Pages in Reference

noust app

Change how a deployed application is laid out and what it may use.

Reference Updated 29 October 2026 View as Markdown

Shell

noust app [OPTIONS] COMMAND [ARGS]...

Subcommands: adopt, adopt-site, apply, backup-before-update, backup-required, branch, build, cache, clone, compose, container, deploy-key, deploy-log, discover, disk, exec, export, files, follow-tags, git-credential, hardening, headless, health, hooks, identity, import, limits, migrate, mount, move, networks, packages, pending, policy, process, process-types, promote, promotion, reclaim, replicas, replication, sandbox, source, stop-grace, tag, traffic, tuning, webhook, zero-downtime

noust app adopt

Shell

noust app adopt [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--path`	The directory the stack runs from, such as /opt/shop.
`--compose-file`	Its compose file, relative to --path (found among the usual names otherwise).
`--source`	Where updates fetch from (default: origin).
`--branch`	The branch updates follow (default: the current).
`--site`	The site file serving the domain (found by its names otherwise).
`--port`	The port to register (the compose file's web port otherwise).
`--accept-recreate`	Adopt even if starting the stack as Noust would recreate something.
`--yes`, `-y`	Adopt without asking.
`--json`	Print what was adopted as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app adopt-site

Shell

noust app adopt-site [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--site`	The site file serving the domain (found otherwise).
`--unit`	The unit the site is in front of (the one that listens on its port otherwise).
`--path`	The directory of its files (the unit's WorkingDirectory or the site's root otherwise).
`--yes`, `-y`	Adopt without asking.
`--json`	Print what was adopted as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app apply

Set an application from a declaration file, as 'noust app export --as-yaml' writes one.

Shell

noust app apply [OPTIONS] DOMAIN FILE

Arguments: domain, file

Option	What it does	Default
`--prune`	Also remove the aliases, redirects and tasks the file does not name.
`--check`	Show what would change and change nothing.
`--yes`, `-y`	Do not ask before applying what runs commands (build, hooks, tasks, Compose arguments).
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the plan and what was applied as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app backup-before-update

Show or set whether an update copies a stack's databases first.

Shell

noust app backup-before-update [OPTIONS] DOMAIN [on|off]

Arguments: domain, state

Option	What it does	Default
`--json`	Print the setting as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app backup-required

Show or set whether an update is refused when its backup fails.

Shell

noust app backup-required [OPTIONS] DOMAIN [on|off|default]

Arguments: domain, state

Option	What it does	Default
`--json`	Print the setting as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app branch

Show, pin or unpin the branch an application deploys from.

Shell

noust app branch [OPTIONS] DOMAIN [BRANCH]

Arguments: domain, branch

Option	What it does	Default
`--unpin`	Deploy any branch a push names.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the branch as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app build

The commands an application is installed, built and started with: see, set or unset them.

Shell

noust app build [OPTIONS] COMMAND [ARGS]...

Subcommands: set, show, unset

noust app build set

Set an application's build block, replacing the repository's noust.yaml whole.

Shell

noust app build set [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--base-directory`	The subdirectory of the repository the project lives in (apps/web).
`--install`	Replaces the install command.
`--build`	Replaces the build command.
`--start`	Replaces the start command. systemd expands ${PORT}; it is never run by a shell.
`--publish-directory`	Where a static build leaves the files the web server serves, from the project.
`--runtime`	Pin the runtime: node@22, python@3.12 or php@8.3.
`--cache`, `--no-cache`	--no-cache builds every deployment from scratch, without the package managers' cache or the dependencies of the release that serves.
`--timeout`	How long the install and the build may each take before they are stopped (the server's deploy.install_timeout and deploy.build_timeout otherwise).
`--file`	Replace the whole block with a YAML file holding 'build:'; '-' reads stdin.
`--json`	Print the build block now in force as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app build show

Show the build block the next deployment of an application uses, and where it comes from.

Shell

noust app build show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the build block as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app build unset

Remove keys of the operator's block, or all of it, so the repository's applies again.

Shell

noust app build unset [OPTIONS] DOMAIN [KEY]...

Arguments: domain, keys

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app cache

The cache the package managers keep between an application's builds.

Shell

noust app cache [OPTIONS] COMMAND [ARGS]...

Subcommands: clear, show

noust app cache clear

Empty an application's build cache; its next build downloads what it needs again.

Shell

noust app cache clear [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print what was freed as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app cache show

Show where an application's build cache is and how much it holds.

Shell

noust app cache show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the cache as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app clone

Clone an application: the same application on NEW_DOMAIN.

Shell

noust app clone [OPTIONS] DOMAIN NEW_DOMAIN

Arguments: domain, new_domain

Option	What it does	Default
`--database`	What the clone does with the application's database: 'empty' makes one of its own, 'share' uses the original's (and writes into its data). Required when the application has a database.
`--source`	Deploy the clone from this source instead.
`--yes`, `-y`	Do not ask before cloning.
`--team`	The team it goes to (default: the original's).
`--project`	The project it goes to (default: the original's).
`--environment`	The environment it goes to (default: the original's).
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print what was applied as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app compose

The compose file, profiles and extra arguments of a Docker Compose stack.

Shell

noust app compose [OPTIONS] COMMAND [ARGS]...

