# noust app

Change how a deployed application is laid out and what it may use.

```bash
noust app [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`adopt`](#noust-app-adopt), [`adopt-site`](#noust-app-adopt-site), [`apply`](#noust-app-apply), [`backup-before-update`](#noust-app-backup-before-update), [`backup-required`](#noust-app-backup-required), [`branch`](#noust-app-branch), [`build`](#noust-app-build), [`cache`](#noust-app-cache), [`clone`](#noust-app-clone), [`compose`](#noust-app-compose), [`container`](#noust-app-container), [`deploy-key`](#noust-app-deploy-key), [`deploy-log`](#noust-app-deploy-log), [`discover`](#noust-app-discover), [`disk`](#noust-app-disk), [`exec`](#noust-app-exec), [`export`](#noust-app-export), [`files`](#noust-app-files), [`follow-tags`](#noust-app-follow-tags), [`git-credential`](#noust-app-git-credential), [`hardening`](#noust-app-hardening), [`headless`](#noust-app-headless), [`health`](#noust-app-health), [`hooks`](#noust-app-hooks), [`identity`](#noust-app-identity), [`import`](#noust-app-import), [`limits`](#noust-app-limits), [`migrate`](#noust-app-migrate), [`mount`](#noust-app-mount), [`move`](#noust-app-move), [`networks`](#noust-app-networks), [`packages`](#noust-app-packages), [`pending`](#noust-app-pending), [`policy`](#noust-app-policy), [`process`](#noust-app-process), [`process-types`](#noust-app-process-types), [`promote`](#noust-app-promote), [`promotion`](#noust-app-promotion), [`reclaim`](#noust-app-reclaim), [`replicas`](#noust-app-replicas), [`replication`](#noust-app-replication), [`sandbox`](#noust-app-sandbox), [`source`](#noust-app-source), [`stop-grace`](#noust-app-stop-grace), [`tag`](#noust-app-tag), [`traffic`](#noust-app-traffic), [`tuning`](#noust-app-tuning), [`webhook`](#noust-app-webhook), [`zero-downtime`](#noust-app-zero-downtime)

## noust app adopt

Register a Docker Compose stack that already runs, without touching it.

```bash
noust app adopt [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--path` | The directory the stack runs from, such as /opt/shop. |  |
| `--compose-file` | Its compose file, relative to --path (found among the usual names otherwise). |  |
| `--source` | Where updates fetch from (default: origin). |  |
| `--branch` | The branch updates follow (default: the current). |  |
| `--site` | The site file serving the domain (found by its names otherwise). |  |
| `--port` | The port to register (the compose file's web port otherwise). |  |
| `--accept-recreate` | Adopt even if starting the stack as Noust would recreate something. |  |
| `--yes`, `-y` | Adopt without asking. |  |
| `--json` | Print what was adopted as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app adopt-site

Register a site that already runs on nginx or Apache, without rebuilding it.

```bash
noust app adopt-site [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--site` | The site file serving the domain (found otherwise). |  |
| `--unit` | The unit the site is in front of (the one that listens on its port otherwise). |  |
| `--path` | The directory of its files (the unit's WorkingDirectory or the site's root otherwise). |  |
| `--yes`, `-y` | Adopt without asking. |  |
| `--json` | Print what was adopted as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app apply

Set an application from a declaration file, as 'noust app export --as-yaml' writes one.

```bash
noust app apply [OPTIONS] DOMAIN FILE
```

Arguments: `domain`, `file`

| Option | What it does | Default |
|---|---|---|
| `--prune` | Also remove the aliases, redirects and tasks the file does not name. |  |
| `--check` | Show what would change and change nothing. |  |
| `--yes`, `-y` | Do not ask before applying what runs commands (build, hooks, tasks, Compose arguments). |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the plan and what was applied as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app backup-before-update

Show or set whether an update copies a stack's databases first.

```bash
noust app backup-before-update [OPTIONS] DOMAIN [on|off]
```

Arguments: `domain`, `state`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the setting as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app backup-required

Show or set whether an update is refused when its backup fails.

```bash
noust app backup-required [OPTIONS] DOMAIN [on|off|default]
```

Arguments: `domain`, `state`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the setting as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app branch

Show, pin or unpin the branch an application deploys from.

```bash
noust app branch [OPTIONS] DOMAIN [BRANCH]
```

Arguments: `domain`, `branch`

| Option | What it does | Default |
|---|---|---|
| `--unpin` | Deploy any branch a push names. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the branch as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app build

The commands an application is installed, built and started with: see, set or unset them.

```bash
noust app build [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`set`](#noust-app-build-set), [`show`](#noust-app-build-show), [`unset`](#noust-app-build-unset)

## noust app build set

Set an application's build block, replacing the repository's noust.yaml whole.

```bash
noust app build set [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--base-directory` | The subdirectory of the repository the project lives in (apps/web). |  |
| `--install` | Replaces the install command. |  |
| `--build` | Replaces the build command. |  |
| `--start` | Replaces the start command. systemd expands ${PORT}; it is never run by a shell. |  |
| `--publish-directory` | Where a static build leaves the files the web server serves, from the project. |  |
| `--runtime` | Pin the runtime: node@22, python@3.12 or php@8.3. |  |
| `--cache`, `--no-cache` | --no-cache builds every deployment from scratch, without the package managers' cache or the dependencies of the release that serves. |  |
| `--timeout` | How long the install and the build may each take before they are stopped (the server's deploy.install_timeout and deploy.build_timeout otherwise). |  |
| `--file` | Replace the whole block with a YAML file holding 'build:'; '-' reads stdin. |  |
| `--json` | Print the build block now in force as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app build show

Show the build block the next deployment of an application uses, and where it comes from.

```bash
noust app build show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the build block as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app build unset

Remove keys of the operator's block, or all of it, so the repository's applies again.

```bash
noust app build unset [OPTIONS] DOMAIN [KEY]...
```

Arguments: `domain`, `keys`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app cache

The cache the package managers keep between an application's builds.

```bash
noust app cache [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`clear`](#noust-app-cache-clear), [`show`](#noust-app-cache-show)

## noust app cache clear

Empty an application's build cache; its next build downloads what it needs again.

