# Fabric > Install, configure, operate, verify, and troubleshoot the Fabric Rust CLI and daemon for trusted cross-machine socket transport over iroh. Use when connecting machines with Fabric, managing peer trust, exposing or dialing Unix/TCP/exec services, syncing folders between trusted peers (fabric sync), configuring the managed user service, diagnosing reachability, or developing and validating the compoundingtech/fabric repository. - Skill: `compoundingtech/fabric` (Agent Skill, multi-file: 11 files) - Install (CLI): `npx skillmds@latest add compoundingtech/fabric` - Raw SKILL.md: https://api.skillmd.com/api/skills/compoundingtech/fabric/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: compoundingtech (https://skillmd.com/u/compoundingtech) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/compoundingtech/fabric --- # Fabric Use `fabric` as a local socket facade for trusted cross-machine services. Keep iroh addresses, QUIC, relays, and peer authorization inside Fabric; consumers should only connect to the local Unix socket or TCP listener returned by `fabric dial`. ## Install Install a release on macOS or Linux: ```sh curl -sSf https://raw.githubusercontent.com/compoundingtech/fabric/main/install.sh | sh fabric --version ``` Expect the binary at `~/.local/bin/fabric` unless `FABRIC_BIN_DIR` or `BIN_DIR` overrides it. Add that directory to `PATH` when necessary. For a source checkout, run `./install.sh`, `make install`, or `cargo install --path .`. Use `cargo run -- ` without installing during development. ## Connect Two Machines Use the same Fabric release on both machines. 1. Run `fabric id` on each machine. 2. Exchange the two stable NodeIDs over a trusted channel. 3. Write each remote NodeID to the local authoritative `peers.toml` as an `[[peers]]` entry with required `id` and optional unique `name`. 4. Run `fabric up` on both machines. Use `fabric reload-peers` instead when the daemon is already running. 5. Run `fabric status` and `fabric ping ` on each machine. Require mutual allow-list entries. A remote daemon rejects a NodeID that is not in its own peer config even when the dialing machine trusts it. Treat `fabric add [name]` as a convenience writer, not a provisioning requirement. Automated provisioning should install the complete peer file. Treat a successful `pong` as the basic connection check. It reports round-trip latency and, when available, the `direct`, `relay`, or `mixed` transport path. Do not require a direct path when a healthy relay path is available. ## Expose And Dial Services Expose exactly one backend per protocol: ```sh fabric expose --socket fabric expose --tcp fabric expose --exec [--max-children N] -- [args...] ``` Use argv after `--` for exec exposures; do not pass a shell command string. Exposures persist by default. Add `--ephemeral` only for a short-lived exposure. Remove a persisted exposure with `fabric unexpose `. Create a local Unix socket on the dialing machine: ```sh fabric dial ``` Or create a local TCP listener: ```sh fabric dial --tcp ``` Give the printed socket path or TCP address to the consumer. Do not make the consumer import iroh types or implement Fabric's peer checks. ## Sync Folders Use `fabric sync` to keep a folder converged with trusted peers. Declare sync entries in the authoritative `~/.config/fabric/syncs.toml` (a sibling of `peers.toml`, hand-editable and provisionable); the running daemon watches each folder and syncs changes over the reserved `fabric/sync/1` ALPN, gated by the same peer allow-list. Each `[[sync]]` entry is `{name, folder, peers, policy}` plus optional `include` globs. Use the SAME `name` on every machine that shares a sync; local `folder` paths may differ. `peers = "*"` means every peer in `peers.toml`. Choose `policy = "catalog"` (union, newer-wins, never deletes on a peer — a deletion is restored, decommission via an edit) or `policy = "bus"` (adds tombstone deletes). ```sh fabric sync add --name --peers "*" --policy catalog fabric sync ls fabric sync rm fabric sync reload ``` `fabric sync add` writes `syncs.toml` and reloads; `fabric sync reload` applies a hand-edited or provisioned file without a restart. Prefer newer-wins on the logical version, not filesystem mtime. A fresh box is declare-then-reload, no interactive step. ## Operate The Daemon Use `fabric up` for the background daemon and `fabric down` to stop it. Use `fabric up --foreground` when another supervisor owns restarts. Install a native per-user service when persistent OS supervision is wanted: ```sh fabric down fabric service install fabric service status ``` Use `fabric service uninstall` to remove the service artifact without deleting identity, peer, config, or log data. Do not migrate a service-manager identity or replace a live managed daemon through that daemon's own `fabric shell`. Build and verify the replacement, preserve a rollback binary, and use a planned window with an independent recovery path. The service-manager swap restarts Fabric and severs its current remote shell. Upgrade the binary lockout-safe: install atomically (`install.sh` uses a temp file plus rename, so it swaps under a running daemon without `ETXTBSY`) at the exact path the daemon runs from, keep a `fabric.rollback` copy, then restart through the SUPERVISOR so the restart survives the shell dropping — `systemctl --user restart ` for a systemd user service, `launchctl kickstart -k gui/$UID/