Complete reference for the bedrud command-line interface.

Synopsis

# Subcommand style
bedrud <command> [flags]
 
# Legacy flag style (systemd units)
bedrud --livekit --config <path>
bedrud --run --config <path>

Global Flags

Default config path for run is config.yaml. Management commands (user, room, config, …) default to /etc/bedrud/config.yaml when installed.

Commands

run / server

Start the Bedrud meeting server with API, embedded web frontend, and embedded LiveKit (if configured).

bedrud run    [--config <path>] [--skip-migrate]
bedrud server [--config <path>] [--skip-migrate]

Behavior:

• Loads config from specified path or defaults
• Starts embedded LiveKit if not livekit.external
• Initializes SQLite/PostgreSQL and runs migrations (unless skipped)
• Fiber HTTP server with API routes + embedded React frontend
• ACME, self-signed TLS, manual TLS, or plain HTTP
• Graceful shutdown on SIGTERM/SIGINT

Implementation: server/internal/server/server.go, server/internal/cli/run.go

--livekit

Start the embedded LiveKit media server only. Extracts binary from Go embed to a temporary directory.

bedrud --livekit --config <path>

Used by: init livekit service created by bedrud install

Implementation: server/internal/livekit/server.go

--run

Alias for bedrud run with same --config flag behavior. Used by init bedrud service.

bedrud --run --config <path>

install

Install Bedrud on a Debian/Linux system. Creates init services (systemd, OpenRC, or SysV init — auto-detected), config files, directories, and TLS certificates.

bedrud install [flags]

What it does:

1. Stops and removes prior installation if --fresh
2. Prompts for IP, domain, email, TLS mode (if non-interactive and flags not provided)
3. Creates directories: /etc/bedrud, /var/lib/bedrud, /var/lib/bedrud/certs, /var/log/bedrud
4. Copies binary to /usr/local/bin/bedrud
5. Generates Bedrud server config at /etc/bedrud/config.yaml
6. Generates LiveKit media server config at /etc/bedrud/livekit.yaml
7. Generates self-signed certs at /etc/bedrud/cert.pem + /etc/bedrud/key.pem (if TLS enabled and no custom certs)
8. Creates LiveKit init service (unless using external LiveKit)
9. Creates Bedrud init service
10. Enables and starts services via detected init system
11. Prints access URLs

TLS options:

• --domain + --email → ACME (Let’s Encrypt)
• --self-signed or --tls → self-signed certificate
• --cert + --key → custom certificates
• --no-tls → plain HTTP only

LiveKit topology:

• Default (embedded): LiveKit runs locally, proxied through Bedrud at /livekit
• --livekit-domain: LiveKit runs locally but clients connect directly via its own domain
• --external-livekit: No local LiveKit; connects to remote server

Implementation: server/internal/install/linux.go

Related docs: Installation Guide • Deployment Guide • Backend Deployment Logic

update / upgrade

Upgrade an existing Bedrud installation in place. update and upgrade are identical.

Preserves configuration, secrets, certificates, and the database. Replaces the installed binary with the currently running executable, runs versioned install migrations and database schema migrations, refreshes init service units, and restarts services.

bedrud update   [flags]
bedrud upgrade  [flags]

What it does:

1. Verifies an existing install (/etc/bedrud/config.yaml or --config)
2. Stops bedrud and livekit services
3. Replaces the installed binary with this executable (skips overwrite for package-managed /usr/bin/bedrud when the running binary is already that path; otherwise installs to /usr/local/bin)
4. Runs versioned install-state migrations when upgrading across releases that need them
5. Runs database AutoMigrate (same as bedrud db migrate / server startup)
6. Rewrites init unit files so ExecStart matches the binary path and LiveKit topology
7. Enables and restarts services
8. Records the new version in /var/lib/bedrud/version

Typical workflows:

# Download latest binary, then upgrade in place
curl -fsSL https://bedrud.org/install.sh | bash -s -- --no-setup
sudo bedrud update
 
# Run the new release binary directly
sudo ./bedrud update
 
# Package manager already replaced the binary — only migrate + restart
sudo bedrud update --skip-binary

Does not: rewrite config secrets, regenerate TLS certs, or remove data. For a clean reinstall use bedrud install --fresh.