```bash
noust app cache clear [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what was freed as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app cache show

Show where an application's build cache is and how much it holds.

```bash
noust app cache show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the cache as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app clone

Clone an application: the same application on NEW_DOMAIN.

```bash
noust app clone [OPTIONS] DOMAIN NEW_DOMAIN
```

Arguments: `domain`, `new_domain`

| Option | What it does | Default |
|---|---|---|
| `--database` | What the clone does with the application's database: 'empty' makes one of its own, 'share' uses the original's (and writes into its data). Required when the application has a database. |  |
| `--source` | Deploy the clone from this source instead. |  |
| `--yes`, `-y` | Do not ask before cloning. |  |
| `--team` | The team it goes to (default: the original's). |  |
| `--project` | The project it goes to (default: the original's). |  |
| `--environment` | The environment it goes to (default: the original's). |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print what was applied as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app compose

The compose file, profiles and extra arguments of a Docker Compose stack.

```bash
noust app compose [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`document`](#noust-app-compose-document), [`replace`](#noust-app-compose-replace), [`reset`](#noust-app-compose-reset), [`set`](#noust-app-compose-set), [`show`](#noust-app-compose-show), [`variables`](#noust-app-compose-variables)

## noust app compose document

Print the Compose document a stack runs from.

```bash
noust app compose document [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the document and where Noust keeps it as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app compose replace

Replace the Compose document a stack runs from.

```bash
noust app compose replace [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--from` | The new document; - reads standard input. |  |
| `--check` | Only judge it: write nothing and run nothing. |  |
| `--apply` | Update the stack to run it now, behind the health gate; without it the stack runs it at its next update. |  |
| `--json` | Print the outcome as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app compose reset

Forget the choices; the unit's own record of the file applies again.

```bash
noust app compose reset [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app compose set

Change what a Compose stack is run with, keeping what is not named.

```bash
noust app compose set [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--file` | The compose file, relative to the project. |  |
| `--profile` | A profile to activate; repeat it. Replaces the profiles. |  |
| `--no-profiles` | Activate no profile. |  |
| `--build-args` | Extra arguments of 'docker compose build', as one quoted line. Allowed: --build-arg, --no-cache, --progress, --pull, --quiet, --with-dependencies, -q. |  |
| `--up-args` | Extra arguments of 'docker compose up', as one quoted line. Allowed: --always-recreate-deps, --force-recreate, --no-deps, --pull, --renew-anon-volumes, --scale, --timeout, --wait, --wait-timeout, -V, -t. |  |
| `--service` | Build and start only this service (and what it depends on); repeat it. |  |
| `--all-services` | Build and start every service again. |  |
| `--json` | Print the settings now in force as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app compose show

Show what a Compose stack is run with.

```bash
noust app compose show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the settings as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app compose variables

Show the variables the compose file asks for and which of them the stack has.

```bash
noust app compose variables [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the variables as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app container

How a container application is built and run: see it, change it.

```bash
noust app container [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`check`](#noust-app-container-check), [`set`](#noust-app-container-set), [`show`](#noust-app-container-show)

## noust app container check

Ask the registry whether the tag of an image application points at a new image.

```bash
noust app container check [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the finding as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app container set

Change how a container application is built and run.

```bash
noust app container set [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--image` | Deploy this image from a registry: name[:tag][@sha256:digest]. Needs no source. |  |
| `--builder` | How a repository becomes an image: its Dockerfile, or Railpack, which needs none (noust setup railpack). |  |
| `--dockerfile` | The Dockerfile, relative to the repository. Default: Dockerfile or Containerfile in the context. |  |
| `--context` | The build context, relative to the repository. Default: its root. |  |
| `--target` | The stage of a multi-stage Dockerfile to build. |  |
| `--build-arg` | A build argument (not a secret: it is written into the image). Repeat for several. |  |
| `--build-secret` | A secret the build mounts, read from FILE and kept in the secret store; never an argument of the build. Repeat for several. |  |
| `--container-port` | Where the process listens inside the container. Default: what the Dockerfile or the image exposes. |  |
| `--volume` | A path in the container whose data survives every deployment, such as /data. Repeat for several. |  |
| `--restart` | Docker's restart policy: no, always, unless-stopped (default) or on-failure. |  |
| `--entrypoint` | Run this program instead of the image's ENTRYPOINT: the line is split into words the way a shell would, and no shell runs it. An empty line clears the image's entrypoint (its CMD is then the program). Setting one drops the image's CMD: give --command too if it should still apply. |  |
| `--command` | Give the entrypoint these arguments instead of the image's CMD (split into words, no shell). Docker cannot clear a CMD: an empty line is refused; --clear command goes back to the image's. |  |
| `--registry-server` | The registry the account is for. Default: the image's own. |  |
| `--registry-user` | The account of a private registry. |  |
| `--registry-password-stdin` | Read the account's password from standard input. |  |
| `--remove-build-arg` | Remove a build argument. |  |
| `--remove-build-secret` | Remove a build secret, and its value. |  |
| `--remove-volume` | Stop keeping this path across deployments. The volume's data stays on the server. |  |
| `--clear` | Go back to the default of a setting: it is read from the Dockerfile or the image again. |  |
| `--clear-registry` | Remove the registry account. |  |
| `--json` | Print the settings now as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app container show

Show how a container application is built and run.

```bash
noust app container show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the settings as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key

An SSH key of its own for the repository an application is built from.

```bash
noust app deploy-key [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`assign`](#noust-app-deploy-key-assign), [`forget-host`](#noust-app-deploy-key-forget-host), [`generate`](#noust-app-deploy-key-generate), [`hosts`](#noust-app-deploy-key-hosts), [`import`](#noust-app-deploy-key-import), [`list`](#noust-app-deploy-key-list), [`pin-host`](#noust-app-deploy-key-pin-host), [`prune`](#noust-app-deploy-key-prune), [`remove`](#noust-app-deploy-key-remove), [`rotate`](#noust-app-deploy-key-rotate), [`show`](#noust-app-deploy-key-show), [`test`](#noust-app-deploy-key-test)

## noust app deploy-key assign

Make an existing key the one that reaches this application's repository.