Subcommands: document, replace, reset, set, show, variables

noust app compose document

Print the Compose document a stack runs from.

Shell

noust app compose document [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the document and where Noust keeps it as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app compose replace

Replace the Compose document a stack runs from.

Shell

noust app compose replace [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--from`	The new document; - reads standard input.
`--check`	Only judge it: write nothing and run nothing.
`--apply`	Update the stack to run it now, behind the health gate; without it the stack runs it at its next update.
`--json`	Print the outcome as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app compose reset

Forget the choices; the unit's own record of the file applies again.

Shell

noust app compose reset [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app compose set

Change what a Compose stack is run with, keeping what is not named.

Shell

noust app compose set [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--file`	The compose file, relative to the project.
`--profile`	A profile to activate; repeat it. Replaces the profiles.
`--no-profiles`	Activate no profile.
`--build-args`	Extra arguments of 'docker compose build', as one quoted line. Allowed: --build-arg, --no-cache, --progress, --pull, --quiet, --with-dependencies, -q.
`--up-args`	Extra arguments of 'docker compose up', as one quoted line. Allowed: --always-recreate-deps, --force-recreate, --no-deps, --pull, --renew-anon-volumes, --scale, --timeout, --wait, --wait-timeout, -V, -t.
`--service`	Build and start only this service (and what it depends on); repeat it.
`--all-services`	Build and start every service again.
`--json`	Print the settings now in force as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app compose show

Show what a Compose stack is run with.

Shell

noust app compose show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the settings as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app compose variables

Show the variables the compose file asks for and which of them the stack has.

Shell

noust app compose variables [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the variables as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app container

How a container application is built and run: see it, change it.

Shell

noust app container [OPTIONS] COMMAND [ARGS]...

Subcommands: check, set, show

noust app container check

Ask the registry whether the tag of an image application points at a new image.

Shell

noust app container check [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the finding as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app container set

Change how a container application is built and run.

Shell

noust app container set [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--image`	Deploy this image from a registry: name[:tag][@sha256:digest]. Needs no source.
`--builder`	How a repository becomes an image: its Dockerfile, or Railpack, which needs none (noust setup railpack).
`--dockerfile`	The Dockerfile, relative to the repository. Default: Dockerfile or Containerfile in the context.
`--context`	The build context, relative to the repository. Default: its root.
`--target`	The stage of a multi-stage Dockerfile to build.
`--build-arg`	A build argument (not a secret: it is written into the image). Repeat for several.
`--build-secret`	A secret the build mounts, read from FILE and kept in the secret store; never an argument of the build. Repeat for several.
`--container-port`	Where the process listens inside the container. Default: what the Dockerfile or the image exposes.
`--volume`	A path in the container whose data survives every deployment, such as /data. Repeat for several.
`--restart`	Docker's restart policy: no, always, unless-stopped (default) or on-failure.
`--entrypoint`	Run this program instead of the image's ENTRYPOINT: the line is split into words the way a shell would, and no shell runs it. An empty line clears the image's entrypoint (its CMD is then the program). Setting one drops the image's CMD: give --command too if it should still apply.
`--command`	Give the entrypoint these arguments instead of the image's CMD (split into words, no shell). Docker cannot clear a CMD: an empty line is refused; --clear command goes back to the image's.
`--registry-server`	The registry the account is for. Default: the image's own.
`--registry-user`	The account of a private registry.
`--registry-password-stdin`	Read the account's password from standard input.
`--remove-build-arg`	Remove a build argument.
`--remove-build-secret`	Remove a build secret, and its value.
`--remove-volume`	Stop keeping this path across deployments. The volume's data stays on the server.
`--clear`	Go back to the default of a setting: it is read from the Dockerfile or the image again.
`--clear-registry`	Remove the registry account.
`--json`	Print the settings now as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app container show

Show how a container application is built and run.

Shell

noust app container show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the settings as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key

An SSH key of its own for the repository an application is built from.

Shell

noust app deploy-key [OPTIONS] COMMAND [ARGS]...

Subcommands: assign, forget-host, generate, hosts, import, list, pin-host, prune, remove, rotate, show, test

noust app deploy-key assign

Make an existing key the one that reaches this application's repository.

Shell

noust app deploy-key assign [OPTIONS] DOMAIN KEY

Arguments: domain, key

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key forget-host

Forget a pinned host key, so the next connection pins the one the host shows now.

Shell

noust app deploy-key forget-host [OPTIONS] HOST

Arguments: host

Option	What it does	Default
`--yes`, `-y`	Do not ask for confirmation.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key generate

Make an ed25519 key, with no passphrase, for the application's repository.

Shell

noust app deploy-key generate [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--name`	The key's name. The application's name by default.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the key as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key hosts

List the SSH host keys Noust pinned the first time it connected to each code host.

Shell

noust app deploy-key hosts [OPTIONS]

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the pinned host keys as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key import

Use a private key you already have as the application's deploy key.

Shell

noust app deploy-key import [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--private-key-file`	File with the private key, or - to read it from standard input. It must have no passphrase.
`--name`	The key's name. The application's name by default.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the key as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key list

List every deploy key and the applications it reaches.

Shell

noust app deploy-key list [OPTIONS]

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the keys as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key pin-host

Pin a code host's SSH key before the first connection, by the fingerprint it publishes.

