vigocli doctor
Run health checks against the Vigo server to verify it is operating correctly.
Usage
vigocli doctor [flags]
Flags
| Flag | Short | Default | Description |
|---|---|---|---|
--pre-start |
false |
Run local pre-start checks (no server needed) | |
--config |
server.yaml |
Path to server.yaml (for --pre-start) |
Modes
Runtime mode (default)
Queries the running server's /api/v1/doctor endpoint and displays the health check results.
vigocli doctor
database ............. OK
tls .................. OK (expires 2027-01-15)
secrets .............. OK
spanner ............... OK
integrations ......... OK
config ............... OK
swarm_pattern_order .. OK
stale_envoys ......... OK
unpinned_envoys ...... OK
Status: healthy
The unpinned_envoys check warns when non-revoked envoys have no enrolled mTLS client-cert pin. The server refuses their check-ins until they re-enroll (curl -sSfk https://<server>:8443/bootstrap | sudo sh on each host); the check names up to five of them, and the server's startup log lists up to twenty.
The swarm_pattern_order check warns when swarm.*.enabled pattern lists in server.yaml contain deny entries shadowed by an earlier non-deny pattern (the silent-fail case ["*", "-rasp1"] plus glob-shadow ["a*", "-annlap"]). The same finding is logged at WARN by the server at startup and on every reload — see Server Configuration for the order rules.
Pre-start mode
Runs local checks without a running server. Useful for validating configuration before starting vigosrv.
vigocli doctor --pre-start
Checks performed in pre-start mode:
| Check | Description |
|---|---|
config_file |
Parse server.yaml |
secrets_provider |
Initialize the secrets provider |
secret_resolution |
Resolve secret: references in config |
tls_certs |
Check cert files exist, parse, and verify expiry |
config_dir |
Verify stacks/ exists with configcrates/, roles/, envoys/ subdirs |
config_validation |
Load and validate all .vgo configcrate files |
spanner |
Validate spanner (hub-spoke federation) configuration |
Example pre-start output
vigocli doctor --pre-start --config /srv/vigo/server.yaml
config_file .......... OK
secrets_provider ..... OK (local)
secret_resolution .... OK
tls_certs ............ WARN (expires in 28 days (2026-04-10))
config_dir ........... OK (.live)
config_validation .... OK (12 configcrates)
spanner ............ OK (standalone)
Status: degraded
Status values
| Status | Meaning |
|---|---|
| healthy | All checks pass |
| degraded | Some checks have warnings |
| unhealthy | One or more checks failed (exit code 1) |
Check result indicators
| Indicator | Meaning |
|---|---|
| OK | Check passed |
| WARN | Check passed with warnings |
| FAIL | Check failed |
| SKIP | Check skipped (dependency unavailable) |
Related
- validate -- validate .vgo configuration files