Fleet access & orders
Two switches decide which of your machines may command which. Fleet access says what a machine can command; takes orders says whether it can be commanded. Build an autoscaler, a deploy bot, a nightly janitor, and still keep one machine out of their reach.
The concept
Every machine carries its own identity (a per-boot SSH key) and can reach the platform over SSH. By default it can look, not touch.
| Switch | Points | Default |
|---|---|---|
| fleet access | this machine can command your other machines | off |
| takes orders | your other machines can command this one | on |
They are independent: a machine that takes no orders can still have fleet access, and a machine with fleet access is not thereby exempt from taking them. Both are per-machine, both are yours alone to flip.
This pair also governs outposts: a machine may open a shell, browse files, or run run and cp on one of your outposts only with fleet access on, exactly as for a sibling machine, and an outpost of yours can refuse orders like any other machine. Hardware in your home is never easier for a machine to reach than a machine is.
Enabling fleet access
Only you (the human owner) can flip either switch; a machine can never grant itself fleet access, nor turn off another machine's ability to refuse.
dashboard
Cursor to the machine, press c. Or open the actions popup with Space and use the c checkbox, labelled fleet access.
In list output, machines with fleet access show the F flag; info <name> shows fleet access: on.
Holding a machine back
Turn takes orders off on the machine that matters: the one with the production database, the customer's box, the credentials. Your automation keeps working everywhere else; that one machine answers only you.
dashboard
Open the actions popup with Space and use the b checkbox, labelled takes orders. It works the same on an outpost.
Such a machine shows the N flag in list (it is still listed; nothing is hidden), and info reads takes orders: off. Another machine that tries to reach it is told <name> takes no orders from other machines (its owner can turn that on).
What a machine can do
| Normal machine | With fleet access | |
|---|---|---|
read & introspect: list, info, stats, usage, whoami, images | yes | yes |
| manage its own env vars and ports; read account-wide env vars | yes | yes |
| manage a sibling's env vars or ports, or account-wide env vars | no | yes |
proxy list | only proxies attached to it | all |
lifecycle: create, copy, resize, stop, start, restart, pause, resume, rm | no | yes |
| set or clear a custom domain | no | yes |
shell into your other machines, or run / cp against them | no | yes |
| reach a machine or outpost that takes no orders | no | no |
| toggle any of the three switches | no | no (owner only, in the dashboard) |
A machine without fleet access that tries a gated verb gets this machine is not allowed to control the fleet (ask the owner to turn on fleet access); reaching a sibling's shell fails with this machine is not allowed to reach other machines (fleet access is off); touching a sibling's env vars or ports gives a machine can only manage its own env vars (ask the owner to turn on fleet access to manage siblings). A machine with fleet access, refused by a target that takes no orders, is told so plainly rather than being sent back to a switch that is already on. Machine sessions are always scoped to your account and are never admin.
Protect your controller
Delete protection is the third dashboard toggle (key g). It blocks rm for everyone, including a machine with fleet access: machine "<name>" is delete-protected; turn protection off first. Turn it on for your controller; a bug in your own automation can never delete the machine running it. Protected machines show the P flag in list.
Lineage
Machines created by another machine record who made them. Trace what your automation built.
ssh
$ ssh dashboard@ironwire.sh info worker-2 … created-by: machine <id>
dashboard
Use info over ssh or the cli; the machine list does not show lineage.
The created-by line appears only on machine-created machines (created_by in JSON output).