Create a mesh

jalth init creates a new mesh in your Cloudflare account. It takes about two minutes and orchestrates six Cloudflare products behind a single interactive flow.

Prerequisites

• Cloudflare account (free tier is fine)
• Cloudflare API token with the recommended permissions
• WARP client installed (jalth doctor reports missing prerequisites)

Optional: A domain on Cloudflare — required only for jalth serve with custom hostnames. Pass --domain myteam.com during init or set it later with jalth domain set.

Basic usage

jalth init

With a custom domain (enables jalth serve immediately):

jalth init --domain myteam.com

For headless servers and CI (no browser SSO):

jalth init --unattended

--unattended security tradeoff

--unattended grants admin via a bootstrap service token stored in the WARP MDM profile. Acceptable for CI and automation; prefer SSO for production meshes where a human is available.

What init does

1. Validate credentials — Verifies API token permissions and auto-detects your admin email and Zero Trust team name.

2. Deploy Registry Worker — Creates D1 database, runs migrations, deploys the Worker with your API token as a secret.

3. Configure Zero Trust — Email OTP IdP, Access Groups (jalth-members, jalth-admins, jalth-operators), enrollment policies, WARP device profile, SSH CA.

4. Enroll this device — Writes WARP MDM config, registers device, assigns CGNAT IP.

5. Save config — Writes ~/.jalth/config.json with registry URL and device token.

API token permissions

The API token is bound to the Worker as a secret during deploy. It is never stored in D1 or client config. Future jalth init runs need the token again; upgrades do not.

Permission	Scope	Level	Used for
User Details	User	Read	Auto-detect admin email
Zero Trust	Account	Edit	Devices, Gateway DNS, connectivity
Access: Organizations, IdPs, Groups	Account	Edit	Enrollment policies, Access Groups
Access: Apps and Policies	Account	Edit	WARP enrollment app, service apps
Access: SSH Auditing	Account	Edit	Gateway SSH CA
Access: Service Tokens	Account	Edit	Headless init + auth-key joins
Cloudflare Tunnel	Account	Edit	jalth serve tunnel lifecycle
Cloudflare DEX	Account	Read	Fleet status enrichment
Workers Scripts	Account	Edit	Deploy Worker, bind secrets
D1	Account	Edit	Mesh database
DNS	Zone	Edit	Exposed service hostnames

After init

Add people and headless servers:

jalth role set sarah@team.com member
jalth group add members --domain myteam.com
jalth auth-key create --name homelab --reusable

Share the join URL:

jalth join https://jalth.myteam.com

Coexistence with existing Cloudflare setup

jalth reuses existing resources when safe:

• WARP enrollment — Works alongside same-org enrollment; different org requires leaving first.
• Device profile — Creates jalth-mesh-routing with its own split tunnel; default profile untouched.
• Resources — All jalth resources are prefixed jalth-*. Existing resources are never modified.
• Destroy — Only deletes resources jalth created; pre-existing resources are left intact.

Idempotent resume

If init fails midway, run jalth init again. Step 3 reconciles control-plane state — reuses what exists, creates what’s missing.