Implementation: server/internal/install/update.go, version.go, services.go

Related docs: Installation Guide - Updating • Appliance Mode

uninstall

Remove Bedrud from the system.

bedrud uninstall

Removes:

• Stops and disables services across all init systems: bedrud, livekit
• Removes service files for systemd, OpenRC, and SysV init
• Removes binary: /usr/local/bin/bedrud, /tmp/bedrud, /tmp/bedrud-livekit-server
• Removes directories: /etc/bedrud, /var/lib/bedrud, /var/log/bedrud
• Removes system user: bedrud

Implementation: server/internal/install/ (linux.go, init.go, sysv.go, openrc.go)

Related docs: Installation Guide - Uninstalling

user

Manage users in the Bedrud database.

bedrud user [--config <path>] <subcommand> [flags]

create

Create a new user with local authentication (bcrypt hashed password).

bedrud user [--config <path>] create --email <email> --password <password> --name <name> [--admin]

Required flags:

• --email: User email address
• --password: User password, hashed with bcrypt before storage
• --name: User display name

Optional flags:

• --admin: Create user as superadmin

Access level: user by default. Use --admin to create a superadmin in one command.

delete

Delete a user by email address.

bedrud user [--config <path>] delete --email <email>

promote

Set a user’s role by replacing their access array. Defaults to superadmin.

bedrud user [--config <path>] promote --email <email> [--role <role>]

Examples:

# Grant superadmin (default)
bedrud user promote --email admin@example.com
 
# Grant admin
bedrud user promote --email admin@example.com --role admin
 
# Grant moderator
bedrud user promote --email mod@example.com --role moderator

Each role maps to a specific access array:

• superadmin → ['superadmin', 'user']
• admin → ['admin', 'user']
• moderator → ['moderator', 'user']
• user → ['user']
• guest → ['guest']

demote

Remove a specific role from a user. Defaults to removing superadmin.

bedrud user [--config <path>] demote --email <email> [--role <role>]

If the user has no remaining roles after removal, user access is added automatically.

Implementation: server/internal/usercli/usercli.go

certificate (alias: cert)

Manage self-signed TLS certificates. Relevant when using self-signed certs from bedrud install --self-signed / --tls (not ACME/Let’s Encrypt by default).

bedrud certificate [--config <path>] <subcommand>
bedrud cert        [--config <path>] <subcommand>   # short alias

regenerate

Regenerate (or create) the self-signed certificate and key from the current config. Rebuilds SANs so enabling WebXDC later does not require a full reinstall.

bedrud certificate regenerate [--config <path>] [--algo <algo>] [--force]

SAN hosts always include:

• server.domain (if set)
• server.host (non-loopback IP or hostname)
• outbound public IP when discoverable
• localhost, 127.0.0.1, ::1

When WebXDC is enabled (webxdc.enabled + valid webxdc.baseDomain, and not path-mode):

• webxdc.baseDomain (e.g. wx.example.com)
• *.{webxdc.baseDomain} — required for instance hosts webxdc-<id>.{baseDomain}

Valid for ~1825 days (~5 years). Creates the cert pair if missing; otherwise atomic replace.

# After enabling WebXDC in config.yaml
sudo bedrud certificate regenerate
sudo systemctl restart livekit bedrud

Implementation: server/internal/cli/cert.go, server/internal/utils/tls.go

renew

Same SAN rebuild as regenerate (including WebXDC wildcard). Prefer regenerate in new scripts.

bedrud certificate renew [--config <path>] [--algo <algo>]
bedrud cert renew [--config <path>] [--algo <algo>]

The server also auto-renews self-signed certs daily when within 30 days of expiry.

info

Print TLS certificate metadata and compare against expected SANs from config (reports missing WebXDC wildcards, etc.).

bedrud certificate info [--config <path>]
bedrud cert info [--config <path>]

Output fields: subject, issuer, notBefore, notAfter, daysRemaining, status (valid/expiring), SANs, expectedSans, missingSans, webxdcWildcard.

