CLI Reference

Complete documentation for the deployally commands.

Installation

curl -fsSL https://get.deployally.com/init.sh | sudo bash

Release candidate channel:

curl -fsSL https://get.deployally.com/init.sh | sudo bash -s -- --rc

Direct binary download:

# x86_64
curl -Lo deployally https://get.deployally.com/x86_64/deployally
chmod +x deployally
sudo mv deployally /usr/local/bin/

# aarch64
curl -Lo deployally https://get.deployally.com/aarch64/deployally
chmod +x deployally
sudo mv deployally /usr/local/bin/

Command Structure

deployally [global-command]
deployally <subcommand> [options]

Global commands (--version, self-update) and the catalog and deploy commands (deploy, validate, template new, templates, apikey) all live at the root level.

Global Commands

`--version` / `-V`

Shows the CLI version.

deployally --version

`--help` / `-h`

Shows help.

deployally --help
deployally deploy --help

`self-update`

Updates the CLI to the latest version from the CDN.

deployally self-update
Flag Description
--rc Use the release candidate channel instead of stable
--force Force reinstall even when already on the latest version

The command downloads the binary, validates it (-V), swaps it in, and restores the backup if anything fails.


Catalog and Deploy Commands

Quick table:

Command Description
validate Validate a catalog or local template
template new Generate a template scaffold from an archetype
deploy Deploy an instance
undeploy Remove an instance (inverse of deploy)
templates List, locate, and identify templates (list, locate, check, identify)
apikey Manage API keys (list, create, show, rotate, revoke)

`validate`

Validates the structure, Reflang references, and archetype contracts of a template.

Syntax

deployally validate --species <SPECIES> [options]

Options

Option Type Default Description
--species string Required. Template species (e.g. memos)
--templates-dir path Directory with local templates; if omitted, the remote catalog is queried
--json bool false Structured JSON output

Exit Codes

Code Meaning
0 Valid, no warnings
1 Valid with warnings
2 Validation errors

Examples

# Validate a catalog template
deployally validate --species memos

# Validate a local template before publishing
deployally validate --species my-app --templates-dir ./templates

# JSON output (programmatic use)
deployally validate --species memos --json

What is validated

  • Template schema (required fields per archetype)
  • Every ${input.X}, ${secrets.X}, etc. has a declared origin
  • Reflang functions are called with the correct arity
  • A healthcheck is declared when the archetype requires it (multi_component_saas)
  • HTTP routes reference existing components
  • ContractIR predicates satisfy the archetype

`template new`

Generates a YAML scaffold for a new template, ready for editing.

Syntax

deployally template new --archetype <A> --species <S> [options]

Options

Option Type Default Description
--archetype enum Required. application, asset, static, worker, multi_component_saas, network_appliance
--species string Required. Template slug (e.g. my-app)
--out path stdout Output file
--port int 8080 Container's internal port
--data-path path Path for the data volume (assets)
--version string 0.1.0 Initial template version
--family string derived Taxonomic family
--repo url Upstream repository URL (reference)
--image string Image reference (e.g. repo/app:1.0)
--listen-port int Host port for direct bind (no proxy)
--provision-action string Action exposed as the per-instance dispatcher

Examples

# Simple application
deployally template new \
  --archetype application \
  --species memos-clone \
  --image neosmemo/memos:0.20 \
  --port 5230 \
  --out memos-clone.yaml

# Asset with a dispatcher for database creation
deployally template new \
  --archetype asset \
  --species my-db \
  --image my-org/db:latest \
  --port 5432 \
  --data-path /var/lib/db \
  --provision-action create-database \
  --out my-db.yaml

# Multi-component SaaS
deployally template new \
  --archetype multi_component_saas \
  --species my-saas \
  --out my-saas.yaml

`deploy`

Deploys an instance of a template.

Syntax

deployally deploy --species <S> --instance-uid <UID> [options]

Options

Option Type Default Description
--species string Required. Template species
--instance-uid string Required. Unique instance identifier (e.g. memos-001)
--apply bool false Actually apply the deploy; without it, runs as an implicit dry-run
--dry-run bool false Show what would happen, without executing
--profile string Template profile (minimal, production, etc.)
--input KEY=VALUE repeatable Set a template input
--variant string default Image variant (e.g. mysql-8.4, mysql-5.7)
--provision-missing-assets bool false Auto-provision assets declared in needs if not running
--offline bool false Force the local-only flow (no registry fetch)
--templates-dir path Use templates from this directory instead of the remote catalog
--source enum local local or remote

