CLI Reference
Complete documentation for the deployally commands.
Installation
curl -fsSL https://get.deployally.com/init.sh | sudo bashRelease candidate channel:
curl -fsSL https://get.deployally.com/init.sh | sudo bash -s -- --rcDirect binary download:
# x86_64
curl -Lo deployally https://get.deployally.com/x86_64/deployally
chmod +x deployally
sudo mv deployally /usr/local/bin/
# aarch64
curl -Lo deployally https://get.deployally.com/aarch64/deployally
chmod +x deployally
sudo mv deployally /usr/local/bin/Command Structure
deployally [global-command]
deployally <subcommand> [options]Global commands (--version, self-update) and the catalog and deploy commands (deploy, validate, template new, templates, apikey) all live at the root level.
Global Commands
`--version` / `-V`
Shows the CLI version.
deployally --version`--help` / `-h`
Shows help.
deployally --help
deployally deploy --help`self-update`
Updates the CLI to the latest version from the CDN.
deployally self-update| Flag | Description |
|---|---|
--rc |
Use the release candidate channel instead of stable |
--force |
Force reinstall even when already on the latest version |
The command downloads the binary, validates it (-V), swaps it in, and restores the backup if anything fails.
Catalog and Deploy Commands
Quick table:
| Command | Description |
|---|---|
validate |
Validate a catalog or local template |
template new |
Generate a template scaffold from an archetype |
deploy |
Deploy an instance |
undeploy |
Remove an instance (inverse of deploy) |
templates |
List, locate, and identify templates (list, locate, check, identify) |
apikey |
Manage API keys (list, create, show, rotate, revoke) |
`validate`
Validates the structure, Reflang references, and archetype contracts of a template.
Syntax
deployally validate --species <SPECIES> [options]Options
| Option | Type | Default | Description |
|---|---|---|---|
--species |
string | — | Required. Template species (e.g. memos) |
--templates-dir |
path | — | Directory with local templates; if omitted, the remote catalog is queried |
--json |
bool | false |
Structured JSON output |
Exit Codes
| Code | Meaning |
|---|---|
| 0 | Valid, no warnings |
| 1 | Valid with warnings |
| 2 | Validation errors |
Examples
# Validate a catalog template
deployally validate --species memos
# Validate a local template before publishing
deployally validate --species my-app --templates-dir ./templates
# JSON output (programmatic use)
deployally validate --species memos --jsonWhat is validated
- Template schema (required fields per archetype)
- Every
${input.X},${secrets.X}, etc. has a declared origin - Reflang functions are called with the correct arity
- A healthcheck is declared when the archetype requires it (multi_component_saas)
- HTTP routes reference existing components
- ContractIR predicates satisfy the archetype
`template new`
Generates a YAML scaffold for a new template, ready for editing.
Syntax
deployally template new --archetype <A> --species <S> [options]Options
| Option | Type | Default | Description |
|---|---|---|---|
--archetype |
enum | — | Required. application, asset, static, worker, multi_component_saas, network_appliance |
--species |
string | — | Required. Template slug (e.g. my-app) |
--out |
path | stdout | Output file |
--port |
int | 8080 | Container's internal port |
--data-path |
path | — | Path for the data volume (assets) |
--version |
string | 0.1.0 |
Initial template version |
--family |
string | derived | Taxonomic family |
--repo |
url | — | Upstream repository URL (reference) |
--image |
string | — | Image reference (e.g. repo/app:1.0) |
--listen-port |
int | — | Host port for direct bind (no proxy) |
--provision-action |
string | — | Action exposed as the per-instance dispatcher |
Examples
# Simple application
deployally template new \
--archetype application \
--species memos-clone \
--image neosmemo/memos:0.20 \
--port 5230 \
--out memos-clone.yaml
# Asset with a dispatcher for database creation
deployally template new \
--archetype asset \
--species my-db \
--image my-org/db:latest \
--port 5432 \
--data-path /var/lib/db \
--provision-action create-database \
--out my-db.yaml
# Multi-component SaaS
deployally template new \
--archetype multi_component_saas \
--species my-saas \
--out my-saas.yaml`deploy`
Deploys an instance of a template.
