Complete reference for the bedrud command-line interface.

Synopsis

# Subcommand style
bedrud <command> [flags]
 
# Flag style
bedrud --livekit --config <path>
bedrud --run --config <path>

Commands

run / server

Start the Bedrud meeting server with API, embedded web frontend, and embedded LiveKit (if configured).

bedrud run    [--config <path>]
bedrud server [--config <path>]

Behavior:

• Loads config from specified path or defaults
• Starts embedded LiveKit if configured for internal mode
• Initializes SQLite/PostgreSQL database and runs migrations
• Creates Fiber HTTP server with all API routes
• Serves embedded React frontend
• Supports ACME (Let’s Encrypt), self-signed TLS, manual TLS, or plain HTTP
• Graceful shutdown on SIGTERM/SIGINT

Implementation: server/internal/server/server.go

--livekit

Start the embedded LiveKit media server only. Extracts binary from Go embed to a temporary directory.

bedrud --livekit --config <path>

Used by: init livekit service created by bedrud install

Implementation: server/internal/livekit/server.go

--run

Alias for bedrud run with same --config flag behavior. Used by init bedrud service.

bedrud --run --config <path>

install

Install Bedrud on a Debian/Linux system. Creates init services (systemd, OpenRC, or SysV init — auto-detected), config files, directories, and TLS certificates.

bedrud install [flags]

What it does:

1. Stops and removes prior installation if --fresh
2. Prompts for IP, domain, email, TLS mode (if non-interactive and flags not provided)
3. Creates directories: /etc/bedrud, /var/lib/bedrud, /var/lib/bedrud/certs, /var/log/bedrud
4. Copies binary to /usr/local/bin/bedrud
5. Generates Bedrud server config at /etc/bedrud/config.yaml
6. Generates LiveKit media server config at /etc/bedrud/livekit.yaml
7. Generates self-signed certs at /etc/bedrud/cert.pem + /etc/bedrud/key.pem (if TLS enabled and no custom certs)
8. Creates LiveKit init service (unless using external LiveKit)
9. Creates Bedrud init service
10. Enables and starts services via detected init system
11. Prints access URLs

TLS options:

• --domain + --email → ACME (Let’s Encrypt)
• --self-signed or --tls → self-signed certificate
• --cert + --key → custom certificates
• --no-tls → plain HTTP only

LiveKit topology:

• Default (embedded): LiveKit runs locally, proxied through Bedrud at /livekit
• --livekit-domain: LiveKit runs locally but clients connect directly via its own domain
• --external-livekit: No local LiveKit; connects to remote server

Implementation: server/internal/install/linux.go

Related docs: Installation Guide • Deployment Guide • Backend Deployment Logic

uninstall

Remove Bedrud from the system.

bedrud uninstall

Removes:

• Stops and disables services across all init systems: bedrud, livekit
• Removes service files for systemd, OpenRC, and SysV init
• Removes binary: /usr/local/bin/bedrud, /tmp/bedrud, /tmp/bedrud-livekit-server
• Removes directories: /etc/bedrud, /var/lib/bedrud, /var/log/bedrud
• Removes system user: bedrud

Implementation: server/internal/install/ (linux.go, init.go, sysv.go, openrc.go)

Related docs: Installation Guide - Uninstalling

user

Manage users in the Bedrud database.

bedrud user [--config <path>] <subcommand> [flags]

create

Create a new user with local authentication (bcrypt hashed password).

bedrud user [--config <path>] create --email <email> --password <password> --name <name> [--admin]

Required flags:

• --email: User email address
• --password: User password, hashed with bcrypt before storage
• --name: User display name

Optional flags:

• --admin: Create user as superadmin

Access level: user by default. Use --admin to create a superadmin in one command.

delete

Delete a user by email address.

bedrud user [--config <path>] delete --email <email>

promote

Set a user’s role by replacing their access array. Defaults to superadmin.

bedrud user [--config <path>] promote --email <email> [--role <role>]

Examples:

