# noust db

Install engines, and manage databases, users, backups and application links.

```bash
noust db [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`access`](#noust-db-access), [`adopt`](#noust-db-adopt), [`backup`](#noust-db-backup), [`backup-delete`](#noust-db-backup-delete), [`backup-push`](#noust-db-backup-push), [`backup-remote`](#noust-db-backup-remote), [`backup-run`](#noust-db-backup-run), [`backup-schedule`](#noust-db-backup-schedule), [`backup-verify`](#noust-db-backup-verify), [`backups`](#noust-db-backups), [`catalog`](#noust-db-catalog), [`choices`](#noust-db-choices), [`config`](#noust-db-config), [`connect`](#noust-db-connect), [`connect-info`](#noust-db-connect-info), [`connection-string`](#noust-db-connection-string), [`create`](#noust-db-create), [`describe`](#noust-db-describe), [`drop`](#noust-db-drop), [`engines`](#noust-db-engines), [`explain`](#noust-db-explain), [`export`](#noust-db-export), [`exposure`](#noust-db-exposure), [`extension`](#noust-db-extension), [`fix-owner`](#noust-db-fix-owner), [`forget`](#noust-db-forget), [`globals`](#noust-db-globals), [`grant`](#noust-db-grant), [`history`](#noust-db-history), [`import`](#noust-db-import), [`import-all`](#noust-db-import-all), [`info`](#noust-db-info), [`install`](#noust-db-install), [`instance`](#noust-db-instance), [`key`](#noust-db-key), [`keys`](#noust-db-keys), [`limits`](#noust-db-limits), [`link`](#noust-db-link), [`links`](#noust-db-links), [`list`](#noust-db-list), [`metrics`](#noust-db-metrics), [`move`](#noust-db-move), [`pitr`](#noust-db-pitr), [`provision`](#noust-db-provision), [`public`](#noust-db-public), [`query`](#noust-db-query), [`replica`](#noust-db-replica), [`restart`](#noust-db-restart), [`restore`](#noust-db-restore), [`restore-remote`](#noust-db-restore-remote), [`revoke`](#noust-db-revoke), [`row`](#noust-db-row), [`rows`](#noust-db-rows), [`saved`](#noust-db-saved), [`settings`](#noust-db-settings), [`slow-queries`](#noust-db-slow-queries), [`sqlite`](#noust-db-sqlite), [`start`](#noust-db-start), [`status`](#noust-db-status), [`stop`](#noust-db-stop), [`tables`](#noust-db-tables), [`tag`](#noust-db-tag), [`tls`](#noust-db-tls), [`transfer`](#noust-db-transfer), [`uninstall`](#noust-db-uninstall), [`unlink`](#noust-db-unlink), [`user-create`](#noust-db-user-create), [`user-delete`](#noust-db-user-delete), [`user-list`](#noust-db-user-list), [`user-password`](#noust-db-user-password)

## noust db access

List who can reach a database, or give one account a profile on it.

```bash
noust db access [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--user`, `-u` | Account whose access to change. |  |
| `--profile` | The account's new profile. |  |
| `--host` | The account's host. | `localhost` |
| `--json` | Print the access list as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db adopt

Track the databases created outside Noust.

```bash
noust db adopt [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Only this engine. Defaults to all of them. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db backup

Write a database to a backup file.

```bash
noust db backup [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--output`, `-o` | Where to write the file. Defaults to the engine's backup directory. A name ending in .gz is gzipped; any other is written as the engine dumps it. |  |
| `--no-compress` | Write the dump without gzip. |  |
| `--format` | PostgreSQL's dump format. custom (pg_dump -Fc) by default. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db backup-delete

Delete a dump from this server, or its copy from a destination.

```bash
noust db backup-delete [OPTIONS] FILE
```

Arguments: `file`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the dump is of. |  |
| `--from` | Delete the copy on this destination instead of the local file. |  |
| `--database`, `-d` | The database the dump is of; needed with --from. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db backup-push

Send a dump to a backup destination, after checking it.

```bash
noust db backup-push [OPTIONS] FILE
```

Arguments: `file`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the dump is of. |  |
| `--to` | A backup destination. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db backup-remote

List what a backup destination holds: the databases, or one database's dumps.

```bash
noust db backup-remote [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine to list dumps of. |  |
| `--from` | A backup destination. |  |
| `--database`, `-d` | List this database's dumps instead of the databases. |  |
| `--json` | Print the listing as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db backup-run

Run a database's backup policy now: dump, check, send, prune.