```bash
noust app deploy-key assign [OPTIONS] DOMAIN KEY
```

Arguments: `domain`, `key`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key forget-host

Forget a pinned host key, so the next connection pins the one the host shows now.

```bash
noust app deploy-key forget-host [OPTIONS] HOST
```

Arguments: `host`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key generate

Make an ed25519 key, with no passphrase, for the application's repository.

```bash
noust app deploy-key generate [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--name` | The key's name. The application's name by default. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the key as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key hosts

List the SSH host keys Noust pinned the first time it connected to each code host.

```bash
noust app deploy-key hosts [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the pinned host keys as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key import

Use a private key you already have as the application's deploy key.

```bash
noust app deploy-key import [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--private-key-file` | File with the private key, or - to read it from standard input. It must have no passphrase. |  |
| `--name` | The key's name. The application's name by default. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the key as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key list

List every deploy key and the applications it reaches.

```bash
noust app deploy-key list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the keys as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key pin-host

Pin a code host's SSH key before the first connection, by the fingerprint it publishes.

```bash
noust app deploy-key pin-host [OPTIONS] HOST
```

Arguments: `host`

| Option | What it does | Default |
|---|---|---|
| `--fingerprint` | The host key's fingerprint, from the code host's own published list. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the pinned host key as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key prune

Delete the deploy keys whose repositories no application is built from any more.

```bash
noust app deploy-key prune [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key remove

Take the repository off its deploy key, and delete the key when nothing else uses it.

```bash
noust app deploy-key remove [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key rotate

Make the key that will replace the application's, keeping the old one working.

```bash
noust app deploy-key rotate [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--finish` | Ask the code host with the new key now; if it answers, the new key replaces the old. |  |
| `--cancel` | Give up the rotation; the old key stays. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the key as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key show

Show the deploy key of an application's repository, and the public half to add at the code host.

```bash
noust app deploy-key show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the key (never its private half) as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-key test

Ask the repository for its branches with the deploy key, as a deploy would.

```bash
noust app deploy-key test [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app deploy-log

Print the captured log of a deployment of an application.

```bash
noust app deploy-log [OPTIONS] DOMAIN [DEPLOYMENT_ID]
```

Arguments: `domain`, `deployment_id`

| Option | What it does | Default |
|---|---|---|
| `--level` | warn keeps warnings and errors; error keeps only errors. | `all` |
| `--search` | Keep only the lines that hold this text, ignoring case. |  |
| `--timestamps`, `--no-timestamps` | Keep each line's stamp. |  |
| `--sanitize` | Mask what looks like a credential and strip control sequences, to share the log. |  |
| `--tail` | Only this many bytes, from the end. |  |
| `--json` | Print the log and whether it was cut as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app discover

List the sites on this server that Noust did not deploy, and what each one is.

```bash
noust app discover [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the sites as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app disk

Show what the application takes of the disk, and the limit its deploys are held to.

```bash
noust app disk [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--measure` | Measure what it takes now, and keep the answer. |  |
| `--limit` | Hold deploys to this many megabytes: a new release is refused while it is over. |  |
| `--no-limit` | Remove the limit. |  |
| `--kernel`, `--no-kernel` | Give the limit to the kernel as a project quota (XFS or ext4 mounted with prjquota), or take it off. The writes themselves are then refused at the limit. |  |
| `--json` | Print the disk as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app exec

Run one command in an application, as the application: noust app exec DOMAIN -- PROGRAM ARGS.

```bash
noust app exec [OPTIONS] DOMAIN [COMMAND]...
```

Arguments: `domain`, `command`

| Option | What it does | Default |
|---|---|---|
| `--service` | The Compose service to run it in, for a stack that runs several. |  |
| `--timeout` | Seconds it may run; 300 by default, at most terminal.exec.max_seconds. |  |
| `--json` | Print how it went as JSON, after its output. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app export

Export everything that defines an application as a JSON document.

```bash
noust app export [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--with-secrets` | Include the values of secret variables. The file is written 0600. |  |
| `-o`, `--output` | Write the export to this file instead of printing it. |  |
| `--as-yaml` | Write a declaration (noust.yaml keys: health, limits, source, build, hooks, variables, domains, tasks) that 'noust app apply' sets on a server, instead of the JSON export. Secret variables are never written. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | The export is JSON already; accepted for scripts that always pass it. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app files

The files of an application, as its own account.

```bash
noust app files [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`get`](#noust-app-files-get), [`list`](#noust-app-files-list), [`mkdir`](#noust-app-files-mkdir), [`move`](#noust-app-files-move), [`put`](#noust-app-files-put), [`remove`](#noust-app-files-remove)

## noust app files get

Copy a file out of the application: to DESTINATION, or to standard output.

```bash
noust app files get [OPTIONS] DOMAIN PATH [DESTINATION]
```

Arguments: `domain`, `path`, `destination`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app files list

List a directory of the application (its own directory by default).

```bash
noust app files list [OPTIONS] DOMAIN [PATH]
```

Arguments: `domain`, `path`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the listing as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app files mkdir

Create a directory whose parent exists.

```bash
noust app files mkdir [OPTIONS] DOMAIN PATH
```

Arguments: `domain`, `path`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app files move

Rename or move something inside the application.

```bash
noust app files move [OPTIONS] DOMAIN SOURCE DESTINATION
```

Arguments: `domain`, `source`, `destination`

| Option | What it does | Default |
|---|---|---|
| `--replace` | Replace what is at DESTINATION. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app files put

Copy a local file into the application at PATH, as the application's account.

```bash
noust app files put [OPTIONS] DOMAIN SOURCE PATH
```

Arguments: `domain`, `source`, `path`

| Option | What it does | Default |
|---|---|---|
| `--replace` | Replace a file that is there. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app files remove