Shell

noust app deploy-key pin-host [OPTIONS] HOST

Arguments: host

Option	What it does	Default
`--fingerprint`	The host key's fingerprint, from the code host's own published list.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the pinned host key as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key prune

Delete the deploy keys whose repositories no application is built from any more.

Shell

noust app deploy-key prune [OPTIONS]

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key remove

Take the repository off its deploy key, and delete the key when nothing else uses it.

Shell

noust app deploy-key remove [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--yes`, `-y`	Do not ask for confirmation.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key rotate

Make the key that will replace the application's, keeping the old one working.

Shell

noust app deploy-key rotate [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--finish`	Ask the code host with the new key now; if it answers, the new key replaces the old.
`--cancel`	Give up the rotation; the old key stays.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the key as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key show

Show the deploy key of an application's repository, and the public half to add at the code host.

Shell

noust app deploy-key show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the key (never its private half) as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-key test

Ask the repository for its branches with the deploy key, as a deploy would.

Shell

noust app deploy-key test [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app deploy-log

Print the captured log of a deployment of an application.

Shell

noust app deploy-log [OPTIONS] DOMAIN [DEPLOYMENT_ID]

Arguments: domain, deployment_id

Option	What it does	Default
`--level`	warn keeps warnings and errors; error keeps only errors.	`all`
`--search`	Keep only the lines that hold this text, ignoring case.
`--timestamps`, `--no-timestamps`	Keep each line's stamp.
`--sanitize`	Mask what looks like a credential and strip control sequences, to share the log.
`--tail`	Only this many bytes, from the end.
`--json`	Print the log and whether it was cut as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app discover

List the sites on this server that Noust did not deploy, and what each one is.

Shell

noust app discover [OPTIONS]

Option	What it does	Default
`--json`	Print the sites as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app disk

Show what the application takes of the disk, and the limit its deploys are held to.

Shell

noust app disk [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--measure`	Measure what it takes now, and keep the answer.
`--limit`	Hold deploys to this many megabytes: a new release is refused while it is over.
`--no-limit`	Remove the limit.
`--kernel`, `--no-kernel`	Give the limit to the kernel as a project quota (XFS or ext4 mounted with prjquota), or take it off. The writes themselves are then refused at the limit.
`--json`	Print the disk as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app exec

Run one command in an application, as the application: noust app exec DOMAIN -- PROGRAM ARGS.

Shell

noust app exec [OPTIONS] DOMAIN [COMMAND]...

Arguments: domain, command

Option	What it does	Default
`--service`	The Compose service to run it in, for a stack that runs several.
`--timeout`	Seconds it may run; 300 by default, at most terminal.exec.max_seconds.
`--json`	Print how it went as JSON, after its output.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app export

Export everything that defines an application as a JSON document.

Shell

noust app export [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--with-secrets`	Include the values of secret variables. The file is written 0600.
`-o`, `--output`	Write the export to this file instead of printing it.
`--as-yaml`	Write a declaration (noust.yaml keys: health, limits, source, build, hooks, variables, domains, tasks) that 'noust app apply' sets on a server, instead of the JSON export. Secret variables are never written.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	The export is JSON already; accepted for scripts that always pass it.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app files

The files of an application, as its own account.

Shell

noust app files [OPTIONS] COMMAND [ARGS]...

Subcommands: get, list, mkdir, move, put, remove

noust app files get

Copy a file out of the application: to DESTINATION, or to standard output.

Shell

noust app files get [OPTIONS] DOMAIN PATH [DESTINATION]

Arguments: domain, path, destination

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app files list

List a directory of the application (its own directory by default).

Shell

noust app files list [OPTIONS] DOMAIN [PATH]

Arguments: domain, path

Option	What it does	Default
`--json`	Print the listing as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app files mkdir

Create a directory whose parent exists.

Shell

noust app files mkdir [OPTIONS] DOMAIN PATH

Arguments: domain, path

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app files move

Rename or move something inside the application.

Shell

noust app files move [OPTIONS] DOMAIN SOURCE DESTINATION

Arguments: domain, source, destination

Option	What it does	Default
`--replace`	Replace what is at DESTINATION.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app files put

Copy a local file into the application at PATH, as the application's account.

Shell

noust app files put [OPTIONS] DOMAIN SOURCE PATH

Arguments: domain, source, path

Option	What it does	Default
`--replace`	Replace a file that is there.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app files remove

Delete a file, a link, or a directory. A link is removed, never what it points at.

Shell

noust app files remove [OPTIONS] DOMAIN PATH

Arguments: domain, path

Option	What it does	Default
`--recursive`, `-r`	Delete a directory and what is in it.
`--yes`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app follow-tags

Show, set or clear the tags an application deploys.

Shell

noust app follow-tags [OPTIONS] DOMAIN [PATTERN]

Arguments: domain, pattern

Option	What it does	Default
`--off`	Follow a branch again instead of tags.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print what the application follows as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app git-credential

The user and token a private https repository needs, kept as a secret.

Shell

noust app git-credential [OPTIONS] COMMAND [ARGS]...

Subcommands: remove, set, show

noust app git-credential remove

Forget the credential of the application's repository.

Shell

noust app git-credential remove [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--yes`, `-y`	Do not ask for confirmation.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app git-credential set

Keep the user and token git signs in to this application's repository with.

