sklp deploy
sklp deploy [flags] [stack]Description
Pilot a node: apply .sklp/<stack>/deploy.yaml to it and inspect what runs
Arguments
| Argument | Required | Notes |
|---|---|---|
| stack | no |
Flags
| Flag | Aliases | Type | Default | Env | Description |
|---|---|---|---|---|---|
| --space | — | string | production | — | space to deploy (named or ephemeral) |
| --repo | — | string | . | — | repository root the deploy file is relative to |
| --force | — | bool | — | — | adopt a space already deployed by a DIFFERENT stack (else the cross-stack re-apply is refused to avoid reconciling away the owner's services) |
| --local | — | bool | — | — | force the LOCAL socket transport even when the active context is remote |
| --context | — | string | — | — | deploy context to target (required for a remote apply: the active context is never used implicitly) |
| --server | -addr | string | — | — | remote supervisor control API (https://host:9443); when set, apply over the network instead of the local socket |
| --token | — | string | — | — | Bearer token for --server (prefer the context/SKLP_TOKEN) |
| --token-file | — | string | — | — | file holding the Bearer token for --server |
| --ca-fingerprint | — | string | — | — | pin the server certificate sha256 for --server |
| --insecure | — | bool | — | — | skip TLS verification for --server (LAN bootstrap only) |
Subcommands
- apply
Apply .sklp/<stack>/deploy.yaml to the node named by -context (required; no stack: list the choices)
- context
Select the active deploy target (kubeconfig-style): list | use | current
- datastores
List the data each space keeps and how well it is protected
- delete
Delete a deployed space's runtime (stop containers, remove its artifacts)
- exec
Run a command (or open a shell) inside a live instance
- fingerprint
Print the space's TLS cert fingerprint
- get
Show one deploy's detail (readiness + instances)
- login
Save remote control credentials (server, token, ca-fingerprint) into a deploy context
- logs
Stream (or follow with -f) a service's container output
- ls
List running instances of a deploy
- mesh
Inspect the WireGuard mesh as the node sees it (ls | rm <id>)
- restart
Bounce every live instance of a service
- restores
List the node's restore drills with the latest verdict of each
- token
Print the space's network Bearer token
Technical details
Technical details
Raw command JSON
{
"path": [
"sklp",
"deploy"
],
"slug": "deploy",
"name": "deploy",
"short": "Pilot a node: apply .sklp/<stack>/deploy.yaml to it and inspect what runs",
"synopsis": "sklp deploy [flags] [stack]",
"flags": [
{
"name": "space",
"usage": "space to deploy (named or ephemeral)",
"type": "string",
"default": "production"
},
{
"name": "repo",
"usage": "repository root the deploy file is relative to",
"type": "string",
"default": "."
},
{
"name": "force",
"usage": "adopt a space already deployed by a DIFFERENT stack (else the cross-stack re-apply is refused to avoid reconciling away the owner's services)",
"type": "bool"
},
{
"name": "local",
"usage": "force the LOCAL socket transport even when the active context is remote",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to target (required for a remote apply: the active context is never used implicitly)",
"type": "string"
},
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443); when set, apply over the network instead of the local socket",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer the context/SKLP_TOKEN)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate sha256 for --server",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only)",
"type": "bool"
}
],
"positionals": [
{
"name": "stack",
"required": false
}
],
"subcommands": [
{
"path": [
"sklp",
"deploy",
"apply"
],
"slug": "deploy-apply",
"name": "apply",
"short": "Apply .sklp/<stack>/deploy.yaml to the node named by -context (required; no stack: list the choices)",
"synopsis": "sklp deploy apply [flags] [stack]",
"flags": [
{
"name": "space",
"usage": "space to deploy (named or ephemeral)",
"type": "string",
"default": "production"
},
{
"name": "repo",
"usage": "repository root the deploy file is relative to",
"type": "string",
"default": "."