Delete a file, a link, or a directory. A link is removed, never what it points at.

```bash
noust app files remove [OPTIONS] DOMAIN PATH
```

Arguments: `domain`, `path`

| Option | What it does | Default |
|---|---|---|
| `--recursive`, `-r` | Delete a directory and what is in it. |  |
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app follow-tags

Show, set or clear the tags an application deploys.

```bash
noust app follow-tags [OPTIONS] DOMAIN [PATTERN]
```

Arguments: `domain`, `pattern`

| Option | What it does | Default |
|---|---|---|
| `--off` | Follow a branch again instead of tags. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print what the application follows as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app git-credential

The user and token a private https repository needs, kept as a secret.

```bash
noust app git-credential [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`remove`](#noust-app-git-credential-remove), [`set`](#noust-app-git-credential-set), [`show`](#noust-app-git-credential-show)

## noust app git-credential remove

Forget the credential of the application's repository.

```bash
noust app git-credential remove [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app git-credential set

Keep the user and token git signs in to this application's repository with.

```bash
noust app git-credential set [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--username`, `-u` | The user to sign in as. |  |
| `--secret-file` | File with the token, or - for standard input. Without it the token is asked for without echo. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app git-credential show

Say whether the application's repository has a credential, and as whom.

```bash
noust app git-credential show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the state (never the token) as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app hardening

The sandbox an application's unit runs in: see it, or change it.

```bash
noust app hardening [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`set`](#noust-app-hardening-set), [`status`](#noust-app-hardening-status)

## noust app hardening set

Run the application's unit in this sandbox: off, default or strict.

```bash
noust app hardening set [OPTIONS] DOMAIN {off|default|strict}
```

Arguments: `domain`, `profile`

| Option | What it does | Default |
|---|---|---|
| `--writable` | A directory the unit may write to besides the application's own tree; repeat it. Without any, the ones it has are kept. |  |
| `--no-writable` | Forget the extra writable directories it has. |  |
| `--no-restart` | Write the unit but do not restart: the running process keeps its sandbox. |  |
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app hardening status

Show the sandbox of the application's unit and how exposed systemd finds it.

```bash
noust app hardening status [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app headless

Record a Docker Compose stack that publishes no port as a worker.

```bash
noust app headless [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--remove-site`, `--keep-site` | Also remove the site Noust wrote for it (asked when not given). |  |
| `--yes`, `-y` | Remove the site without asking. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app health

Show or set what the health gate asks of an application.

```bash
noust app health [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--path` | Path the health check requests, such as /healthz. |  |
| `--expect` | Statuses that mean up: 200-399, or 200,204. Default: any status below 500. |  |
| `--timeout` | Seconds it gets to answer, 5 to 600. |  |
| `--command` | Check by running this command as the application (up when it exits 0) instead of making a request. |  |
| `--service` | The Compose service a --command runs in. |  |
| `--method` | Request method: GET, HEAD, OPTIONS or POST. |  |
| `--scheme` | http or https (connects to 127.0.0.1 either way). |  |
| `--host` | The Host header to present, such as shop.example.com. |  |
| `--port` | Probe this port on 127.0.0.1 instead. |  |
| `--interval` | Seconds between two probes, 1 to 60. |  |
| `--retries` | The most probes after the start period. |  |
| `--start-period` | Seconds during which a failed probe does not count, 0 to 600. |  |
| `--reset` | Go back to the defaults for all of it. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the health check settings as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app hooks

Commands a deployment runs before it serves and after: see, set or clear them.

```bash
noust app hooks [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`clear`](#noust-app-hooks-clear), [`set`](#noust-app-hooks-set), [`show`](#noust-app-hooks-show)

## noust app hooks clear

Remove an application's hooks, so the repository's noust.yaml applies again.

```bash
noust app hooks clear [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app hooks set

Set an application's hooks, replacing the repository's noust.yaml whole.

```bash
noust app hooks set [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--file` | YAML with 'hooks:' and its phases, the shape of a noust.yaml; '-' reads stdin. |  |
| `--json` | Print the hooks now in force as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app hooks show

Show the hooks the next deployment of an application runs, and where they come from.

```bash
noust app hooks show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the hooks as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app identity

The system account an application runs as: see it, or give it its own.

```bash
noust app identity [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`migrate`](#noust-app-identity-migrate), [`status`](#noust-app-identity-status)

## noust app identity migrate

Run the application as its own system account instead of the shared one.

```bash
noust app identity migrate [OPTIONS] [DOMAIN]
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--all` | Move every application that can have its own account, one at a time. |  |
| `--shared-group` | Let the new account join this group, for an application that writes outside its own folder into one the group can write (an upload directory the web server serves). |  |
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app identity status

Show the account the application runs as, and whether it is its own.

```bash
noust app identity status [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the account as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app import

Create an application from a 'noust app export' document.

```bash
noust app import [OPTIONS] FILE
```

Arguments: `file`

| Option | What it does | Default |
|---|---|---|
| `--domain` | Create it on this domain instead of the exported one. |  |
| `--source` | Deploy from this source instead of the exported one. |  |
| `--env-file` | File of NAME=value lines: the secret values the export left out, or overrides. |  |
| `--env` | A variable's value, over the export and --env-file. Repeat for several. |  |
| `--yes`, `-y` | Do not ask before creating the export's cron jobs and previews. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the plan and what was applied as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app limits

Show or set the memory, CPU and task limits of an application.

```bash
noust app limits [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--memory` | Memory limit: 512M, 2G, or none to remove it. |  |
| `--cpu` | CPU quota: 50% of one CPU, 200% for two, or none. |  |
| `--tasks` | Processes and threads it may run, or none. |  |
| `--restart` | Restart now so the new limits apply. |  |
| `--json` | Print the limits as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app migrate

Move an in-place application onto the release layout.

```bash
noust app migrate [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--persist` | Keep this path in shared/ across releases. Repeat for each; replaces detection. |  |
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--json` | Print the migration plan (or, with --yes, its result) as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app mount

Files kept for an application, and server paths bound into its container.