```bash
noust db backup-run [OPTIONS] [DATABASE]
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--all` | Run the policy that covers every database. |  |
| `--json` | Print what the run did as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db backup-schedule

Set, show or remove a database's backup policy (schedule, retention, destinations).

```bash
noust db backup-schedule [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`remove`](#noust-db-backup-schedule-remove), [`set`](#noust-db-backup-schedule-set), [`show`](#noust-db-backup-schedule-show)

## noust db backup-schedule remove

Remove a database's backup policy and its timer. Its dumps stay.

```bash
noust db backup-schedule remove [OPTIONS] [DATABASE]
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--all` | The policy that covers every database. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db backup-schedule set

Create or replace a database's backup policy, and its timer.

```bash
noust db backup-schedule set [OPTIONS] [DATABASE]
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--all` | One policy for every database of the engine, those created later too. |  |
| `--exclude-database` | With --all, a database to skip. Repeatable. |  |
| `--exclude-schema` | PostgreSQL schema to leave out of every dump. Repeatable. |  |
| `--exclude-table` | Table (PostgreSQL, MySQL, MariaDB) or collection (MongoDB) to leave out. Repeatable. |  |
| `--schedule` | hourly, daily, weekly, monthly or a systemd OnCalendar expression. | `daily` |
| `--keep` | Scheduled dumps to keep here, or 'none'. Dumps taken by hand are never deleted. | `7` |
| `--keep-days` | Days to keep a scheduled dump here, or 'none'. | `30` |
| `--keep-gb` | The most the scheduled backups kept here may weigh together, in gigabytes, or 'none'. The newest always stays, whatever its size. | `none` |
| `--to` | Send each dump to this backup destination, keeping COUNT, DAYS and GB there. Repeatable. |  |
| `--format` | PostgreSQL's dump format. custom (pg_dump -Fc) by default. |  |
| `--verify-restore` | Load each dump into a temporary database, and drop it, as proof it restores. |  |
| `--remote-only` | Keep no copy on this server: a scheduled dump is deleted once every --to destination holds it (for a small disk). A dump that could not be sent everywhere stays. |  |
| `--disable` | Keep the settings but install no timer. |  |
| `--max-runtime` | Stop a run that takes longer than this: 90m, 2h, 1d or a number of seconds (1 minute to 7 days). No limit by default. |  |
| `--timezone` | Read the schedule in this time zone, such as Europe/Madrid (timedatectl list-timezones lists them). The server's clock by default. |  |
| `--json` | Print the policy as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db backup-schedule show

Show one database's backup policy, or every policy.

```bash
noust db backup-schedule show [OPTIONS] [DATABASE]
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--all` | The policy that covers every database. |  |
| `--json` | Print the policies as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db backup-verify

Check a dump: size, digest and the engine's own reading of it.

```bash
noust db backup-verify [OPTIONS] FILE
```

Arguments: `file`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the dump is of. |  |
| `--restore-test` | Also load it into a temporary database, dropped afterwards. |  |
| `--json` | Print the dump and its evidence as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db backups

List the database backups on this server.

```bash
noust db backups [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Only this engine. Defaults to all of them. |  |
| `--database`, `-d` | Only backups of this database. |  |
| `--json` | Print the backup list as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db catalog

Show which engines and versions can be installed on this server.

```bash
noust db catalog [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the catalog as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db choices

List the engines and versions a database can be created on, and how.

```bash
noust db choices [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the choices as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db config

Store the account Noust signs in to an engine with, after trying it.

```bash
noust db config [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the credentials are for. |  |
| `--user`, `-u` | Administrative user, such as root. |  |
| `--password`, `-p` | Administrative password. Alone, it is asked for without echo, so it never reaches the shell history or the process list. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db connect

Open a session with the engine's own client.

```bash
noust db connect [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine to connect to. |  |
| `--database`, `-d` | Database to open. |  |
| `--username`, `-u` | User to connect as. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db connect-info

Show the SSH tunnel to reach a database from your computer.

