### First-run setup token log output

Source: https://geiserx.github.io/CashPilot/getting-started/

Example log line showing the one-time setup token that must be entered in the registration form to create the owner account. The token is only shown in logs and is discarded after the owner account is created.

```text
FIRST-RUN SETUP: no account exists yet. Open /register and enter this
one-time setup token to create the owner account: <token>
```

--------------------------------

### Install gVisor and register with Docker

Source: https://geiserx.github.io/CashPilot/home-network-security/

Downloads and verifies the latest gVisor release, installs it to /usr/local/bin, registers the runsc runtime with Docker, and reloads Docker. Then runs a hello-world container with the runsc runtime to verify installation.

```bash
(
  set -e
  ARCH=$(uname -m)
  URL=https://storage.googleapis.com/gvisor/releases/release/latest/${ARCH}
  wget ${URL}/gvisor.tar.zstd ${URL}/gvisor.tar.zstd.sha512
  sha512sum -c gvisor.tar.zstd.sha512
  sudo tar --zstd -xf gvisor.tar.zstd -C /usr/local/bin
  rm -f gvisor.tar.zstd gvisor.tar.zstd.sha512
)
sudo /usr/local/bin/runsc install
sudo systemctl reload docker
docker run --rm --runtime=runsc hello-world
```

--------------------------------

### View cashpilot-ui container logs

Source: https://geiserx.github.io/CashPilot/getting-started/

Displays logs for the cashpilot-ui container to find the one-time setup token printed on first start.

```bash
docker compose logs cashpilot-ui
```

--------------------------------

### Example output: missing capabilities

Source: https://geiserx.github.io/CashPilot/guides/mysterium/

Example JSON response when the device is present but capabilities are missing, showing only connect_fail errors.

```json
{"statuses":{"data_transfer":{"connect_fail":2},
             "monitoring":{"connect_fail":2},
             "scraping":{"connect_fail":4}}}
```

--------------------------------

### Example output: missing /dev/net/tun

Source: https://geiserx.github.io/CashPilot/guides/mysterium/

Example JSON response when the tun device is missing, showing tun_device_problem errors.

```json
{"statuses":{"data_transfer":{"tun_device_problem":14},
             "scraping":{"tun_device_problem":14},
             "monitoring":{"connect_fail":5,"tun_device_problem":1}}}
```

--------------------------------

### Fetch compose file and launch CashPilot

Source: https://geiserx.github.io/CashPilot/getting-started/

Downloads the docker-compose.yml from the CashPilot repository and starts the containers in detached mode. Requires Docker and Docker Compose installed.

```bash
curl -fsSLO https://raw.githubusercontent.com/GeiserX/CashPilot/main/docker-compose.yml
docker compose up -d
```

--------------------------------

### Start main server with UI and local worker

Source: https://geiserx.github.io/CashPilot/fleet/

Run this command on the main server to start the UI and a local worker using the docker-compose.fleet.yml file.

```bash
docker compose -f docker-compose.fleet.yml up -d
```

--------------------------------

### Restore backup onto fresh install with Docker

Source: https://geiserx.github.io/CashPilot/backup-restore/

Recreates the data volume and copies the database and key files back together. Run this before the fresh install generates its own keys. The optional .secret_key copy is only needed when CASHPILOT_SECRET_KEY is not set.

```bash
docker compose down

# Recreate the volume and put all three files back TOGETHER.
docker volume create cashpilot_data
docker run --rm -v cashpilot_data:/data -v "$PWD/$OUT":/backup alpine sh -c '
  cp /backup/cashpilot.db /data/cashpilot.db &&
  cp /backup/.fernet_key  /data/.fernet_key  &&
  # Optional: absent whenever CASHPILOT_SECRET_KEY is set.
  { [ -f /backup/.secret_key ] && cp /backup/.secret_key /data/.secret_key || true; } &&
  chmod 600 /data/.fernet_key &&
  chown -R 1000:1000 /data'

docker compose up -d
docker logs -f cashpilot-ui
```