```bash
noust app mount [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`bind`](#noust-app-mount-bind), [`file`](#noust-app-mount-file), [`list`](#noust-app-mount-list), [`remove`](#noust-app-mount-remove), [`show`](#noust-app-mount-show)

## noust app mount bind

Bind SOURCE, a path of the server, at TARGET in a container application.

```bash
noust app mount bind [OPTIONS] DOMAIN SOURCE TARGET
```

Arguments: `domain`, `source`, `target`

| Option | What it does | Default |
|---|---|---|
| `--writable` | Mount it read-write. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app mount file

Keep a file for the application at TARGET, linked into every release.

```bash
noust app mount file [OPTIONS] DOMAIN TARGET
```

Arguments: `domain`, `target`

| Option | What it does | Default |
|---|---|---|
| `--from` | Read the text from this file instead of standard input. |  |
| `--mode` | Permissions in octal digits. | `600` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app mount list

List the files and server paths mounted into an application.

```bash
noust app mount list [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the mounts as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app mount remove

Remove a mount. A file Noust kept is deleted with it.

```bash
noust app mount remove [OPTIONS] DOMAIN TARGET
```

Arguments: `domain`, `target`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app mount show

Print the text of a mounted file. It may hold a secret: the read is on record.

```bash
noust app mount show [OPTIONS] DOMAIN TARGET
```

Arguments: `domain`, `target`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app move

Move an application to another project or environment.

```bash
noust app move [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--team` | The team it moves to, when it is another one. |  |
| `--project` | The project it moves to. |  |
| `--env` | The environment it moves to. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print where it is now as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app networks

Show the Docker networks a Compose stack is on and who else is on them.

```bash
noust app networks [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the networks as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app packages

The system packages an application needs on the host (a library, a font, a converter).

```bash
noust app packages [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-app-packages-add), [`install`](#noust-app-packages-install), [`remove`](#noust-app-packages-remove), [`set`](#noust-app-packages-set), [`show`](#noust-app-packages-show)

## noust app packages add

Add packages to what an application declares, keeping the others, and install them.

```bash
noust app packages add [OPTIONS] DOMAIN NAMES...
```

Arguments: `domain`, `names`

| Option | What it does | Default |
|---|---|---|
| `--no-install` | Only record the list: the next update installs. |  |
| `--json` | Print the packages as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app packages install

Install the packages an application declares that the host lacks.

```bash
noust app packages install [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the packages as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app packages remove

Stop declaring packages. They stay installed: another application, or the system, may use them.

```bash
noust app packages remove [OPTIONS] DOMAIN NAMES...
```

Arguments: `domain`, `names`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the packages as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app packages set

Declare the packages an application needs, replacing its list, and install them.

```bash
noust app packages set [OPTIONS] DOMAIN [NAMES]...
```

Arguments: `domain`, `names`

| Option | What it does | Default |
|---|---|---|
| `--no-install` | Only record the list: the next update installs. |  |
| `--json` | Print the packages as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app packages show

Show what an application declares, what the host has of it, and the server's policy.

```bash
noust app packages show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the packages as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app pending

Show what the application is set to that it does not run with yet.

```bash
noust app pending [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the changes as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy

Who may reach an application's site and how: password, addresses, limits, headers.

```bash
noust app policy [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`clients`](#noust-app-policy-clients), [`http3`](#noust-app-policy-http3), [`private`](#noust-app-policy-private), [`ranges`](#noust-app-policy-ranges), [`reset`](#noust-app-policy-reset), [`route`](#noust-app-policy-route), [`set`](#noust-app-policy-set), [`show`](#noust-app-policy-show), [`user`](#noust-app-policy-user), [`waf`](#noust-app-policy-waf)

## noust app policy clients

Client certificates: who may open a site that asks for one.

```bash
noust app policy clients [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`ca`](#noust-app-policy-clients-ca), [`issue`](#noust-app-policy-clients-issue), [`list`](#noust-app-policy-clients-list), [`revoke`](#noust-app-policy-clients-revoke)

## noust app policy clients ca

Print the certificate of the application's client authority (public).

```bash
noust app policy clients ca [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy clients issue

Make a certificate for a client of the site.

```bash
noust app policy clients issue [OPTIONS] DOMAIN NAME
```

Arguments: `domain`, `name`

| Option | What it does | Default |
|---|---|---|
| `--days` | How long the certificate is valid. | `365` |
| `--out` | Where the files go: NAME.p12 (for a browser), NAME.crt, NAME.key and ca.crt. | `.` |
| `--json` | Print the password and the files written as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy clients list

List the client certificates made for an application, revoked ones included.

```bash
noust app policy clients list [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the certificates as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy clients revoke

Revoke a certificate: the site refuses it from the moment it is rendered again.

```bash
noust app policy clients revoke [OPTIONS] DOMAIN SERIAL
```

Arguments: `domain`, `serial`

| Option | What it does | Default |
|---|---|---|
| `--accept-lockout` | Go ahead although it is the last valid certificate of a site that asks for one. |  |
| `--json` | Print the answer as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy http3

Say whether this application's server can serve it over HTTP/3, and what is missing.

```bash
noust app policy http3 [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the answer as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy private

Publish an application on a private network only: a tailnet or a WireGuard interface.

```bash
noust app policy private [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`certificate`](#noust-app-policy-private-certificate), [`disable`](#noust-app-policy-private-disable), [`enable`](#noust-app-policy-private-enable), [`networks`](#noust-app-policy-private-networks), [`show`](#noust-app-policy-private-show)

## noust app policy private certificate

Serve an application with the certificate Tailscale issues for this server's name.

```bash
noust app policy private certificate [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the certificate as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy private disable

Let an application answer anybody again: the private ranges leave the allowed addresses.

```bash
noust app policy private disable [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--accept-lockout` | Go ahead although the list refuses the address you are connected from. |  |
| `--json` | Print the answer as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy private enable

Make an application answer a private network only.