Shell

noust app git-credential set [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--username`, `-u`	The user to sign in as.
`--secret-file`	File with the token, or - for standard input. Without it the token is asked for without echo.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app git-credential show

Say whether the application's repository has a credential, and as whom.

Shell

noust app git-credential show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the state (never the token) as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app hardening

The sandbox an application's unit runs in: see it, or change it.

Shell

noust app hardening [OPTIONS] COMMAND [ARGS]...

Subcommands: set, status

noust app hardening set

Run the application's unit in this sandbox: off, default or strict.

Shell

noust app hardening set [OPTIONS] DOMAIN {off|default|strict}

Arguments: domain, profile

Option	What it does	Default
`--writable`	A directory the unit may write to besides the application's own tree; repeat it. Without any, the ones it has are kept.
`--no-writable`	Forget the extra writable directories it has.
`--no-restart`	Write the unit but do not restart: the running process keeps its sandbox.
`--yes`, `-y`	Do not ask for confirmation.
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app hardening status

Show the sandbox of the application's unit and how exposed systemd finds it.

Shell

noust app hardening status [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the status as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app headless

Record a Docker Compose stack that publishes no port as a worker.

Shell

noust app headless [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--remove-site`, `--keep-site`	Also remove the site Noust wrote for it (asked when not given).
`--yes`, `-y`	Remove the site without asking.
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app health

Show or set what the health gate asks of an application.

Shell

noust app health [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--path`	Path the health check requests, such as /healthz.
`--expect`	Statuses that mean up: 200-399, or 200,204. Default: any status below 500.
`--timeout`	Seconds it gets to answer, 5 to 600.
`--command`	Check by running this command as the application (up when it exits 0) instead of making a request.
`--service`	The Compose service a --command runs in.
`--method`	Request method: GET, HEAD, OPTIONS or POST.
`--scheme`	http or https (connects to 127.0.0.1 either way).
`--host`	The Host header to present, such as shop.example.com.
`--port`	Probe this port on 127.0.0.1 instead.
`--interval`	Seconds between two probes, 1 to 60.
`--retries`	The most probes after the start period.
`--start-period`	Seconds during which a failed probe does not count, 0 to 600.
`--reset`	Go back to the defaults for all of it.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the health check settings as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app hooks

Commands a deployment runs before it serves and after: see, set or clear them.

Shell

noust app hooks [OPTIONS] COMMAND [ARGS]...

Subcommands: clear, set, show

noust app hooks clear

Remove an application's hooks, so the repository's noust.yaml applies again.

Shell

noust app hooks clear [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app hooks set

Set an application's hooks, replacing the repository's noust.yaml whole.

Shell

noust app hooks set [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--file`	YAML with 'hooks:' and its phases, the shape of a noust.yaml; '-' reads stdin.
`--json`	Print the hooks now in force as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app hooks show

Show the hooks the next deployment of an application runs, and where they come from.

Shell

noust app hooks show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the hooks as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app identity

The system account an application runs as: see it, or give it its own.

Shell

noust app identity [OPTIONS] COMMAND [ARGS]...

Subcommands: migrate, status

noust app identity migrate

Run the application as its own system account instead of the shared one.

Shell

noust app identity migrate [OPTIONS] [DOMAIN]

Arguments: domain

Option	What it does	Default
`--all`	Move every application that can have its own account, one at a time.
`--shared-group`	Let the new account join this group, for an application that writes outside its own folder into one the group can write (an upload directory the web server serves).
`--yes`, `-y`	Do not ask for confirmation.
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app identity status

Show the account the application runs as, and whether it is its own.

Shell

noust app identity status [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the account as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app import

Create an application from a 'noust app export' document.

Shell

noust app import [OPTIONS] FILE

Arguments: file

Option	What it does	Default
`--domain`	Create it on this domain instead of the exported one.
`--source`	Deploy from this source instead of the exported one.
`--env-file`	File of NAME=value lines: the secret values the export left out, or overrides.
`--env`	A variable's value, over the export and --env-file. Repeat for several.
`--yes`, `-y`	Do not ask before creating the export's cron jobs and previews.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the plan and what was applied as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app limits

Show or set the memory, CPU and task limits of an application.

Shell

noust app limits [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--memory`	Memory limit: 512M, 2G, or none to remove it.
`--cpu`	CPU quota: 50% of one CPU, 200% for two, or none.
`--tasks`	Processes and threads it may run, or none.
`--restart`	Restart now so the new limits apply.
`--json`	Print the limits as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app migrate

Move an in-place application onto the release layout.

Shell

noust app migrate [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--persist`	Keep this path in shared/ across releases. Repeat for each; replaces detection.
`--yes`, `-y`	Do not ask for confirmation.
`--json`	Print the migration plan (or, with --yes, its result) as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app mount

Files kept for an application, and server paths bound into its container.

Shell

noust app mount [OPTIONS] COMMAND [ARGS]...

Subcommands: bind, file, list, remove, show

noust app mount bind

Bind SOURCE, a path of the server, at TARGET in a container application.

Shell

noust app mount bind [OPTIONS] DOMAIN SOURCE TARGET

Arguments: domain, source, target

Option	What it does	Default
`--writable`	Mount it read-write.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app mount file

Keep a file for the application at TARGET, linked into every release.