Syntax
deployally deploy --species <S> --instance-uid <UID> [options]Options
| Option | Type | Default | Description |
|---|---|---|---|
--species |
string | — | Required. Template species |
--instance-uid |
string | — | Required. Unique instance identifier (e.g. memos-001) |
--apply |
bool | false |
Actually apply the deploy; without it, runs as an implicit dry-run |
--dry-run |
bool | false |
Show what would happen, without executing |
--profile |
string | — | Template profile (minimal, production, etc.) |
--input KEY=VALUE |
repeatable | — | Set a template input |
--variant |
string | default | Image variant (e.g. mysql-8.4, mysql-5.7) |
--provision-missing-assets |
bool | false |
Auto-provision assets declared in needs if not running |
--offline |
bool | false |
Force the local-only flow (no registry fetch) |
--templates-dir |
path | — | Use templates from this directory instead of the remote catalog |
--source |
enum | local |
local or remote |
Examples
# Basic deploy
deployally deploy --species memos \
--instance-uid memos-001 \
--input WEB_HOSTNAME=memos.example.com \
--apply
# Dry-run to inspect the plan
deployally deploy --species memos \
--instance-uid memos-001 \
--input WEB_HOSTNAME=memos.example.com \
--dry-run
# Production profile
deployally deploy --species mysql \
--instance-uid mysql-prod \
--profile production \
--apply
# Specific variant (MySQL 5.7 instead of 8.4)
deployally deploy --species mysql \
--instance-uid mysql-legacy \
--variant mysql-5.7 \
--apply
# Auto-provision a database for WordPress
deployally deploy --species wordpress \
--instance-uid blog-001 \
--input WEB_HOSTNAME=blog.example.com \
--input ADMIN_EMAIL=admin@example.com \
--provision-missing-assets \
--apply
# Deploy a local template
deployally deploy --species my-app \
--instance-uid my-app-001 \
--templates-dir ./templates \
--source local \
--apply
# Offline mode (no registry calls)
deployally deploy --species memos \
--instance-uid memos-001 \
--offline \
--applyExecution Pipeline
- Fetch: pull the template (local → cache → registry, unless
--offline) - Build context: apply defaults from declared inputs; merge with
--input - Wizard: prompt for what's missing (compacted by prefix); skipped when
--inputis exhaustive - Reflang resolve: substitute
${...}across every section - Validate: ContractIR + archetype predicates
- Archetype defaults merge: apply networks, CCS labels, restart policy
- Preflight: DNS, port conflicts, network existence
- Auto-provision (when
--provision-missing-assets): bring up missing assets in cascade - Apply: create volumes, networks, containers (Docker SDK)
- Wait healthy: poll the declared healthcheck with retry
`undeploy`
Removes an instance created by deploy — the inverse operation. Dry-run
is the default: without --apply, the command only prints the removal plan
and doesn't touch anything.
Syntax
deployally undeploy --instance-uid <UID> [options]Options
| Option | Type | Default | Description |
|---|---|---|---|
--instance-uid |
string | — | Required. Identifier of the instance to remove |
--dry-run |
bool | false |
Show the removal plan without executing (default behavior; the flag just makes the intent explicit) |
--apply |
bool | false |
Remove the instance's containers (label ccs.systems/uid) and the local registry (manifests/<uid>/). Preserves data in /data, legacy volumes, and secrets |
--purge-data |
bool | false |
Used with --apply. Also removes the instance's /data tree (staging config, data, and traefik ≥3.0.5's dynamic/), legacy named volumes {uid}-*, and the secrets directory. Honors the template's lifecycle.on_uninstall.preserve. Requires confirming by typing the instance_uid, or --yes |
--yes |
bool | false |
Skips the interactive purge confirmation; required with -o json|yaml |
--force |
bool | false |
Proceeds with degraded evidence (corrupted record, or unresolvable template on purge) — ignores preserve |
-o, --output |
enum | human |
json or yaml — machine output (Envelope v2.0) |
Examples
# Preview (dry-run — doesn't touch anything)
deployally undeploy --instance-uid memos-001
# Remove containers + registry, preserving data (redeploy brings everything back)
deployally undeploy --instance-uid memos-001 --apply
# Full removal (irreversible) — requires typing the instance_uid or --yes
deployally undeploy --instance-uid memos-001 --apply --purge-data --yes
# Machine output for integration (CCS)
deployally undeploy --instance-uid memos-001 --apply --purge-data --yes -o jsonWhat is never removed
kind: bindvolumes (system paths)- The
publicnetwork - Shared assets or tenant databases (declared in
deps[]) - Containers that don't carry the instance's
ccs.systems/uidlabel
Undeploy is local
An instance removed locally may still be registered on the server: running
deploy again with the same --instance-uid reprovisions everything (same
secrets, same volumes). For a definitive deactivation, unregister the instance
on the server.
Configuration File
Default location: /opt/deployally/config.yaml
api:
url: https://sys.deployally.com
api_key: da_xxx
defaults:
source: remote
profile: development
logging:
level: infoEnvironment Variables
| Variable | Description |
|---|---|
DEPLOYALLY_API_URL |
API URL |
DEPLOYALLY_API_KEY |
API key |
DEPLOYALLY_CONFIG |
Alternate config path |
RUST_LOG |
Log level (debug, info, warn, error) |
Global Exit Codes
| Code | Meaning |
|---|---|
| 0 | Success |
| 1 | Success with warnings |
| 2 | Validation or input error |
| 3 | I/O error (Docker, network) |
| 4 | Authentication error |
| 5 | Resource not found |
Next Steps
- Reflang Reference — full template language syntax
- Getting Started — first deploy
- Templates — how archetypes work
- API Integration — programmatic use (restricted)