```bash
noust app policy private enable [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--network` | A network of 'noust app policy private networks': tailscale, wg0. |  |
| `--cidr` | A private range to allow as well. |  |
| `--accept-lockout` | Go ahead although the list refuses the address you are connected from. |  |
| `--json` | Print the answer as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy private networks

List the private networks this server is on.

```bash
noust app policy private networks [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the networks as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy private show

Say whether an application answers a private network only, and which.

```bash
noust app policy private show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the answer as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy ranges

Show the networks a site believes Cloudflare's client-address header from.

```bash
noust app policy ranges [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--refresh` | Fetch Cloudflare's published ranges and apply them. |  |
| `--json` | Print the ranges as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy reset

Take every field of the policy back to its default. The accounts are kept.

```bash
noust app policy reset [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the policy now in force as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy route

What happens at a prefix of the site: a password, headers, another service, a redirect.

```bash
noust app policy route [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-app-policy-route-add), [`list`](#noust-app-policy-route-list), [`remove`](#noust-app-policy-route-remove)

## noust app policy route add

Set what happens at a prefix of the site; a route at the same prefix is replaced.

```bash
noust app policy route add [OPTIONS] DOMAIN PATH
```

Arguments: `domain`, `path`

| Option | What it does | Default |
|---|---|---|
| `--password` | Ask for the password here. |  |
| `--open` | Lift the site's password here. |  |
| `--header` | Send a header here. |  |
| `--proxy-port` | Hand the prefix to this local port. |  |
| `--strip`, `--keep-prefix` | Take the prefix off (proxy). |  |
| `--redirect-to` | Redirect the prefix to an address or a path. |  |
| `--code` | Redirect status. | `301` |
| `--drop-path` | Redirect without the rest of the path. |  |
| `--json` | Print the policy now in force as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy route list

List the routes of an application's site.

```bash
noust app policy route list [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the routes as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy route remove

Take a route away; the prefix is served as the rest of the site again.

```bash
noust app policy route remove [OPTIONS] DOMAIN PATH
```

Arguments: `domain`, `path`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the policy now in force as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy set

Change an application's policy: what you name changes, the rest stays.

```bash
noust app policy set [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--password`, `--no-password` | Ask for a password. |  |
| `--realm` | The sign-in prompt's title. |  |
| `--access` | all: the password and the address list must both pass; any: either lets in. |  |
| `--allow` | Allow only these (repeat). |  |
| `--clear-allow` | Allow everyone again. |  |
| `--deny` | Refuse these (repeat). |  |
| `--clear-deny` | Refuse no one. |  |
| `--real-ip` | Read the client address from a header, believed from Cloudflare or your own proxies. |  |
| `--real-ip-header` | The header (custom): X-Forwarded-For, X-Real-IP... |  |
| `--trusted-proxy` | A proxy (custom). |  |
| `--rate-limit` | 10r/s or 300r/m per client address; none clears. |  |
| `--rate-burst` | Requests above the rate let through first. |  |
| `--connection-limit` | Concurrent connections per address; 0 for none. |  |
| `--header` | Send a header. |  |
| `--remove-header` | Stop sending yours. |  |
| `--hide-header` | Do not send a default. |  |
| `--hsts` | Strict-Transport-Security. |  |
| `--noindex`, `--index` | Tell search engines not to index. |  |
| `--canonical` | Serve www or the bare name, redirecting the other. |  |
| `--forward-auth-preset` | Ask an authentication service about every request, with a common service's defaults. |  |
| `--forward-auth-url` | Where each request is asked about, such as http://127.0.0.1:4180/oauth2/auth. |  |
| `--forward-auth-sign-in` | Where a visitor who is not signed in is sent (the page asked for is appended). |  |
| `--forward-auth-header` | A response header of the service to hand on to the application (repeat). |  |
| `--no-forward-auth` | Stop asking an authentication service. |  |
| `--accept-unreachable-auth` | Go ahead although the authentication service does not answer (everyone is refused until it does). |  |
| `--http3`, `--no-http3` | Serve the site over HTTP/3 (QUIC) as well (nginx 1.25 or later with the HTTP/3 module). |  |
| `--client-certs`, `--no-client-certs` | Answer only a visitor with a certificate this site's own authority signed (noust app policy clients issue makes them). |  |
| `--force-https`, `--no-force-https` | Send port 80 to HTTPS once the site has a certificate (the default). --no-force-https leaves the site answering on both, for a client that cannot follow a redirect (nginx only). |  |
| `--waf` | The web application firewall (OWASP Core Rule Set): detect writes down what the rules see, block also refuses what they score too high. |  |
| `--waf-exclude` | Leave this rule out for the site (repeat for more); replaces the list. |  |
| `--clear-waf-exclusions` | Leave no rule out for the site. |  |
| `--accept-lockout` | Go ahead although the lists refuse the address you are connected from. |  |
| `--json` | Print the policy now in force as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy show

Show an application's policy, its accounts and the headers its site sends.

```bash
noust app policy show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the policy as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy user

The accounts of an application's password.

```bash
noust app policy user [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-app-policy-user-add), [`remove`](#noust-app-policy-user-remove)

## noust app policy user add

Add an account to the application's password, or change its password. Asks for it.

```bash
noust app policy user add [OPTIONS] DOMAIN USERNAME
```

Arguments: `domain`, `username`

| Option | What it does | Default |
|---|---|---|
| `--password-stdin` | Read the password from standard input. |  |
| `--json` | Print the policy as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy user remove

Remove an account of the application's password.

```bash
noust app policy user remove [OPTIONS] DOMAIN USERNAME
```

Arguments: `domain`, `username`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the policy as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy waf

The web application firewall: what the server has, what its rules saw, installing it.

```bash
noust app policy waf [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`events`](#noust-app-policy-waf-events), [`install`](#noust-app-policy-waf-install), [`show`](#noust-app-policy-waf-show)

## noust app policy waf events

Show what the rules judged lately for an application, and the rules that matched most.

```bash
noust app policy waf events [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--limit` |  | `20` |
| `--json` | Print the events as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy waf install

Install nginx's ModSecurity module and the OWASP Core Rule Set (Debian and Ubuntu).