Examples

# Basic deploy
deployally deploy --species memos \
  --instance-uid memos-001 \
  --input WEB_HOSTNAME=memos.example.com \
  --apply

# Dry-run to inspect the plan
deployally deploy --species memos \
  --instance-uid memos-001 \
  --input WEB_HOSTNAME=memos.example.com \
  --dry-run

# Production profile
deployally deploy --species mysql \
  --instance-uid mysql-prod \
  --profile production \
  --apply

# Specific variant (MySQL 5.7 instead of 8.4)
deployally deploy --species mysql \
  --instance-uid mysql-legacy \
  --variant mysql-5.7 \
  --apply

# Auto-provision a database for WordPress
deployally deploy --species wordpress \
  --instance-uid blog-001 \
  --input WEB_HOSTNAME=blog.example.com \
  --input ADMIN_EMAIL=admin@example.com \
  --provision-missing-assets \
  --apply

# Deploy a local template
deployally deploy --species my-app \
  --instance-uid my-app-001 \
  --templates-dir ./templates \
  --source local \
  --apply

# Offline mode (no registry calls)
deployally deploy --species memos \
  --instance-uid memos-001 \
  --offline \
  --apply

Execution Pipeline

  1. Fetch: pull the template (local → cache → registry, unless --offline)
  2. Build context: apply defaults from declared inputs; merge with --input
  3. Wizard: prompt for what's missing (compacted by prefix); skipped when --input is exhaustive
  4. Reflang resolve: substitute ${...} across every section
  5. Validate: ContractIR + archetype predicates
  6. Archetype defaults merge: apply networks, CCS labels, restart policy
  7. Preflight: DNS, port conflicts, network existence
  8. Auto-provision (when --provision-missing-assets): bring up missing assets in cascade
  9. Apply: create volumes, networks, containers (Docker SDK)
  10. Wait healthy: poll the declared healthcheck with retry

`undeploy`

Removes an instance created by deploy — the inverse operation. Dry-run is the default: without --apply, the command only prints the removal plan and doesn't touch anything.

Syntax

deployally undeploy --instance-uid <UID> [options]

Options

Option Type Default Description
--instance-uid string Required. Identifier of the instance to remove
--dry-run bool false Show the removal plan without executing (default behavior; the flag just makes the intent explicit)
--apply bool false Remove the instance's containers (label ccs.systems/uid) and the local registry (manifests/<uid>/). Preserves data in /data, legacy volumes, and secrets
--purge-data bool false Used with --apply. Also removes the instance's /data tree (staging config, data, and traefik ≥3.0.5's dynamic/), legacy named volumes {uid}-*, and the secrets directory. Honors the template's lifecycle.on_uninstall.preserve. Requires confirming by typing the instance_uid, or --yes
--yes bool false Skips the interactive purge confirmation; required with -o json|yaml
--force bool false Proceeds with degraded evidence (corrupted record, or unresolvable template on purge) — ignores preserve
-o, --output enum human json or yaml — machine output (Envelope v2.0)

Examples

# Preview (dry-run — doesn't touch anything)
deployally undeploy --instance-uid memos-001

# Remove containers + registry, preserving data (redeploy brings everything back)
deployally undeploy --instance-uid memos-001 --apply

# Full removal (irreversible) — requires typing the instance_uid or --yes
deployally undeploy --instance-uid memos-001 --apply --purge-data --yes

# Machine output for integration (CCS)
deployally undeploy --instance-uid memos-001 --apply --purge-data --yes -o json

What is never removed

  • kind: bind volumes (system paths)
  • The public network
  • Shared assets or tenant databases (declared in deps[])
  • Containers that don't carry the instance's ccs.systems/uid label

Undeploy is local

An instance removed locally may still be registered on the server: running deploy again with the same --instance-uid reprovisions everything (same secrets, same volumes). For a definitive deactivation, unregister the instance on the server.


Configuration File

Default location: /opt/deployally/config.yaml

api:
  url: https://sys.deployally.com
  api_key: da_xxx

defaults:
  source: remote
  profile: development

logging:
  level: info

Environment Variables

Variable Description
DEPLOYALLY_API_URL API URL
DEPLOYALLY_API_KEY API key
DEPLOYALLY_CONFIG Alternate config path
RUST_LOG Log level (debug, info, warn, error)

Global Exit Codes

Code Meaning
0 Success
1 Success with warnings
2 Validation or input error
3 I/O error (Docker, network)
4 Authentication error
5 Resource not found

Next Steps

By Borlot.com.br on 05/06/2026