```bash
noust db connect-info [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--username`, `-u` | Account to connect as. |  |
| `--server` | This server's address as you reach it. Detected by default. |  |
| `--ssh-user` | Account to sign in to the server as. root by default. |  |
| `--json` | Print everything as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db connection-string

Print a connection string for an application to use.

```bash
noust db connection-string [OPTIONS] DATABASE USERNAME
```

Arguments: `database`, `username`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--password`, `-p` | Password. A placeholder is printed when omitted. |  |
| `--host` | Host the application uses. | `localhost` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db create

Create a database and record it in the store.

```bash
noust db create [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine to create it on. |  |
| `--owner`, `-o` | User that will own the database. |  |
| `--encoding` | Character encoding. Defaults to UTF8. |  |
| `--app` | Application it belongs to, so its backups include it. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db describe

Show a table's columns, primary key, indexes and constraints.

```bash
noust db describe [OPTIONS] DATABASE TABLE
```

Arguments: `database`, `table`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--schema` | Schema. Defaults to public, or the database on MySQL. |  |
| `--json` | Print the structure as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db drop

Delete a database and everything in it, after a last dump.

```bash
noust db drop [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--no-backup` | Do not take a last dump before dropping. |  |
| `--unlink` | Also remove its variables from the applications using it. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db engines

List the engines Noust can manage, and their versions.

```bash
noust db engines [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the engine list as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db explain

Show how the engine would run a statement.

```bash
noust db explain [OPTIONS] DATABASE QUERY
```

Arguments: `database`, `query`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--analyze` | Run the statement to time it, as the superuser, inside a transaction rolled back. |  |
| `--timeout` | Seconds. | `30` |
| `--json` | Print the plan as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db export

Print a read's whole result as CSV or JSON, to redirect into a file.

```bash
noust db export [OPTIONS] DATABASE QUERY
```

Arguments: `database`, `query`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--format` |  | `csv` |
| `--max-rows` |  | `50000` |
| `--timeout` | Seconds. | `30` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db exposure

List database ports open beyond this machine; exits 1 when there is one.

```bash
noust db exposure [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the open ports as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db extension

Load and unload the PostgreSQL extensions of a database.

```bash
noust db extension [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-db-extension-add), [`list`](#noust-db-extension-list), [`remove`](#noust-db-extension-remove)

## noust db extension add

Load an extension into a database (CREATE EXTENSION).

```bash
noust db extension add [OPTIONS] DATABASE NAME
```

Arguments: `database`, `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The PostgreSQL it is on. |  |
| `--cascade` | Also load the extensions it needs (CREATE EXTENSION ... CASCADE). |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the extension as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db extension list

List the extensions of a database: the loaded ones, or with --all everything the server offers.

```bash
noust db extension list [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The PostgreSQL it is on. |  |
| `--all` | Also the extensions that are not loaded. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the extensions as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db extension remove

Unload an extension from a database (DROP EXTENSION).

```bash
noust db extension remove [OPTIONS] DATABASE NAME
```

Arguments: `database`, `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The PostgreSQL it is on. |  |
| `--cascade` | Also drop what depends on it. Without it PostgreSQL refuses. |  |
| `--yes`, `-y` | Do not ask before unloading it. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the extension as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db fix-owner

Give a PostgreSQL database, and its objects, to its application's role.

```bash
noust db fix-owner [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--owner` | Role that must own it. Defaults to the one Noust provisioned. |  |
| `--apply` | Make the change; only show it without. |  |
| `--force`, `-f`, `-y` | Do not ask before applying. |  |
| `--json` | Print the plan as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db forget

Forget a tracked database that no longer exists on its engine.

```bash
noust db forget [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database was on. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db globals

The roles of a PostgreSQL server, which no database dump carries.

```bash
noust db globals [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`dump`](#noust-db-globals-dump), [`list`](#noust-db-globals-list), [`restore`](#noust-db-globals-restore)

## noust db globals dump

Dump the roles of the server with pg_dumpall --globals-only.