```bash
noust app policy waf install [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app policy waf show

Say whether this application's server can run the WAF, and what is missing.

```bash
noust app policy waf show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the answer as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app process

The processes an application runs beside its web process: workers, schedulers.

```bash
noust app process [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`list`](#noust-app-process-list), [`logs`](#noust-app-process-logs), [`remove`](#noust-app-process-remove), [`scale`](#noust-app-process-scale), [`set`](#noust-app-process-set)

## noust app process list

List the processes of an application with the state of each copy.

```bash
noust app process list [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the processes as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app process logs

Read the journal of a process: all its copies, interleaved.

```bash
noust app process logs [OPTIONS] DOMAIN NAME
```

Arguments: `domain`, `name`

| Option | What it does | Default |
|---|---|---|
| `--lines`, `-n` |  | `100` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app process remove

Stop a process and forget it.

```bash
noust app process remove [OPTIONS] DOMAIN NAME
```

Arguments: `domain`, `name`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app process scale

Run INSTANCES copies of a process. 0 stops them and keeps the definition.

```bash
noust app process scale [OPTIONS] DOMAIN NAME INSTANCES
```

Arguments: `domain`, `name`, `instances`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app process set

Define a process of the application, or change one, and run it.

```bash
noust app process set [OPTIONS] DOMAIN NAME COMMAND
```

Arguments: `domain`, `name`, `command`

| Option | What it does | Default |
|---|---|---|
| `--instances` | How many copies run on this server. | `1` |
| `--memory` | MemoryMax of each copy. |  |
| `--cpu` | CPUQuota of each copy. |  |
| `--tasks` | TasksMax of each copy. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app process-types

The process types (web, release, workers) a repository declares.

```bash
noust app process-types [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`show`](#noust-app-process-types-show)

## noust app process-types show

Show the process types an application declares and which ones a deployment uses.

```bash
noust app process-types show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the process types as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app promote

Put a release of DOMAIN on another application and activate it there.

```bash
noust app promote [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--to` | The application that receives the release. |  |
| `--release` | The release (default: the one that serves). |  |
| `--schema-changed-ok` | Go back past a deployment of the target that changed its database's schema. |  |
| `--yes`, `-y` | Do not ask before promoting. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app promotion

List the applications a release of DOMAIN can be promoted to.

```bash
noust app promotion [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the targets as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app reclaim

Hand a Docker Compose stack that runs outside its unit back to Noust.

```bash
noust app reclaim [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--accept-recreate` | Hand it back even if starting the unit would recreate a container. |  |
| `--yes`, `-y` | Hand it back without asking. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app replicas

Show how an application is scaled, or run it as COPIES copies of its web process.

```bash
noust app replicas [OPTIONS] DOMAIN [COPIES]
```

Arguments: `domain`, `copies`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the copies as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app replication

Say whether the application could run on more than one server, and what stops it.

```bash
noust app replication [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the verdict as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app sandbox

Build an application without root: see, try, enable or disable its sandbox.

```bash
noust app sandbox [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`compose-exception`](#noust-app-sandbox-compose-exception), [`disable`](#noust-app-sandbox-disable), [`enable`](#noust-app-sandbox-enable), [`self-test`](#noust-app-sandbox-self-test), [`status`](#noust-app-sandbox-status), [`test`](#noust-app-sandbox-test)

## noust app sandbox compose-exception

Allow a Docker Compose stack privileged containers and the Docker socket.

```bash
noust app sandbox compose-exception [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this stack needs it; recorded. |  |
| `--revoke` | Stop allowing it. |  |
| `--yes`, `-y` | Do not ask for confirmation. |  |

## noust app sandbox disable

Build the application as root: an explicit decision, recorded with a reason.

```bash
noust app sandbox disable [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why it cannot build in the sandbox; recorded. Required under the ENS profile or with security.exception_reasons on. |  |
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--json` | Print the new regime as JSON. |  |

## noust app sandbox enable

Build the application in the sandbox from its next deploy on.

```bash
noust app sandbox enable [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--force` | Enable without a passing trial. |  |
| `--network` | strict: install without the application's variables, build without a network. |  |
| `--pty`, `--no-pty` | Build on a terminal, for build scripts that reopen /dev/stderr. |  |
| `--json` | Print the new regime as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app sandbox self-test

Prove that the build sandbox holds on this server.

```bash
noust app sandbox self-test [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the checks as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app sandbox status

Show how an application builds: in the sandbox, or as root and why.

```bash
noust app sandbox status [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the build regime as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app sandbox test

Build what the application's next update would build, in the sandbox, without activating it.

```bash
noust app sandbox test [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the trial's outcome as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app source

How an application's repository is fetched, and which pushes deploy it.

```bash
noust app source [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`change`](#noust-app-source-change), [`reset`](#noust-app-source-reset), [`set`](#noust-app-source-set), [`show`](#noust-app-source-show)

## noust app source change

Make an application deploy from another repository or directory.

```bash
noust app source change [OPTIONS] DOMAIN SOURCE
```

Arguments: `domain`, `new_source`

| Option | What it does | Default |
|---|---|---|
| `-b`, `--branch` | The branch to follow. By default the one it follows now when SOURCE is the same repository at another address, else the remote's default. |  |
| `--no-check` | Do not ask the remote whether it can be read and has the branch (needs --branch). |  |
| `-y`, `--yes` | Change it without asking. |  |
| `--json` | Print the plan, or what was changed, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app source reset

Go back to the default source options.

```bash
noust app source reset [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app source set

Change some source options of an application, keeping the others.

```bash
noust app source set [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--submodules`, `--no-submodules` | Initialise and export the submodules. |  |
| `--lfs` | Git LFS: auto fetches the files when the repository tracks any, on always, off never. |  |
| `--shallow`, `--no-shallow` | Fetch only the latest commit (--no-shallow keeps the full history). |  |
| `--watch-path` | A glob a push must touch to deploy (apps/web/**); repeat it, or prefix '!' to exclude. The last pattern that matches wins. |  |
| `--clear-watch-paths` | Remove every watch path. |  |
| `--skip-markers`, `--no-skip-markers` | Skip a push whose commits all say [skip ci] or [skip cd]. |  |
| `--json` | Print the options now in force as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app source show

Show submodules, Git LFS, shallow clone, watch paths and skip markers of an application.

