Skip to content
Kaba

kabactl

kabactl

kabactl (Kaba Control) is the engine the Kaba client talks to. It is a single Rust binary that:

  • serves the local HTTPS API the client uses for accounts, settings, frames, history, policies and memories;
  • runs a SOCKS5 proxy with ad blocking, an optional Tor path, and per-peer exit routing;
  • owns the memory store (LanceDB) and the account database (SQLite);
  • runs model inference and LoRA training, locally or on a peer;
  • joins your devices into an encrypted cluster over iroh;
  • runs the tool sandbox, terminals, the password vault and the Safe Browsing database.

The client installs and starts kabactl for you. You only need this section if you want to script it, run it headless on a server, or understand what it is doing. To install it by itself, see install & quick start.

Run it

Section titled “Run it”
Terminal window
kabactl server            # foreground, logs to stderr and kabactl-server.log
kabactl service start     # same server, detached as a background daemon
kabactl service status
kabactl doctor            # check config, certs, databases, ports and PATH

kabactl with no arguments prints help.

Where things live

Section titled “Where things live”

kabactl keeps everything in one storage directory, shared with the client:

| Platform | Storage directory | |---|---| | Linux | ~/.config/kaba | | macOS | ~/Library/Application Support/kaba | | Windows | %APPDATA%\kaba |

| Path | Contents | |---|---| | config.toml | Configuration. Written with defaults on first run. | | certs/kaba.cert, certs/kaba.key | Self-signed TLS identity. See certs. | | kaba.db | SQLite: users, devices, groups, policies, frames, visits, settings, API keys, vault entries, flows, exposed services. | | memories/kaba | LanceDB vector store (the unencrypted global store; each account has its own encrypted store). | | kaba-engine/ | tokenizer.json, base-model GGUF files, and loras/ for adapters. | | security/ | Safe Browsing feeds, ioc.bloom, manifest.json and index. | | bin/kabactl | The managed binary that service install and self-update maintain. | | kabactl-server.log | Server log. Rotates at 10 MB, keeps 5 files. | | kabactl-service.pid, kabactl-service.log | Written by service start. | | perf/ | Diagnostics bundles from --trace. |

Run kabactl doctor to see the exact paths on your machine.

Do not run it as root

Section titled “Do not run it as root”

kabactl refuses to run as root, because root-owned files in your storage directory would lock out every later non-root run. The exceptions are service install --system, service uninstall --system and self-update. Inside a container (/.dockerenv or /run/.containerenv present) the check is skipped. Set KABA_ALLOW_ROOT=1 to override it elsewhere.

In this section

Section titled “In this section”

Install & quick start

Binaries, the container image, building from source and Helm: install & quick start.

Services

The services the server runs and how to daemonize it.