Reference

Docs

Every command the binary ships with. nsa <command> -h prints the same usage with its full set of flags.

Install

One static binary, fetched from the terminal. Pick your platform.

# macOS, Apple Silicon
curl -fsSL https://releases.nsa.tech/nsa-darwin-arm64-latest -o nsa && chmod +x nsa && sudo mv nsa /usr/local/bin/

# macOS, Intel
curl -fsSL https://releases.nsa.tech/nsa-darwin-amd64-latest -o nsa && chmod +x nsa && sudo mv nsa /usr/local/bin/

# Linux, x86-64
curl -fsSL https://releases.nsa.tech/nsa-linux-amd64-latest -o nsa && chmod +x nsa && sudo mv nsa /usr/local/bin/

# Linux, ARM64
curl -fsSL https://releases.nsa.tech/nsa-linux-arm64-latest -o nsa && chmod +x nsa && sudo mv nsa /usr/local/bin/

# Windows, x86-64 (PowerShell)
curl.exe -fsSL https://releases.nsa.tech/nsa-windows-amd64-latest.exe -o nsa.exe

Set up a network

Create a network on one machine and join it from the others. The 12-word secret is the only thing you share, and it is a full credential.

nsa new
create a network and add this machine to it (prints the secret)
nsa new [--config-dir D] <name>
nsa join
join an existing network using its shared secret
nsa join [--network <label>] [--lan] <name>

Come online

Every machine that wants to reach or be reached runs nsa up — including the one that dials. Off your LAN, it needs a switchboard you run.

nsa up
bring this node online: reserve on switchboards and announce
nsa up [--network <label>] [--lan] [--no-dht] [--listen <maddr>]... [<switchboard-maddr>...]
nsa down
stop the node: withdraw its record, drop reservations, close connections
nsa down [--network <label>]
nsa switchboard
run a blind switchboard: it introduces two machines and never carries their data
nsa switchboard [--listen <maddr>]... [--identity <path>]

Reach a machine

These talk to the node nsa up started. Without it running they stop with the node isn't running.

nsa ssh
ssh into a node over the nsa connection
nsa ssh [--network <label>] [--via <switchboard-maddr>] [ssh args] [user@]<name> [cmd]
nsa vnc
forward a node's VNC port and launch the local viewer
nsa vnc [--network <label>] [--port N] [--no-viewer] [--via <switchboard-maddr>]... <name>
nsa port
forward a local TCP port to a node's localhost port
nsa port [--network <label>] [--local-port N] [--via <switchboard-maddr>]... <port> <name>
nsa pipe
bridge a node's localhost port to stdio (ssh ProxyCommand transport)
nsa pipe [--network <label>] [--port N] [--via <switchboard-maddr>]... <name>
nsa ping
reach a node by name and confirm it is up and authorized
nsa ping [--network <label>] [--via <switchboard-maddr>]... <name>
nsa status
resolve a node by name (or list referenced ones) as available/unavailable
nsa status [--network <label>] [name]

Check and maintain

nsa doctor is the one to run first when something will not connect.

nsa doctor
check whether this machine's network can reach nsa peers
nsa doctor [--network <label>] [--via <switchboard-maddr>]...
nsa version
nsa version [--check]
nsa update
replace this binary with the latest published release
nsa update [--check] [--yes]