},
{
"name": "force",
"usage": "adopt a space already deployed by a DIFFERENT stack",
"type": "bool"
},
{
"name": "local",
"usage": "force the LOCAL socket transport even when the active context is remote",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to target (required for a remote apply: the active context is never used implicitly)",
"type": "string"
},
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443)",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer the context/SKLP_TOKEN)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate sha256 for --server",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only)",
"type": "bool"
}
],
"positionals": [
{
"name": "stack",
"required": false
}
]
},
{
"path": [
"sklp",
"deploy",
"context"
],
"slug": "deploy-context",
"name": "context",
"short": "Select the active deploy target (kubeconfig-style): list | use | current",
"synopsis": "sklp deploy context",
"subcommands": [
{
"path": [
"sklp",
"deploy",
"context",
"current"
],
"slug": "deploy-context-current",
"name": "current",
"short": "Print the active context and where it points",
"synopsis": "sklp deploy context current"
},
{
"path": [
"sklp",
"deploy",
"context",
"list"
],
"slug": "deploy-context-list",
"name": "list",
"short": "List configured contexts; marks the active one with *",
"synopsis": "sklp deploy context list"
},
{
"path": [
"sklp",
"deploy",
"context",
"use"
],
"slug": "deploy-context-use",
"name": "use",
"short": "Set the active context (like `kubectl config use-context`)",
"synopsis": "sklp deploy context use [name]",
"positionals": [
{
"name": "name",
"required": false
}
]
}
]
},
{
"path": [
"sklp",
"deploy",
"datastores"
],
"slug": "deploy-datastores",
"name": "datastores",
"short": "List the data each space keeps and how well it is protected",
"synopsis": "sklp deploy datastores [flags]",
"flags": [
{
"name": "space",
"usage": "space to inspect (empty = every space on the node)",
"type": "string"
},
{
"name": "json",
"usage": "emit JSON on stdout (the form for scripts and AI agents)",
"type": "bool"
},
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443); when set, pilot it over the network instead of the local socket",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer --token-file or SKLP_CONTEXT_TOKEN to keep it out of the process list)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate by its sha256 fingerprint (printed by the server / `sklp deploy fingerprint`)",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only; prefer --ca-fingerprint)",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to read server/token/ca-fingerprint from (default: the active context)",
"type": "string"
},
{
"name": "config",
"usage": "path to a config file to read (one file per node/VM, e.g. lungor.yaml); overrides the default ~/.config/sklp/config.yaml",
"type": "string"
}
]
},
{
"path": [
"sklp",
"deploy",
"delete"
],
"slug": "deploy-delete",
"name": "delete",
"short": "Delete a deployed space's runtime (stop containers, remove its artifacts)",
"synopsis": "sklp deploy delete [flags] [stack]",
"flags": [
{
"name": "file",
"usage": "explicit path to deploy.yaml (overrides the <stack> layout resolution)",
"type": "string"
},
{
"name": "space",
"usage": "space to delete",
"type": "string",
"default": "production"
},
{
"name": "repo",
"usage": "repository root the deploy file is relative to",
"type": "string",
"default": "."
},
{
"name": "v",
"usage": "also destroy the space's named volumes — the data goes with it, irreversibly",
"type": "bool"
},
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443); when set, pilot it over the network instead of the local socket",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer --token-file or SKLP_CONTEXT_TOKEN to keep it out of the process list)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate by its sha256 fingerprint (printed by the server / `sklp deploy fingerprint`)",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only; prefer --ca-fingerprint)",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to read server/token/ca-fingerprint from (default: the active context)",
"type": "string"
},
{
"name": "config",
"usage": "path to a config file to read (one file per node/VM, e.g. lungor.yaml); overrides the default ~/.config/sklp/config.yaml",
"type": "string"
}
],
"positionals": [
{
"name": "stack",
"required": false
}
]
},
{
"path": [
"sklp",
"deploy",
"exec"
],
"slug": "deploy-exec",
"name": "exec",
"short": "Run a command (or open a shell) inside a live instance",
"synopsis": "sklp deploy exec [args…]",
"rawArgs": true
},
{
"path": [
"sklp",
"deploy",
"fingerprint"
],
"slug": "deploy-fingerprint",
"name": "fingerprint",
"short": "Print the space's TLS cert fingerprint",
"synopsis": "sklp deploy fingerprint [flags]",
"flags": [
{
"name": "space",
"usage": "space whose cert fingerprint to print",
"type": "string",
"default": "production"
}
]
},
{
"path": [
"sklp",
"deploy",
"get"
],
"slug": "deploy-get",
"name": "get",
"short": "Show one deploy's detail (readiness + instances)",
"synopsis": "sklp deploy get [flags] [space]",
"flags": [
{