Shell

noust app mount file [OPTIONS] DOMAIN TARGET

Arguments: domain, target

Option	What it does	Default
`--from`	Read the text from this file instead of standard input.
`--mode`	Permissions in octal digits.	`600`
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app mount list

List the files and server paths mounted into an application.

Shell

noust app mount list [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the mounts as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app mount remove

Remove a mount. A file Noust kept is deleted with it.

Shell

noust app mount remove [OPTIONS] DOMAIN TARGET

Arguments: domain, target

Option	What it does	Default
`--yes`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app mount show

Print the text of a mounted file. It may hold a secret: the read is on record.

Shell

noust app mount show [OPTIONS] DOMAIN TARGET

Arguments: domain, target

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app move

Move an application to another project or environment.

Shell

noust app move [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--team`	The team it moves to, when it is another one.
`--project`	The project it moves to.
`--env`	The environment it moves to.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print where it is now as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app networks

Show the Docker networks a Compose stack is on and who else is on them.

Shell

noust app networks [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the networks as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app packages

The system packages an application needs on the host (a library, a font, a converter).

Shell

noust app packages [OPTIONS] COMMAND [ARGS]...

Subcommands: add, install, remove, set, show

noust app packages add

Add packages to what an application declares, keeping the others, and install them.

Shell

noust app packages add [OPTIONS] DOMAIN NAMES...

Arguments: domain, names

Option	What it does	Default
`--no-install`	Only record the list: the next update installs.
`--json`	Print the packages as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app packages install

Install the packages an application declares that the host lacks.

Shell

noust app packages install [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the packages as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app packages remove

Stop declaring packages. They stay installed: another application, or the system, may use them.

Shell

noust app packages remove [OPTIONS] DOMAIN NAMES...

Arguments: domain, names

Option	What it does	Default
`--json`	Print the packages as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app packages set

Declare the packages an application needs, replacing its list, and install them.

Shell

noust app packages set [OPTIONS] DOMAIN [NAMES]...

Arguments: domain, names

Option	What it does	Default
`--no-install`	Only record the list: the next update installs.
`--json`	Print the packages as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app packages show

Show what an application declares, what the host has of it, and the server's policy.

Shell

noust app packages show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the packages as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app pending

Show what the application is set to that it does not run with yet.

Shell

noust app pending [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the changes as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy

Who may reach an application's site and how: password, addresses, limits, headers.

Shell

noust app policy [OPTIONS] COMMAND [ARGS]...

Subcommands: clients, http3, private, ranges, reset, route, set, show, user, waf

noust app policy clients

Client certificates: who may open a site that asks for one.

Shell

noust app policy clients [OPTIONS] COMMAND [ARGS]...

Subcommands: ca, issue, list, revoke

noust app policy clients ca

Print the certificate of the application's client authority (public).

Shell

noust app policy clients ca [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy clients issue

Make a certificate for a client of the site.

Shell

noust app policy clients issue [OPTIONS] DOMAIN NAME

Arguments: domain, name

Option	What it does	Default
`--days`	How long the certificate is valid.	`365`
`--out`	Where the files go: NAME.p12 (for a browser), NAME.crt, NAME.key and ca.crt.	`.`
`--json`	Print the password and the files written as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy clients list

List the client certificates made for an application, revoked ones included.

Shell

noust app policy clients list [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the certificates as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy clients revoke

Revoke a certificate: the site refuses it from the moment it is rendered again.

Shell

noust app policy clients revoke [OPTIONS] DOMAIN SERIAL

Arguments: domain, serial

Option	What it does	Default
`--accept-lockout`	Go ahead although it is the last valid certificate of a site that asks for one.
`--json`	Print the answer as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy http3

Say whether this application's server can serve it over HTTP/3, and what is missing.

Shell

noust app policy http3 [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the answer as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy private

Publish an application on a private network only: a tailnet or a WireGuard interface.

Shell

noust app policy private [OPTIONS] COMMAND [ARGS]...

Subcommands: certificate, disable, enable, networks, show

noust app policy private certificate

Serve an application with the certificate Tailscale issues for this server's name.

Shell

noust app policy private certificate [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the certificate as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy private disable

Let an application answer anybody again: the private ranges leave the allowed addresses.

Shell

noust app policy private disable [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--accept-lockout`	Go ahead although the list refuses the address you are connected from.
`--json`	Print the answer as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy private enable

Make an application answer a private network only.

Shell

noust app policy private enable [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--network`	A network of 'noust app policy private networks': tailscale, wg0.
`--cidr`	A private range to allow as well.
`--accept-lockout`	Go ahead although the list refuses the address you are connected from.
`--json`	Print the answer as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy private networks

List the private networks this server is on.

Shell

noust app policy private networks [OPTIONS]

Option	What it does	Default
`--json`	Print the networks as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy private show

Say whether an application answers a private network only, and which.

Shell

noust app policy private show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the answer as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy ranges

Show the networks a site believes Cloudflare's client-address header from.

Shell

noust app policy ranges [OPTIONS]

Option	What it does	Default
`--refresh`	Fetch Cloudflare's published ranges and apply them.
`--json`	Print the ranges as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy reset

Take every field of the policy back to its default. The accounts are kept.

Shell

noust app policy reset [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the policy now in force as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy route

What happens at a prefix of the site: a password, headers, another service, a redirect.