```bash
noust db globals dump [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--output`, `-o` | Write the file here instead of the backup directory. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db globals list

List the files of roles this server has dumped, newest first.

```bash
noust db globals list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the files as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db globals restore

Create the roles of a file that this server does not have.

```bash
noust db globals restore [OPTIONS] SOURCE
```

Arguments: `source`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db grant

Grant a user privileges on a database.

```bash
noust db grant [OPTIONS] USERNAME DATABASE
```

Arguments: `username`, `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--privileges` | Comma-separated privileges. Defaults to the engine's full set. |  |
| `--host` | Host the grant applies to. | `localhost` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db history

List the statements you ran in the console, newest first.

```bash
noust db history [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Only this engine's. |  |
| `--database`, `-d` | Only this database's. |  |
| `--limit` |  | `20` |
| `--clear` | Forget them instead of listing them. |  |
| `--json` | Print the history as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db import

Import a dump into DATABASE, creating it when it does not exist.

```bash
noust db import [OPTIONS] DATABASE FILE
```

Arguments: `database`, `file`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--replace` | Drop the database and load the dump into a fresh one. A safety copy is taken first and put back if the import fails. |  |
| `--keep-owners` | PostgreSQL: keep the owners and privileges the dump names. By default they are left out, because they are the roles of the server it came from, and everything belongs to the database's owner. |  |
| `--no-safety-copy` | Do not dump the database first when nothing is dropped. |  |
| `--owner` | PostgreSQL: the account a database this import makes belongs to (it must exist), instead of the default. A database that is loaded over keeps its owner. |  |
| `--as-superuser` | PostgreSQL: load the dump as the server's superuser. By default it is loaded as the database's owner, so what a dump asks beyond that (COPY ... FROM PROGRAM, extensions that need a superuser) is refused. Use it only for a dump you made or have read. Audited. |  |
| `--inspect` | Say what the file is and whether the engine can load it, and stop. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--json` | Print what the import did as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db import-all

Import a dump of every database of an engine, and its accounts when asked.

```bash
noust db import-all [OPTIONS] FILE
```

Arguments: `file`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine to import into. |  |
| `--users` | Also create the accounts of the dump (PostgreSQL: its roles, with the password hash it holds). Without superuser, role-creating, replication or row-security-bypassing power, and never over an account that exists. The databases then keep the owners and privileges the dump names for those accounts. |  |
| `--accounts-file` | MySQL and MariaDB: a file of CREATE USER and GRANT statements, one per line (SHOW CREATE USER and SHOW GRANTS print them, so does pt-show-grants); mysqldump does not write the accounts. Used with --users. |  |
| `--database`, `-d` | Load only this database (repeat for several). The server's own ones (postgres) are loaded only when named. |  |
| `--replace` | Drop each database that exists and load the dump into a fresh one. A safety copy is taken first and put back if its load fails. |  |
| `--no-safety-copy` | Do not dump a database first when it is loaded over rather than replaced. |  |
| `--as-superuser` | Load every database as the server's superuser instead of as its owner. By default a database is loaded as its owner, so what a dump asks beyond that (COPY ... FROM PROGRAM, extensions that need a superuser) is refused. Use it only for a file you made or have read. Audited. |  |
| `--plan` | Say what would be created, loaded over, replaced or left out, and stop. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--json` | Print the plan or what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db info

Show a database's size, owner, application, support and access.

```bash
noust db info [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--json` | Print the database's details as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db install

Install a database engine: postgresql, mysql, mariadb, redis, valkey or mongodb.

```bash
noust db install [OPTIONS] ENGINE
```

Arguments: `engine`

| Option | What it does | Default |
|---|---|---|
| `--version` | Version to install (see 'noust db catalog'); the distribution's by default. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance

Run another version of an engine, or an engine the host lacks, in a container.