Implementation: server/internal/utils/tls.go (ValidateTLSCertPair)

config

Inspect and edit the Bedrud config file on disk.

bedrud config [--config <path>] <subcommand>

Implementation: server/internal/cli/config.go

settings

Inspect/modify runtime SystemSettings stored in the database (admin panel overrides).

bedrud settings [--config <path>] <subcommand>

Implementation: server/internal/cli/settings.go

invite-token (invite)

Manage registration invite tokens.

bedrud invite-token [--config <path>] <subcommand>
# alias: bedrud invite ...

Implementation: server/internal/cli/invite.go

db

Database utilities.

bedrud db [--config <path>] <subcommand>

Implementation: server/internal/cli/db.go

room

Manage meetings/rooms from the CLI.

bedrud room [--config <path>] <subcommand>

Implementation: server/internal/cli/room.go, server/internal/roomcli/

version

bedrud version

Prints bedrud <version> (version injected at build time).

help

bedrud help
bedrud <command> --help

Examples

Basic dev server start

# Run with default config.yaml in current directory
bedrud run
 
# Run with custom config
bedrud run --config /path/to/config.yaml
 
# Via env var (fallback)
export CONFIG_PATH=/etc/bedrud/config.yaml
bedrud run

Interactive installation (prompts for inputs)

bedrud install

Non-interactive installation with Let’s Encrypt

bedrud install --domain example.com --email admin@example.com

Self-signed TLS with custom ports

bedrud install --self-signed --port 8443 --lk-port 7880 --lk-tcp-port 7881 --lk-udp-port 7882

Behind CDN with separate LiveKit domain

bedrud install --domain bedrud.example.com --email admin@example.com --livekit-domain lk.example.com --behind-proxy

Fresh reinstall

bedrud install --fresh --domain example.com --email admin@example.com

User management

# Create first admin user (single command)
bedrud user [--config <path>] create --email admin@example.com --password secret123 --name "Admin User" --admin
 
# Or create a regular user, then promote
bedrud user [--config <path>] create --email admin@example.com --password secret123 --name "Admin User"
bedrud user [--config <path>] promote --email admin@example.com
 
# Grant admin access (not superadmin)
bedrud user [--config <path>] promote --email admin@example.com --role admin
 
# Grant moderator access
bedrud user [--config <path>] promote --email mod@example.com --role moderator
 
# Create regular user
bedrud user [--config <path>] create --email user@example.com --password pass456 --name "Regular User"
 
# Remove a user
bedrud user [--config <path>] delete --email user@example.com
 
# Remove admin access
bedrud user [--config <path>] demote --email admin@example.com
 
# Remove moderator access, reverts to user
bedrud user [--config <path>] demote --email mod@example.com --role moderator

Certificate management

# Check certificate status
bedrud cert info --config /etc/bedrud/config.yaml
 
# Force-renew self-signed certificate
bedrud cert renew --config /etc/bedrud/config.yaml

Config and settings

bedrud config path
bedrud config show --json
bedrud config get server.port
bedrud config set logger.level info
bedrud config validate
 
bedrud settings show --effective
bedrud settings set InstanceName "My Meet"

Rooms and invite tokens

bedrud room list --active
bedrud room info my-meeting
bedrud room kick my-meeting --identity user-id-here
bedrud room close my-meeting --yes
 
bedrud invite-token create --email newuser@example.com --ttl-hours 72
bedrud invite-token list

Related Documentation

• Installation Guide - Detailed bedrud install walkthrough, TLS topologies, post-install steps
• Configuration Reference - Server and LiveKit config file structure
• Backend Deployment Logic - How install and uninstall work internally
• Deployment Guide - Full deployment options including init system services