--------------------------------

### Check wallet address from container logs

Source: https://geiserx.github.io/CashPilot/guides/proxybase-xyz/

On first start, the container logs show the generated wallet address. Save the mnemonic shown in the logs to back up the wallet.

```text
==> No wallet found — creating one...
Wallet created successfully!
Address: 0xb956cb455901fba57a330221bb1caa00c3ec7acb
```

--------------------------------

### Verify the fix

Source: https://geiserx.github.io/CashPilot/guides/mysterium/

Run these commands to confirm the device and capabilities are working and the log is clean.

```bash
docker exec cashpilot-mysterium sh -c 'ip tuntap add dev probe mode tun && echo TUN_OK && ip link del probe'
docker exec cashpilot-mysterium sudo -n true && echo SUDO_OK
docker logs cashpilot-mysterium 2>&1 | grep -c 'PERM_SUDOERS'        # expect 0
docker logs cashpilot-mysterium 2>&1 | grep -i wireguard | tail -3   # expect "Wireguard: started"
```

--------------------------------

### POST /api/workers/earnings-import request example

Source: https://geiserx.github.io/CashPilot/fleet/

Example HTTP request to import earnings a client collected on its own. Uses the worker's own key, not the shared enrollment key. The body includes client_id and readings with slug, balance, date, currency, and optional fx_rate_usd.

```http
POST /api/workers/earnings-import
Authorization: Bearer <this worker's own key, not the shared enrollment key>
Content-Type: application/json

{
  "client_id": "desktop-macbook",
  "readings": [
    {"slug": "honeygain", "balance": 12.4, "date": "2026-07-01", "currency": "USD"},
    {"slug": "mysterium", "balance": 88.0, "date": "2026-07-01", "currency": "MYST", "fx_rate_usd": 0.41}
  ]
}
```

--------------------------------

### Backup CashPilot database and keys

Source: https://geiserx.github.io/CashPilot/backup-restore/

Creates a dated backup directory, uses SQLite's backup API inside the container to avoid torn writes, copies the database and the .fernet_key (and optionally .secret_key) to the host, and sets restrictive permissions. The .fernet_key is essential; without it the database is only half a backup.

```bash
# Everything that matters, into one dated directory.
OUT="cashpilot-backup-$(date +%Y%m%d)"
mkdir -p "$OUT"

# The database, consistently, without stopping the container.
docker exec cashpilot-ui sh -c \
  'python -c "import sqlite3,sys; s=sqlite3.connect(\"/data/cashpilot.db\"); d=sqlite3.connect(\"/tmp/backup.db\"); s.backup(d); d.close(); s.close()"'
docker cp cashpilot-ui:/tmp/backup.db "$OUT/cashpilot.db"
docker exec cashpilot-ui rm -f /tmp/backup.db

# THE key. Without it the database above is half a backup.
docker cp cashpilot-ui:/data/.fernet_key "$OUT/.fernet_key"

# Only present if CASHPILOT_SECRET_KEY is unset, so do not fail without it.
docker cp cashpilot-ui:/data/.secret_key "$OUT/.secret_key" 2>/dev/null \
  || echo "no .secret_key (CASHPILOT_SECRET_KEY is set in the environment) — fine"

chmod 600 "$OUT"/.*key 2>/dev/null
ls -la "$OUT"
```

--------------------------------

### Inspect container mounts as JSON

Source: https://geiserx.github.io/CashPilot/guides/mysterium/

Get the JSON representation of the container's mounts to identify the data directory or volume to reuse.

```bash
docker inspect cashpilot-mysterium --format '{{json .Mounts}}'
```

--------------------------------

### Generate hostd wallet seed with Docker

Source: https://geiserx.github.io/CashPilot/guides/sia-hostd/

Run this Docker command to generate a 12-word BIP-39 seed phrase and wallet address. The seed is the only way to access earnings; back it up securely. The volume and container are not a recovery path.

```bash
docker run --rm ghcr.io/siafoundation/hostd seed
```