Shell

noust app policy route [OPTIONS] COMMAND [ARGS]...

Subcommands: add, list, remove

noust app policy route add

Set what happens at a prefix of the site; a route at the same prefix is replaced.

Shell

noust app policy route add [OPTIONS] DOMAIN PATH

Arguments: domain, path

Option	What it does	Default
`--password`	Ask for the password here.
`--open`	Lift the site's password here.
`--header`	Send a header here.
`--proxy-port`	Hand the prefix to this local port.
`--strip`, `--keep-prefix`	Take the prefix off (proxy).
`--redirect-to`	Redirect the prefix to an address or a path.
`--code`	Redirect status.	`301`
`--drop-path`	Redirect without the rest of the path.
`--json`	Print the policy now in force as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy route list

List the routes of an application's site.

Shell

noust app policy route list [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the routes as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy route remove

Take a route away; the prefix is served as the rest of the site again.

Shell

noust app policy route remove [OPTIONS] DOMAIN PATH

Arguments: domain, path

Option	What it does	Default
`--json`	Print the policy now in force as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy set

Change an application's policy: what you name changes, the rest stays.

Shell

noust app policy set [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--password`, `--no-password`	Ask for a password.
`--realm`	The sign-in prompt's title.
`--access`	all: the password and the address list must both pass; any: either lets in.
`--allow`	Allow only these (repeat).
`--clear-allow`	Allow everyone again.
`--deny`	Refuse these (repeat).
`--clear-deny`	Refuse no one.
`--real-ip`	Read the client address from a header, believed from Cloudflare or your own proxies.
`--real-ip-header`	The header (custom): X-Forwarded-For, X-Real-IP...
`--trusted-proxy`	A proxy (custom).
`--rate-limit`	10r/s or 300r/m per client address; none clears.
`--rate-burst`	Requests above the rate let through first.
`--connection-limit`	Concurrent connections per address; 0 for none.
`--header`	Send a header.
`--remove-header`	Stop sending yours.
`--hide-header`	Do not send a default.
`--hsts`	Strict-Transport-Security.
`--noindex`, `--index`	Tell search engines not to index.
`--canonical`	Serve www or the bare name, redirecting the other.
`--forward-auth-preset`	Ask an authentication service about every request, with a common service's defaults.
`--forward-auth-url`	Where each request is asked about, such as http://127.0.0.1:4180/oauth2/auth.
`--forward-auth-sign-in`	Where a visitor who is not signed in is sent (the page asked for is appended).
`--forward-auth-header`	A response header of the service to hand on to the application (repeat).
`--no-forward-auth`	Stop asking an authentication service.
`--accept-unreachable-auth`	Go ahead although the authentication service does not answer (everyone is refused until it does).
`--http3`, `--no-http3`	Serve the site over HTTP/3 (QUIC) as well (nginx 1.25 or later with the HTTP/3 module).
`--client-certs`, `--no-client-certs`	Answer only a visitor with a certificate this site's own authority signed (noust app policy clients issue makes them).
`--force-https`, `--no-force-https`	Send port 80 to HTTPS once the site has a certificate (the default). --no-force-https leaves the site answering on both, for a client that cannot follow a redirect (nginx only).
`--waf`	The web application firewall (OWASP Core Rule Set): detect writes down what the rules see, block also refuses what they score too high.
`--waf-exclude`	Leave this rule out for the site (repeat for more); replaces the list.
`--clear-waf-exclusions`	Leave no rule out for the site.
`--accept-lockout`	Go ahead although the lists refuse the address you are connected from.
`--json`	Print the policy now in force as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy show

Show an application's policy, its accounts and the headers its site sends.

Shell

noust app policy show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the policy as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy user

The accounts of an application's password.

Shell

noust app policy user [OPTIONS] COMMAND [ARGS]...

Subcommands: add, remove

noust app policy user add

Add an account to the application's password, or change its password. Asks for it.

Shell

noust app policy user add [OPTIONS] DOMAIN USERNAME

Arguments: domain, username

Option	What it does	Default
`--password-stdin`	Read the password from standard input.
`--json`	Print the policy as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy user remove

Remove an account of the application's password.

Shell

noust app policy user remove [OPTIONS] DOMAIN USERNAME

Arguments: domain, username

Option	What it does	Default
`--json`	Print the policy as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy waf

The web application firewall: what the server has, what its rules saw, installing it.

Shell

noust app policy waf [OPTIONS] COMMAND [ARGS]...

Subcommands: events, install, show

noust app policy waf events

Show what the rules judged lately for an application, and the rules that matched most.

Shell

noust app policy waf events [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--limit`		`20`
`--json`	Print the events as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy waf install

Install nginx's ModSecurity module and the OWASP Core Rule Set (Debian and Ubuntu).

Shell

noust app policy waf install [OPTIONS]

Option	What it does	Default
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app policy waf show

Say whether this application's server can run the WAF, and what is missing.

Shell

noust app policy waf show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the answer as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app process

The processes an application runs beside its web process: workers, schedulers.

Shell

noust app process [OPTIONS] COMMAND [ARGS]...

Subcommands: list, logs, remove, scale, set

noust app process list

List the processes of an application with the state of each copy.

Shell

noust app process list [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the processes as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app process logs

Read the journal of a process: all its copies, interleaved.

Shell

noust app process logs [OPTIONS] DOMAIN NAME

Arguments: domain, name

Option	What it does	Default
`--lines`, `-n`		`100`
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app process remove

Stop a process and forget it.

Shell

noust app process remove [OPTIONS] DOMAIN NAME

Arguments: domain, name

Option	What it does	Default
`--yes`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app process scale

Run INSTANCES copies of a process. 0 stops them and keeps the definition.

Shell

noust app process scale [OPTIONS] DOMAIN NAME INSTANCES

Arguments: domain, name, instances

Option	What it does	Default
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app process set

Define a process of the application, or change one, and run it.

Shell

noust app process set [OPTIONS] DOMAIN NAME COMMAND

Arguments: domain, name, command

Option	What it does	Default
`--instances`	How many copies run on this server.	`1`
`--memory`	MemoryMax of each copy.
`--cpu`	CPUQuota of each copy.
`--tasks`	TasksMax of each copy.
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app process-types

The process types (web, release, workers) a repository declares.

Shell

noust app process-types [OPTIONS] COMMAND [ARGS]...

Subcommands: show

noust app process-types show

Show the process types an application declares and which ones a deployment uses.

Shell

noust app process-types show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the process types as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app promote

Put a release of DOMAIN on another application and activate it there.

Shell

noust app promote [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--to`	The application that receives the release.
`--release`	The release (default: the one that serves).
`--schema-changed-ok`	Go back past a deployment of the target that changed its database's schema.
`--yes`, `-y`	Do not ask before promoting.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app promotion

List the applications a release of DOMAIN can be promoted to.

Shell

noust app promotion [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the targets as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app reclaim

Hand a Docker Compose stack that runs outside its unit back to Noust.

Shell

noust app reclaim [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--accept-recreate`	Hand it back even if starting the unit would recreate a container.
`--yes`, `-y`	Hand it back without asking.
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app replicas

Show how an application is scaled, or run it as COPIES copies of its web process.

Shell

noust app replicas [OPTIONS] DOMAIN [COPIES]

Arguments: domain, copies

Option	What it does	Default
`--json`	Print the copies as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app replication

Say whether the application could run on more than one server, and what stops it.

Shell

noust app replication [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the verdict as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app sandbox

Build an application without root: see, try, enable or disable its sandbox.

Shell

noust app sandbox [OPTIONS] COMMAND [ARGS]...

Subcommands: compose-exception, disable, enable, self-test, status, test

noust app sandbox compose-exception

Allow a Docker Compose stack privileged containers and the Docker socket.

Shell

noust app sandbox compose-exception [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--reason`	Why this stack needs it; recorded.
`--revoke`	Stop allowing it.
`--yes`, `-y`	Do not ask for confirmation.

noust app sandbox disable

Build the application as root: an explicit decision, recorded with a reason.

Shell

noust app sandbox disable [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--reason`	Why it cannot build in the sandbox; recorded. Required under the ENS profile or with security.exception_reasons on.
`--yes`, `-y`	Do not ask for confirmation.
`--json`	Print the new regime as JSON.

noust app sandbox enable

Build the application in the sandbox from its next deploy on.

Shell

noust app sandbox enable [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--force`	Enable without a passing trial.
`--network`	strict: install without the application's variables, build without a network.
`--pty`, `--no-pty`	Build on a terminal, for build scripts that reopen /dev/stderr.
`--json`	Print the new regime as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app sandbox self-test

Prove that the build sandbox holds on this server.

Shell

noust app sandbox self-test [OPTIONS]

Option	What it does	Default
`--json`	Print the checks as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app sandbox status

Show how an application builds: in the sandbox, or as root and why.

Shell

noust app sandbox status [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the build regime as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app sandbox test

Build what the application's next update would build, in the sandbox, without activating it.

Shell

noust app sandbox test [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the trial's outcome as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app source

How an application's repository is fetched, and which pushes deploy it.

Shell

noust app source [OPTIONS] COMMAND [ARGS]...

Subcommands: change, reset, set, show

noust app source change

Make an application deploy from another repository or directory.

Shell

noust app source change [OPTIONS] DOMAIN SOURCE

Arguments: domain, new_source

Option	What it does	Default
`-b`, `--branch`	The branch to follow. By default the one it follows now when SOURCE is the same repository at another address, else the remote's default.
`--no-check`	Do not ask the remote whether it can be read and has the branch (needs --branch).
`-y`, `--yes`	Change it without asking.
`--json`	Print the plan, or what was changed, as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app source reset

Go back to the default source options.

Shell

noust app source reset [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app source set

Change some source options of an application, keeping the others.

Shell

noust app source set [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--submodules`, `--no-submodules`	Initialise and export the submodules.
`--lfs`	Git LFS: auto fetches the files when the repository tracks any, on always, off never.
`--shallow`, `--no-shallow`	Fetch only the latest commit (--no-shallow keeps the full history).
`--watch-path`	A glob a push must touch to deploy (apps/web/**); repeat it, or prefix '!' to exclude. The last pattern that matches wins.
`--clear-watch-paths`	Remove every watch path.
`--skip-markers`, `--no-skip-markers`	Skip a push whose commits all say [skip ci] or [skip cd].
`--json`	Print the options now in force as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app source show

Show submodules, Git LFS, shallow clone, watch paths and skip markers of an application.

Shell

noust app source show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the source options as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app stop-grace

Show or set how long an application's unit has to stop, and with which signal.

Shell

noust app stop-grace [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--seconds`	How long the unit may take to stop before systemd kills it (1 to 3600).
`--signal`	The signal that asks it to stop (default SIGTERM).
`--reset`	Go back to systemd's own: 90 seconds and SIGTERM.
`--json`	Print the stop policy now in force as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app tag

Tags on applications: find them, and deploy the ones that share a tag.

Shell

noust app tag [OPTIONS] COMMAND [ARGS]...

Subcommands: add, deploy, list, remove, restart, set

noust app tag add

Give an application more tags.

Shell

noust app tag add [OPTIONS] DOMAIN TAGS...

Arguments: domain, tags

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app tag deploy

Update every application that carries TAG, one after the other.

Shell

noust app tag deploy [OPTIONS] TAG

Arguments: tag_name

Option	What it does	Default
`--force`	Rebuild applications even when their branch has nothing new.
`--stop-on-failure`	Leave the rest alone after the first one that fails.
`--json`	Print what came of each application as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

List the tags of one application, or every tagged application.

Shell

noust app tag list [OPTIONS] [DOMAIN]

Arguments: domain

Option	What it does	Default
`--tag`	Only the applications with this tag.
`--json`	Print the tags as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app tag remove

Take tags off an application.

Shell

noust app tag remove [OPTIONS] DOMAIN TAGS...

Arguments: domain, tags

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app tag restart

Restart every application and service that carries TAG.

Shell

noust app tag restart [OPTIONS] TAG

Arguments: tag_name

Option	What it does	Default
`--json`	Print what came of each as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app tag set

Make an application carry exactly these tags (none clears them).

Shell

noust app tag set [OPTIONS] DOMAIN [TAGS]...

Arguments: domain, tags

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app traffic

Show the requests an application served, and what was asked of it.

Shell

noust app traffic [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--window`	How far back to look.	`24h`
`--top`	Entries in each ranking.	`10`
`--json`	Print the traffic as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app tuning

Limits and options of an application's unit: soft memory, swap, weights, CPUs, ulimits, capabilities, devices.

Shell

noust app tuning [OPTIONS] COMMAND [ARGS]...

Subcommands: clear, set, status

noust app tuning clear

Remove all the tuning: the unit goes back to what the template writes.

Shell

noust app tuning clear [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--no-restart`	Write the unit but do not restart.
`--yes`, `-y`	Do not ask for confirmation.
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app tuning set

Tune the application's unit; what is not named is kept.

Shell

noust app tuning set [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--memory-high`	Soft memory limit: throttled above it, killed only at the hard one.
`--swap-max`	Swap the unit may use; 0 forbids it.
`--cpu-weight`	Share of the CPU when it is contended (100 is the default).
`--allowed-cpus`	Pin the unit to these CPUs, such as 0-3 or 0,2.
`--io-weight`	Share of the disk when it is contended.
`--nofile`	Open files (ulimit -n).
`--nproc`	Processes of the account (ulimit -u).
`--memlock`	Locked memory (ulimit -l).
`--core-dumps`, `--no-core-dumps`	Allow core dumps (ulimit -c).
`--cap`	A capability the process keeps (NET_BIND_SERVICE, ...); repeat it. Replaces the list.
`--device`	A device the process may open (/dev/nvidia0:rw, char-drm); repeat it. Replaces the list.
`--gpu`	Allow the devices a GPU needs (nvidia, dri); repeat it.
`--unset`	Remove one option (memory_high_mb, capabilities, ...); repeat it.
`--no-restart`	Write the unit but do not restart: the running process keeps what it has.
`--yes`, `-y`	Do not ask for confirmation.
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app tuning status

Show how the application's unit is tuned and the lines it has for it.

Shell

noust app tuning status [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the status as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app webhook

The deploy webhook of an application: a push to its repository deploys it.

Shell

noust app webhook [OPTIONS] COMMAND [ARGS]...

Subcommands: deliveries, disable, registry, rotate, show

noust app webhook deliveries

List what the forge has sent to this application's webhook.

Shell

noust app webhook deliveries [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--limit`	How many deliveries to list, newest first.	`20`
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the deliveries as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app webhook disable

Discard the webhook secret: deliveries are answered 404 from now on.

Shell

noust app webhook disable [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app webhook registry

Say what to give a container registry so a push of the image deploys the application.

Shell

noust app webhook registry [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--reveal`	Print the token of Docker Hub's address too (it is a credential, never shown otherwise).
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the addresses as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app webhook rotate

Create the webhook secret, or replace it.

Shell

noust app webhook rotate [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--yes`, `-y`	Do not ask for confirmation.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the new secret and the payload URL as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app webhook show

Show how far the webhook is set up.

Shell

noust app webhook show [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--reveal`	Print the secret too (it is never shown otherwise).
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the state as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust app zero-downtime

Show or switch blue/green activation of an application.

Shell

noust app zero-downtime [OPTIONS] DOMAIN [on|off]

Arguments: domain, mode

Option	What it does	Default
`--drain`	Seconds the old instance keeps running after a switch, 0 to 300. Default: 10.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the mode (or what was changed) as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Something on this page is wrong or unclear? Report it on GitHub.

Help, contributing and the project’s policies are under Project.