```bash
noust app source show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the source options as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app stop-grace

Show or set how long an application's unit has to stop, and with which signal.

```bash
noust app stop-grace [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--seconds` | How long the unit may take to stop before systemd kills it (1 to 3600). |  |
| `--signal` | The signal that asks it to stop (default SIGTERM). |  |
| `--reset` | Go back to systemd's own: 90 seconds and SIGTERM. |  |
| `--json` | Print the stop policy now in force as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app tag

Tags on applications: find them, and deploy the ones that share a tag.

```bash
noust app tag [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-app-tag-add), [`deploy`](#noust-app-tag-deploy), [`list`](#noust-app-tag-list), [`remove`](#noust-app-tag-remove), [`restart`](#noust-app-tag-restart), [`set`](#noust-app-tag-set)

## noust app tag add

Give an application more tags.

```bash
noust app tag add [OPTIONS] DOMAIN TAGS...
```

Arguments: `domain`, `tags`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app tag deploy

Update every application that carries TAG, one after the other.

```bash
noust app tag deploy [OPTIONS] TAG
```

Arguments: `tag_name`

| Option | What it does | Default |
|---|---|---|
| `--force` | Rebuild applications even when their branch has nothing new. |  |
| `--stop-on-failure` | Leave the rest alone after the first one that fails. |  |
| `--json` | Print what came of each application as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app tag list

List the tags of one application, or every tagged application.

```bash
noust app tag list [OPTIONS] [DOMAIN]
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--tag` | Only the applications with this tag. |  |
| `--json` | Print the tags as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app tag remove

Take tags off an application.

```bash
noust app tag remove [OPTIONS] DOMAIN TAGS...
```

Arguments: `domain`, `tags`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app tag restart

Restart every application and service that carries TAG.

```bash
noust app tag restart [OPTIONS] TAG
```

Arguments: `tag_name`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what came of each as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app tag set

Make an application carry exactly these tags (none clears them).

```bash
noust app tag set [OPTIONS] DOMAIN [TAGS]...
```

Arguments: `domain`, `tags`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app traffic

Show the requests an application served, and what was asked of it.

```bash
noust app traffic [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--window` | How far back to look. | `24h` |
| `--top` | Entries in each ranking. | `10` |
| `--json` | Print the traffic as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app tuning

Limits and options of an application's unit: soft memory, swap, weights, CPUs, ulimits, capabilities, devices.

```bash
noust app tuning [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`clear`](#noust-app-tuning-clear), [`set`](#noust-app-tuning-set), [`status`](#noust-app-tuning-status)

## noust app tuning clear

Remove all the tuning: the unit goes back to what the template writes.

```bash
noust app tuning clear [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--no-restart` | Write the unit but do not restart. |  |
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app tuning set

Tune the application's unit; what is not named is kept.

```bash
noust app tuning set [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--memory-high` | Soft memory limit: throttled above it, killed only at the hard one. |  |
| `--swap-max` | Swap the unit may use; 0 forbids it. |  |
| `--cpu-weight` | Share of the CPU when it is contended (100 is the default). |  |
| `--allowed-cpus` | Pin the unit to these CPUs, such as 0-3 or 0,2. |  |
| `--io-weight` | Share of the disk when it is contended. |  |
| `--nofile` | Open files (ulimit -n). |  |
| `--nproc` | Processes of the account (ulimit -u). |  |
| `--memlock` | Locked memory (ulimit -l). |  |
| `--core-dumps`, `--no-core-dumps` | Allow core dumps (ulimit -c). |  |
| `--cap` | A capability the process keeps (NET_BIND_SERVICE, ...); repeat it. Replaces the list. |  |
| `--device` | A device the process may open (/dev/nvidia0:rw, char-drm); repeat it. Replaces the list. |  |
| `--gpu` | Allow the devices a GPU needs (nvidia, dri); repeat it. |  |
| `--unset` | Remove one option (memory_high_mb, capabilities, ...); repeat it. |  |
| `--no-restart` | Write the unit but do not restart: the running process keeps what it has. |  |
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app tuning status

Show how the application's unit is tuned and the lines it has for it.

```bash
noust app tuning status [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app webhook

The deploy webhook of an application: a push to its repository deploys it.

```bash
noust app webhook [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`deliveries`](#noust-app-webhook-deliveries), [`disable`](#noust-app-webhook-disable), [`registry`](#noust-app-webhook-registry), [`rotate`](#noust-app-webhook-rotate), [`show`](#noust-app-webhook-show)

## noust app webhook deliveries

List what the forge has sent to this application's webhook.

```bash
noust app webhook deliveries [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--limit` | How many deliveries to list, newest first. | `20` |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the deliveries as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app webhook disable

Discard the webhook secret: deliveries are answered 404 from now on.

```bash
noust app webhook disable [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app webhook registry

Say what to give a container registry so a push of the image deploys the application.

```bash
noust app webhook registry [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reveal` | Print the token of Docker Hub's address too (it is a credential, never shown otherwise). |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the addresses as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app webhook rotate

Create the webhook secret, or replace it.

```bash
noust app webhook rotate [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the new secret and the payload URL as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app webhook show

Show how far the webhook is set up.

```bash
noust app webhook show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reveal` | Print the secret too (it is never shown otherwise). |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the state as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust app zero-downtime

Show or switch blue/green activation of an application.

```bash
noust app zero-downtime [OPTIONS] DOMAIN [on|off]
```

Arguments: `domain`, `mode`

| Option | What it does | Default |
|---|---|---|
| `--drain` | Seconds the old instance keeps running after a switch, 0 to 300. Default: 10. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the mode (or what was changed) as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |