tapqueue-admin status Server version and a summary of what's set up
tapqueue-admin users List users
tapqueue-admin users add <username> [--name] Create a user and print their client token
tapqueue-admin users reset-token <username> Issue a new client token
tapqueue-admin users quota <username> [<pages> day|week|month | none]
Show a user's page limits and usage, or set or remove their own
tapqueue-admin groups quota <id> <pages> day|week|month | none
Set or remove a group's page limit
tapqueue-admin quotas Everyone with a page limit and how much they've used
tapqueue-admin queues List queues (the printers users see in Windows)
tapqueue-admin queues add <id> --name <name> [--description] [--location] [--color] [--duplex] [--media]
tapqueue-admin queues edit <id> [--name] [--description] [--location] [--color on|off] [--duplex on|off] [--media]
tapqueue-admin queues remove <id>
tapqueue-admin printers [--refresh] Printers with their health and toner levels
tapqueue-admin printers add <id> <uri> [--name] [--location] [--tls-skip-verify]
tapqueue-admin printers edit <id> [--uri] [--name] [--location] [--tls-skip-verify on|off]
tapqueue-admin printers remove <id>
tapqueue-admin jobs [--status held] List recent jobs
tapqueue-admin clients update [--check] Publish the newest client release from GitHub; --check only looks
tapqueue-admin stations update [--check] The same for the station build that goes with this server
tapqueue-admin report [--by user|group|printer|queue|day|month] [--from 2026-10-01] [--to 2026-10-31] [--csv]
Pages printed; this month by person unless told otherwise
(see reports.md)
tapqueue-admin release <user> <printer> [ids] Release a user's held jobs to a printer
tapqueue-admin badges [username] List badges
tapqueue-admin badges add <user> <card>|--last-tap [--station <station>]
Link a badge to a user: a card number, or the card
last tapped (at that station, with --station)
tapqueue-admin badges unknown [--station <station>]
Unrecognized cards tapped in the last hour
tapqueue-admin badges remove <badge-id> Unlink a badge
tapqueue-admin stations Release stations and when they last checked in
tapqueue-admin stations add <id> <printer> Create a station and print its token
tapqueue-admin stations move <id> <printer> Make a station release to another printer
tapqueue-admin stations reset-token <id> Issue a new station token
tapqueue-admin stations remove <id> Delete a station
tapqueue-admin clients Signed-in clients and their versions
tapqueue-admin clients update [--check] Publish the newest client release from GitHub
tapqueue-admin stations update [--check] The same for the station build that goes with the server
tapqueue-admin server downgrade [<version>] Older releases to go back to; with one, go back to it
tapqueue-admin clients builds Published client builds
tapqueue-admin clients sign-out <session> Sign a client out; jobs from that PC stop going to them
tapqueue-admin workstations PCs with the TapQueue service: client, update errors, who's signed in
tapqueue-admin workstations update <computer> Install the published client now (retries a failed update)
tapqueue-admin workstations forget <computer> Drop a PC that's gone
tapqueue-admin crashes [<computer>] Crash reports sent by clients, newest first
tapqueue-admin crashes show <id> One report with its full error
tapqueue-admin crashes clear [<computer>] Delete crash reports (all, or one PC's)
tapqueue-admin directory Active Directory sync: settings, scope, next and recent syncs
tapqueue-admin directory sync [--dry-run] [--force]
Sync now, only show what would change, or go past the disable limit
tapqueue-admin directory scope add <dn> Sync the users under an OU, in a group, or one user
tapqueue-admin directory scope remove <id> Stop syncing a scope item
tapqueue-admin server Settings, and whether each is set here or in server.toml
tapqueue-admin server set hold-hours|session-timeout <number|default>
Change a setting now, or go back to server.toml's
tapqueue-admin server set quota-overrun allow|deny|default
Whether a job may take someone over their page limit
tapqueue-admin server set address-matching on|off|default
Whether jobs without a PC key are matched by address
(see how-it-works.md)
tapqueue-admin server set held-limit <megabytes|0|default>