"name": "space",
"usage": "space to inspect (or pass it as a positional)",
"type": "string"
},
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443); when set, pilot it over the network instead of the local socket",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer --token-file or SKLP_CONTEXT_TOKEN to keep it out of the process list)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate by its sha256 fingerprint (printed by the server / `sklp deploy fingerprint`)",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only; prefer --ca-fingerprint)",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to read server/token/ca-fingerprint from (default: the active context)",
"type": "string"
},
{
"name": "config",
"usage": "path to a config file to read (one file per node/VM, e.g. lungor.yaml); overrides the default ~/.config/sklp/config.yaml",
"type": "string"
}
],
"positionals": [
{
"name": "space",
"required": false,
"complete": "space"
}
]
},
{
"path": [
"sklp",
"deploy",
"login"
],
"slug": "deploy-login",
"name": "login",
"short": "Save remote control credentials (server, token, ca-fingerprint) into a deploy context",
"synopsis": "sklp deploy login [flags]",
"flags": [
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443)",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for the control API",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pinned server certificate sha256 fingerprint",
"type": "string"
},
{
"name": "space",
"usage": "default space for this context (like a kubeconfig namespace); a plain `sklp deploy` targets it",
"type": "string"
},
{
"name": "context",
"usage": "context to write (default: the active context, or \"default\" when none is set)",
"type": "string"
}
]
},
{
"path": [
"sklp",
"deploy",
"logs"
],
"slug": "deploy-logs",
"name": "logs",
"short": "Stream (or follow with -f) a service's container output",
"synopsis": "sklp deploy logs [flags] <service>",
"flags": [
{
"name": "file",
"usage": "(deprecated, ignored) logs stream from the live supervisor",
"type": "string"
},
{
"name": "repo",
"usage": "(deprecated, ignored) logs stream from the live supervisor",
"type": "string"
},
{
"name": "space",
"usage": "space the service belongs to",
"type": "string",
"default": "production"
},
{
"name": "follow",
"aliases": [
"f"
],
"usage": "follow the log (tail -f); Ctrl-C to stop",
"type": "bool"
},
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443); when set, pilot it over the network instead of the local socket",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer --token-file or SKLP_CONTEXT_TOKEN to keep it out of the process list)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate by its sha256 fingerprint (printed by the server / `sklp deploy fingerprint`)",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only; prefer --ca-fingerprint)",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to read server/token/ca-fingerprint from (default: the active context)",
"type": "string"
},
{
"name": "config",
"usage": "path to a config file to read (one file per node/VM, e.g. lungor.yaml); overrides the default ~/.config/sklp/config.yaml",
"type": "string"
}
],
"positionals": [
{
"name": "service",
"required": true
}
]
},
{
"path": [
"sklp",
"deploy",
"ls"
],
"slug": "deploy-ls",
"name": "ls",
"short": "List running instances of a deploy",
"synopsis": "sklp deploy ls [flags]",
"flags": [
{
"name": "file",
"usage": "(deprecated, ignored) ls queries the live supervisor",
"type": "string"
},
{
"name": "repo",
"usage": "(deprecated, ignored) ls queries the live supervisor",
"type": "string"
},
{
"name": "space",
"usage": "space to inspect (empty = every live space on this host)",
"type": "string"
},
{
"name": "json",
"usage": "emit JSON on stdout (the form for scripts and AI agents)",
"type": "bool"
},
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443); when set, pilot it over the network instead of the local socket",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer --token-file or SKLP_CONTEXT_TOKEN to keep it out of the process list)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate by its sha256 fingerprint (printed by the server / `sklp deploy fingerprint`)",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only; prefer --ca-fingerprint)",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to read server/token/ca-fingerprint from (default: the active context)",
"type": "string"
},
{
"name": "config",
"usage": "path to a config file to read (one file per node/VM, e.g. lungor.yaml); overrides the default ~/.config/sklp/config.yaml",
"type": "string"
}
]
},
{
"path": [
"sklp",
"deploy",
"mesh"
],
"slug": "deploy-mesh",
"name": "mesh",
"short": "Inspect the WireGuard mesh as the node sees it (ls | rm <id>)",
"synopsis": "sklp deploy mesh",
"subcommands": [
{
"path": [
"sklp",
"deploy",
"mesh",
"ls"
],
"slug": "deploy-mesh-ls",
"name": "ls",
"short": "List the mesh peers meshauthority knows",
"synopsis": "sklp deploy mesh ls [flags]",
"flags": [
{
"name": "json",
"usage": "emit JSON on stdout (the form for scripts and AI agents)",
"type": "bool"
},
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443); when set, pilot it over the network instead of the local socket",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer --token-file or SKLP_CONTEXT_TOKEN to keep it out of the process list)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate by its sha256 fingerprint (printed by the server / `sklp deploy fingerprint`)",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only; prefer --ca-fingerprint)",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to read server/token/ca-fingerprint from (default: the active context)",
"type": "string"
},
{
"name": "config",
"usage": "path to a config file to read (one file per node/VM, e.g. lungor.yaml); overrides the default ~/.config/sklp/config.yaml",
"type": "string"
}
]
},
{
"path": [
"sklp",
"deploy",
"mesh",
"rm"
],
"slug": "deploy-mesh-rm",
"name": "rm",
"short": "Forget a mesh peer silent for 2 minutes (a rebuilt node's old identity); its mesh IP returns to the pool",
"synopsis": "sklp deploy mesh rm [flags] <id>",
"flags": [
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443); when set, pilot it over the network instead of the local socket",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer --token-file or SKLP_CONTEXT_TOKEN to keep it out of the process list)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate by its sha256 fingerprint (printed by the server / `sklp deploy fingerprint`)",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only; prefer --ca-fingerprint)",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to read server/token/ca-fingerprint from (default: the active context)",
"type": "string"
},
{
"name": "config",
"usage": "path to a config file to read (one file per node/VM, e.g. lungor.yaml); overrides the default ~/.config/sklp/config.yaml",
"type": "string"
}
],
"positionals": [
{
"name": "id",
"required": true
}
]
}
]
},
{
"path": [
"sklp",
"deploy",
"restart"
],
"slug": "deploy-restart",
"name": "restart",
"short": "Bounce every live instance of a service",
"synopsis": "sklp deploy restart [flags] <service>",
"flags": [
{
"name": "space",
"usage": "space the service belongs to",
"type": "string",
"default": "production"
},
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443); when set, pilot it over the network instead of the local socket",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer --token-file or SKLP_CONTEXT_TOKEN to keep it out of the process list)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate by its sha256 fingerprint (printed by the server / `sklp deploy fingerprint`)",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only; prefer --ca-fingerprint)",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to read server/token/ca-fingerprint from (default: the active context)",
"type": "string"
},
{
"name": "config",
"usage": "path to a config file to read (one file per node/VM, e.g. lungor.yaml); overrides the default ~/.config/sklp/config.yaml",
"type": "string"
}
],
"positionals": [
{
"name": "service",
"required": true
}
]
},
{
"path": [
"sklp",
"deploy",
"restores"
],
"slug": "deploy-restores",
"name": "restores",
"short": "List the node's restore drills with the latest verdict of each",
"synopsis": "sklp deploy restores [flags]",
"flags": [
{
"name": "json",
"usage": "emit JSON on stdout (the form for scripts and AI agents)",
"type": "bool"
},
{
"name": "server",
"aliases": [
"addr"
],
"usage": "remote supervisor control API (https://host:9443); when set, pilot it over the network instead of the local socket",
"type": "string"
},
{
"name": "token",
"usage": "Bearer token for --server (prefer --token-file or SKLP_CONTEXT_TOKEN to keep it out of the process list)",
"type": "string"
},
{
"name": "token-file",
"usage": "file holding the Bearer token for --server",
"type": "string"
},
{
"name": "ca-fingerprint",
"usage": "pin the server certificate by its sha256 fingerprint (printed by the server / `sklp deploy fingerprint`)",
"type": "string"
},
{
"name": "insecure",
"usage": "skip TLS verification for --server (LAN bootstrap only; prefer --ca-fingerprint)",
"type": "bool"
},
{
"name": "context",
"usage": "deploy context to read server/token/ca-fingerprint from (default: the active context)",
"type": "string"
},
{
"name": "config",
"usage": "path to a config file to read (one file per node/VM, e.g. lungor.yaml); overrides the default ~/.config/sklp/config.yaml",
"type": "string"
}
]
},
{
"path": [
"sklp",
"deploy",
"token"
],
"slug": "deploy-token",
"name": "token",
"short": "Print the space's network Bearer token",
"synopsis": "sklp deploy token [flags]",
"flags": [
{
"name": "space",
"usage": "space whose token to print",
"type": "string",
"default": "production"
}
],
"subcommands": [
{
"path": [
"sklp",
"deploy",
"token",
"rotate"
],
"slug": "deploy-token-rotate",
"name": "rotate",
"short": "Rotate a node's control API token through its API and save the new one into the deploy context",
"synopsis": "sklp deploy token rotate [flags]",
"flags": [
{
"name": "context",
"usage": "deploy context to rotate (default: the active one)",
"type": "string"
}
]
}
]
}
]
}