# Grant superadmin (default)
bedrud user promote --email admin@example.com
 
# Grant admin
bedrud user promote --email admin@example.com --role admin
 
# Grant moderator
bedrud user promote --email mod@example.com --role moderator

Each role maps to a specific access array:

• superadmin → ['superadmin', 'user']
• admin → ['admin', 'user']
• moderator → ['moderator', 'user']
• user → ['user']
• guest → ['guest']

demote

Remove a specific role from a user. Defaults to removing superadmin.

bedrud user [--config <path>] demote --email <email> [--role <role>]

If the user has no remaining roles after removal, user access is added automatically.

Implementation: server/internal/usercli/usercli.go

cert

Manage TLS certificates. Relevant when using self-signed certificates (generated by bedrud install --self-signed).

bedrud cert [--config <path>] <subcommand>

renew

Force-renew the self-signed TLS certificate. Detects the existing certificate’s key algorithm and regenerates with the same type (default: Ed25519). The new certificate is valid for 1825 days (~5 years).

bedrud cert renew [--config <path>]

The server also auto-renews the certificate daily via its built-in scheduler when it’s within 30 days of expiry. This command is for manual or out-of-band renewal.

SANs: Derived from the server config — domain (if set), plus localhost, 127.0.0.1, and ::1.

Implementation: server/internal/utils/tls.go (RenewSelfSignedCert)

info

Print TLS certificate metadata to stdout.

bedrud cert info [--config <path>]

Output fields: subject, issuer, notBefore, notAfter, daysRemaining, status (valid/expiring/error), SANs.

Implementation: server/internal/utils/tls.go (ValidateTLSCertPair)

help

Show usage message with all commands and flags.

bedrud help

Also triggered when no arguments are provided. Displays the printUsage() output.

Examples

Basic dev server start

# Run with default config.yaml in current directory
bedrud run
 
# Run with custom config
bedrud run --config /path/to/config.yaml
 
# Via env var (fallback)
export CONFIG_PATH=/etc/bedrud/config.yaml
bedrud run

Interactive installation (prompts for inputs)

bedrud install

Non-interactive installation with Let’s Encrypt

bedrud install --domain example.com --email admin@example.com

Self-signed TLS with custom ports

bedrud install --self-signed --port 8443 --lk-port 7880 --lk-tcp-port 7881 --lk-udp-port 7882

Behind CDN with separate LiveKit domain

bedrud install --domain bedrud.example.com --email admin@example.com --livekit-domain lk.example.com --behind-proxy

Fresh reinstall

bedrud install --fresh --domain example.com --email admin@example.com

User management

# Create first admin user (single command)
bedrud user [--config <path>] create --email admin@example.com --password secret123 --name "Admin User" --admin
 
# Or create a regular user, then promote
bedrud user [--config <path>] create --email admin@example.com --password secret123 --name "Admin User"
bedrud user [--config <path>] promote --email admin@example.com
 
# Grant admin access (not superadmin)
bedrud user [--config <path>] promote --email admin@example.com --role admin
 
# Grant moderator access
bedrud user [--config <path>] promote --email mod@example.com --role moderator
 
# Create regular user
bedrud user [--config <path>] create --email user@example.com --password pass456 --name "Regular User"
 
# Remove a user
bedrud user [--config <path>] delete --email user@example.com
 
# Remove admin access
bedrud user [--config <path>] demote --email admin@example.com
 
# Remove moderator access, reverts to user
bedrud user [--config <path>] demote --email mod@example.com --role moderator

Certificate management

# Check certificate status
bedrud cert info --config /etc/bedrud/config.yaml
 
# Force-renew self-signed certificate
bedrud cert renew --config /etc/bedrud/config.yaml

Related Documentation

• Installation Guide - Detailed bedrud install walkthrough, TLS topologies, post-install steps
• Configuration Reference - Server and LiveKit config file structure
• Backend Deployment Logic - How install and uninstall work internally
• Deployment Guide - Full deployment options including init system services