How much one person may have waiting at once (default 2048 MB)
tapqueue-admin server set job-history <days|0|default>
Delete finished jobs' history after this many days
(default 0: never; otherwise at least 32)
tapqueue-admin server set activity-log <days|0|default>
Keep the activity log this long (default 90; 0: for ever)
tapqueue-admin server set time-zone <name|default>
Where days start for page limits, reports and the daily
backup and sync, e.g. Europe/Oslo (default: the server's own)
tapqueue-admin server set tap-wait|printer-busy|printer-send <seconds|default>
How long a tap waits for the printer (5), a busy printer
is retried (120) and one job may take to send (300)
tapqueue-admin server set sign-in-attempts|sign-in-lockout <number|default>
Wrong passwords before sign-in is refused (5), and for
how many minutes (15); see admin-roles.md
tapqueue-admin server log [--follow] Recent server log lines; --follow keeps printing new ones
tapqueue-admin server restart Restart tapqueue-server (only when systemd runs it)
tapqueue-admin server enrollment-code new|off Make new PCs give a code to register (shown once), or stop asking
tapqueue-admin backups Backups on the server, and the daily schedule (see backup.md)
tapqueue-admin backups create Make a backup now
tapqueue-admin backups download <name|latest> [file]
Copy a backup here
tapqueue-admin backups delete <name> Delete a backup
tapqueue-admin backups schedule <HH:MM|off> When the daily backup runs, in the server's time zone
tapqueue-admin backups keep <number> How many daily backups to keep
tapqueue-admin notifications Email alerts: the mail server, who gets them, what's wrong now (see notifications.md)
tapqueue-admin notifications test Send a test email to everyone on the list
tapqueue-admin notifications on|off Turn the emails on or off (the mail server is set in the console)
tapqueue-admin --help shows every option.
A page limit is a number of pages per day, week (from Monday) or calendar month, counted in the
server's time zone (the server machine's own unless you set one: tapqueue-admin server set time-zone Europe/Oslo). Pages are counted when a job is
released: its pages (after any page range the user picked) times copies. TapQueue counts pages
in PDF, PWG raster, Apple raster and JPEG documents; anything else counts as 1 page per copy and
shows ? in tapqueue-admin jobs.
- A limit on a user overrides their groups'.
- Otherwise the limits of their groups apply, and a job prints if any of them allows it (the most generous wins). Groups without a limit don't lift anyone's.
- Someone with no limit on them or any of their groups can print as much as they like.
sudo tapqueue-admin groups quota students 200 month
sudo tapqueue-admin users quota asmith 500 month # this person gets more
sudo tapqueue-admin quotasWhat happens to a job that would go over is up to you (server set quota-overrun):
| Setting | A job prints when |
|---|---|
allow (default) |
the person is under their limit when it starts, even if it takes them over |
deny |
it fits in the pages they have left |
A job that can't be released stays held, and the station, client or console says why.
Roles in the admin console, and local users' console passwords. Full admins only (the admin token is one). See admin-roles.md.
tapqueue-admin admins # people, their roles, and every grant
tapqueue-admin admins grant alice admin # admin in every area: a full admin
tapqueue-admin admins grant @helpdesk operator --area jobs,fleet
tapqueue-admin admins revoke 3 # grant id from `admins`
tapqueue-admin users password alice # asks for it twice
tapqueue-admin users password alice --clear
The first of these that's set wins:
--server <url>,--token <token>and--fingerprint <sha256>TAPQUEUE_SERVER,TAPQUEUE_ADMIN_TOKENandTAPQUEUE_SERVER_FINGERPRINT~/.config/tapqueue/admin.toml:server_url = "https://tapqueue-server:8632" token = "<admin.token from server.toml>" # The server's self-signed certificate (`sudo tapqueue-admin server` on the server shows it) server_cert_fingerprint = "AF:EF:98:35:…"
/etc/tapqueue/server.toml, when it can be read (on the server, withsudo). This talks to the server onlocalhost.
The admin token can do anything, so treat it like a root password. From another machine use the
https:// address, so the token isn't sent in the clear; see TLS.