CLI Client

Keywords

openme CLI, openme knock, openme Linux, openme macOS CLI, openme Windows CLI, command line SPA

The openme CLI is the reference client for all platforms. It builds from the same codebase as the server, so a single binary handles both roles.

---

Download & Install

Linux — .deb

Download for Linux →

curl -Lo openme.deb "https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme_0.7.0_linux_amd64.deb"
sudo dpkg -i openme.deb

See Download → Linux for all architectures (arm64, armhf, i386, riscv64).

Linux — binary

curl -Lo openme "https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme-linux-amd64"
chmod +x openme && sudo mv openme /usr/local/bin/

macOS

Download for macOS →

# Apple Silicon
curl -Lo openme "https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme-darwin-arm64"
chmod +x openme && sudo mv openme /usr/local/bin/

# Intel
curl -Lo openme "https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme-darwin-amd64"
chmod +x openme && sudo mv openme /usr/local/bin/

Windows

Download for Windows →

Download openme-windows-amd64.exe (x64) or openme-windows-arm64.exe (ARM64) and add it to your PATH:

$dest = "$env:ProgramFiles\openme"
New-Item -ItemType Directory -Force -Path $dest | Out-Null
Move-Item .\openme-windows-amd64.exe "$dest\openme.exe"   # adjust filename for ARM64
[Environment]::SetEnvironmentVariable(
    "Path", $env:Path + ";$dest", [EnvironmentVariableTarget]::Machine)
Write-Host "Restart your terminal, then run: openme --version"

From source

go install github.com/merlos/openme/cli/cmd/openme@latest

---

Profile Configuration

Profiles are stored in ~/.openme/config.yaml (or %USERPROFILE%\.openme\config.yaml on Windows).

profiles:
  default:
    server_host: "myserver.example.com"
    server_udp_port: 54154
    server_pubkey: "base64..."   # server's Curve25519 public key
    private_key:   "base64..."   # your Ed25519 private key
    public_key:    "base64..."   # your Ed25519 public key
    post_knock:    "ssh user@myserver.example.com"   # optional: run after knock

The profile named default is used when no profile is specified. Generate the block with openme add <name> on the server, then paste it here.

See the full Client Configuration reference.

---

Sending a Knock

# Use the default profile
openme knock

# Named profile
openme knock home

# Open firewall for a specific IP (instead of the outbound IP)
openme knock --ip 10.0.0.5

# Knock and immediately run the health check
openme status --knock

If post_knock is set, it runs automatically after a successful knock:

openme knock   # opens the firewall rule, then runs post_knock (e.g., ssh)

---

Health Check

openme status           # check if the health port is reachable
openme status --knock   # knock first, then check

The health port is only reachable for knock_timeout seconds (default 30 s) after a valid knock.

---

Scripting

# Inline knock + action
openme knock && ssh user@myserver.example.com

# Watch-mode knock with retries
for i in 1 2 3; do openme knock && break; sleep 2; done