```bash
noust db instance [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`catalog`](#noust-db-instance-catalog), [`create`](#noust-db-instance-create), [`health`](#noust-db-instance-health), [`launch`](#noust-db-instance-launch), [`limits`](#noust-db-instance-limits), [`list`](#noust-db-instance-list), [`migrate`](#noust-db-instance-migrate), [`migrations`](#noust-db-instance-migrations), [`remove`](#noust-db-instance-remove), [`renew-tls`](#noust-db-instance-renew-tls), [`rollback`](#noust-db-instance-rollback), [`show`](#noust-db-instance-show), [`start`](#noust-db-instance-start), [`stop`](#noust-db-instance-stop), [`tls`](#noust-db-instance-tls), [`tls-ca`](#noust-db-instance-tls-ca), [`upgrade`](#noust-db-instance-upgrade)

## noust db instance catalog

List the engines Noust can run as an instance, and the versions it offers.

```bash
noust db instance catalog [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the catalog as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance create

Make an instance NAME and start it.

```bash
noust db instance create [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | What to run: a flavour of the catalog. |  |
| `--version` | Its version, such as 16 or 8.4 ('noust db instance catalog'). The default one when omitted. |  |
| `--memory` | Its memory limit, such as 512m or 2g. Mandatory: the container is held to it and the engine sizes its caches to it. |  |
| `--port` | The port on 127.0.0.1. A free one just above the engine's own when omitted. |  |
| `--variant` | An image of the engine with something added, such as pgvector or postgis for PostgreSQL ('noust db instance catalog'). The engine's own image when omitted. |  |
| `--init-script` | A .sql file the engine runs, in name order, the first time it starts (PostgreSQL, MySQL and MariaDB; repeatable). It is not run again, and it is readable by the container: no secrets. |  |
| `--image` | An image of your own instead of the catalog's: repository[:tag]@sha256:DIGEST. The digest is mandatory (a tag can be moved after you looked; 'docker buildx imagetools inspect REPO:TAG' prints it) and --version says which version it is. Noust has not tested it. |  |
| `--args` | Arguments added after the ones Noust passes the engine, such as '-c max_connections=200'. Split like a shell would and never run by one. Not with --command. No secrets: a command line is visible to every local user. |  |
| `--command` | The container's whole command, instead of the engine's: Noust adds nothing to it (the memory share, TLS), so it is refused for an instance that serves TLS. Not with --args. |  |
| `--accept-untested` | Accept that Noust has not tested an image, a command or arguments you chose. Needed with --yes or --json for them; --yes alone answers the question, not this. |  |
| `--yes`, `-y` | Do not ask before making it. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the instance as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance health

Show or change how an instance is asked whether it is well.

```bash
noust db instance health [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--interval` | Seconds between probes. 'default' is 10. |  |
| `--timeout` | Seconds a probe may take. 'default' is 5. |  |
| `--retries` | Failed probes in a row before the engine is unhealthy. 'default' is 12. |  |
| `--plan` | Only say what it would do. |  |
| `--yes`, `-y` | Do not ask before restarting it. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the settings, the plan or what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance launch

Show or change what an instance's container is started with.

```bash
noust db instance launch [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--args` | Arguments added after the ones Noust passes the engine, such as '-c work_mem=8MB'. Split like a shell would and never run by one; no secrets. |  |
| `--command` | The container's whole command, instead of the engine's. Noust adds nothing to it. |  |
| `--reset` | Take both back to what Noust passes the engine. |  |
| `--plan` | Only say what it would do. |  |
| `--accept-untested` | Accept that Noust has not tested your words. |  |
| `--yes`, `-y` | Do not ask before restarting it. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the command, the plan or what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance limits

Show or change what an instance may use: memory, CPUs and swap.

```bash
noust db instance limits [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--memory` | Its memory limit, such as 2g. The engine's caches follow. |  |
| `--cpus` | How many CPUs it may use, such as 1.5. 'none' lifts the limit. |  |
| `--swap` | Swap it may use on top of its memory: 0 for none, or 512m. 'default' leaves Docker's. |  |
| `--plan` | Only say what it would do. |  |
| `--yes`, `-y` | Do not ask before restarting it. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the settings, the plan or what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance list

List the instances Noust runs, and how much of the server's memory they hold.

