identity, the extracted binaries and the logs.

conflux uninstall [--yes]

The identity cannot be recovered afterwards. To see what each command keeps, see Files and Directories.

$ sudo conflux uninstall --yes

conflux status

Prints conflux's status rows, followed by the output of anchorctl status.

conflux status

It exits with code 78 when there is no configuration. To learn what each row means, see Reading Status.

$ sudo conflux status

conflux version

Prints the release, the commit and the platform, then the anchor set that conflux carries and the SHA-256 digests of its binaries.

conflux version

$ conflux version
conflux 1.0.0-pre (f47de0fac83d24489664ca15fc6a317ac9c9f683) linux/amd64
anchor set <set id>
  anchord    <sha-256>
  anchorctl  <sha-256>

conflux help

Prints the usage of conflux and anchorctl, or of one command.

conflux help [COMMAND]

On its own, it prints conflux's usage, then anchorctl's usage below a horizontal rule. With a command name, it prints that command's usage, whichever binary owns the command.

$ conflux help proxy

conflux anchorctl

Runs the embedded anchorctl with your arguments, unchanged.

conflux anchorctl [--] ARGS...

A leading -- is accepted and ignored. With no arguments, it runs anchorctl's help.

$ sudo conflux anchorctl proxy

conflux serve

Runs the supervisor, which the boot service starts.

conflux serve [--foreground] [--dir DIR]

$ sudo conflux serve --foreground

Flags

Flags take one dash or two: -x or --x. A value follows as --x=v or --x v.

up and proxy

up and proxy take the same flags, except --interface, which only up takes. Conflux saves every flag in conflux.json, so a later run or a reboot keeps the value until you change it.

Repeat --taint, --subnet and --peers to give more than one value. To undo a flag, give its --no- form, or --lan-discovery auto. Giving both flags of a pair exits with code 1.

Other Commands

enrol, uninstall and serve have their own flags, listed with each command.

Passed-Through Commands

Conflux passes every command it does not own to anchorctl: peers, route, routes, connect, punch, events, metrics, export, telemetry, block, unblock, blocks, taints, subnets, send, subscribe, keygen, issue, delegate, renew-link, install-link, id, inspect, config, mint-realm, mint-anchor.

The anchorctl that conflux carries does not include root, so that command answers as unknown.

• When no daemon is running, conflux answers nothing is running here., names start, up and proxy, and exits with code 69. It skips this check for a usage request, or when you give your own -socket or ANCHOR_SOCKET.
• conflux anchorctl proxy lists, adds (-add) and removes (-rm) proxies on the running anchor. The changes last until the next restart, which starts from conflux.json.
• conflux anchorctl export -endpoint … changes telemetry on the running daemon until the next restart. See The export Block.

Realm Controls

Six anchorctl commands let one member act on others in the same realm. Conflux passes them through like any other anchorctl command. All of them except blocks act on another member, never on this machine.

• Each command needs its power in this machine's credential. The issuer grants powers in the same way as taints.
• Credentials from the instance VeilNet hosts grant no powers, so on that instance anchor refuses these orders and says why.
• On a sovereign network, the root node that the guardian hosts issues these orders, and the guardian may grant a power to a machine.
• Give the full 58-character AnchorID, anchor…, as conflux status prints it. The ten-character short form in the tables of peers and blocks is not accepted.
• To cover every private network on a member, use subnets -set '*'. The anchorctl help says all, which anchor does not accept.
• A block does not stop the blocked anchor. It keeps running outside its realm until the block ends or is lifted, and every peer shows DATA no. To stop the anchor on this machine, run conflux down.

To learn more, see Gossip Controls and Powers and Boundaries.

Exit Codes

Conflux exits with these codes:

Error Messages lists every message with its code.

Environment Variables

Conflux reads these environment variables:

Files and Directories

Conflux keeps one configuration per machine, owned by root and outside every home directory. Every directory has mode 0700 and every file has mode 0600. On Windows, a protected access list gives SYSTEM and Administrators sole access.

To learn how conflux protects the manifest, see Security.

Configuration File

conflux.json holds the settings you asked for and everything a reboot needs. Every up and proxy rewrites it, and leaves out the fields that are at their defaults:

{
  "version": 1,
  "mode": "proxy",
  "taints": ["brhk-2mq9-tzva-6pjs-k4xe-nw7d-qf"],
  "ipv4": "10.128.0.5/24",
  "proxies": ["5432=127.0.0.1:5432", "80=127.0.0.1:3000"],
  "createdAt": "2026-09-06T06:35:41Z",
  "updatedAt": "2026-09-06T06:35:41Z"
}

Editing by Hand

You can edit the file by hand. Then run sudo conflux start, and the anchor restarts with the settings in the file.

If anchor would refuse the file, conflux refuses it first, names the field and does not retry. Anchor finds problems that depend on the host when it starts. Examples are a subnet whose interface is not up yet, which anchor retries, and TLS material under export that does not load.

The export Block

export sets where this machine's telemetry goes. Conflux copies the block unchanged into the daemon's configuration, so the field names match anchor's. Conflux refuses an unknown or repeated field and names it.

"export": {
  "enabled": true,
  "endpoint": "guardian.example.gov:4317",
  "metrics": true,
  "logs": true,
  "headers": { "authorization": "Basic …" },
  "metricIntervalNanos": 60000000000,
  "resourceAttributes": { "site": "field-2" }
}

• The fields are enabled, endpoint (host and port, not a URL), insecure, headers, metrics, traces, logs, flows, metricIntervalNanos, traceSampleRatio, serviceName, resourceAttributes, exportTimeoutNanos, shutdownTimeoutNanos, caCert, clientCert, clientKey, logLevel and cardinalityLimit.
• The three TLS fields take {"path": "…"} or {"inline": "…"}.
• headers authenticate this machine to a collector, so treat them as credentials.
• Conflux refuses an enabled block with no endpoint, or with none of metrics, traces, logs and flows turned on.
• A credential from a guardian may carry an export block. conflux enrol copies it into conflux.json once, and you can change it freely after that.

sudo conflux status prints the endpoint that this file names, and shows which of these settings the running daemon follows.