```bash
noust db instance list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the instances and the memory they hold as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance migrate

Move an engine's databases to a new instance of a newer major version.

```bash
noust db instance migrate [OPTIONS] SOURCE
```

Arguments: `source`

| Option | What it does | Default |
|---|---|---|
| `--to-version` | The version to go to, such as 17 ('noust db instance catalog'). Newer than the one it leaves. |  |
| `--name` | What to call the new instance. The engine and its version when omitted. |  |
| `--memory` | Its memory limit, such as 1g. The old instance's, or the engine's suggestion, when omitted. |  |
| `--port` | The port on 127.0.0.1. A free one when omitted. |  |
| `--plan` | Only say what it would do. |  |
| `--yes`, `-y` | Do not ask before moving. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the plan or what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance migrations

List the moves to a newer version, newest first, and which can be rolled back.

```bash
noust db instance migrations [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the moves as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance remove

Remove an instance, its container, its volumes and its data.

```bash
noust db instance remove [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Accept that its data is deleted, without asking. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print what was removed as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance renew-tls

Sign an instance's certificate again and restart it on the new one.

```bash
noust db instance renew-tls [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask before restarting it. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the new status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance rollback

Point the applications back at the engine a move left.

```bash
noust db instance rollback [OPTIONS] MIGRATION
```

Arguments: `migration`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask before going back. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance show

Show one instance: its image, its port, its memory, where its files are.

```bash
noust db instance show [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the instance as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance start

Start an instance and wait until its engine answers.

```bash
noust db instance start [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the instance as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance stop

Stop an instance. Its data stays; the applications that use it lose their database.

```bash
noust db instance stop [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the instance as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance tls

Show or change how an instance serves TLS.

```bash
noust db instance tls [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--mode` | off, optional (TLS when the client asks) or required (nothing else gets in). Only shows how it serves TLS when omitted. |  |
| `--plan` | Only say what it would do. |  |
| `--yes`, `-y` | Do not ask before restarting it. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the status, the plan or what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance tls-ca

Show Noust's certificate authority, the one applications trust.

```bash
noust db instance tls-ca [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the authority's certificate as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db instance upgrade

Move an instance to the newest image of its version.

```bash
noust db instance upgrade [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--no-backup` | Do not dump every database first. Only when its data does not matter. |  |
| `--image` | For an instance on an image of your own: the next one, repository[:tag]@sha256:DIGEST. Noust never looks for a newer image of one you pinned. |  |
| `--accept-untested` | Accept that Noust has not tested the image you name. Needed with --json. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print what changed as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db key

Show a bounded preview of one Redis key.

```bash
noust db key [OPTIONS] SLOT KEY
```

Arguments: `slot`, `key`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` |  | `redis` |
| `--hex` | KEY is the key's bytes in hexadecimal. |  |
| `--json` | Print the preview as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db keys

Scan a Redis database's keys, with their type, TTL and memory.

```bash
noust db keys [OPTIONS] [SLOT]
```

Arguments: `slot`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` |  | `redis` |
| `--match` | Glob pattern, such as 'session:*'. |  |
| `--cursor` | Continue a scan. | `0` |
| `--count` |  | `100` |
| `--type` |  |  |
| `--json` | Print the keys as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db limits

Show the limits of an engine on this host, or set them.

```bash
noust db limits [OPTIONS] ENGINE
```

Arguments: `engine`

| Option | What it does | Default |
|---|---|---|
| `--memory` | Memory the engine may use: 4096, 512m or 4g. The kernel kills it above. |  |
| `--cpus` | Processors it may use: 0.5, 2 or 3.5. |  |
| `--swap` | Swap it may use besides its memory, in megabytes; 0 gives it none. |  |
| `--tasks` | Processes and threads it may have (256 or more). |  |
| `--remove` | Take a limit away; repeat it for several. |  |
| `--yes`, `-y` | Accept a memory limit below what the engine uses now. |  |
| `--json` | Print the limits or the outcome as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db link

Give an application a database's connection string, and restart it.

```bash
noust db link [OPTIONS] DOMAIN DATABASE
```

Arguments: `domain`, `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--user`, `-u` | Account to sign in as. Noust must know it. |  |
| `--env-var` | Variable to write. DATABASE_URL, or REDIS_URL for Redis. |  |
| `--extra-vars` | Also write DB_HOST, DB_PORT, DB_NAME, ... |  |
| `--tls` | Make the application encrypt the connection and, with verify-ca or verify-full, check the engine's certificate against Noust's authority. Needs an engine that serves TLS (noust db instance tls). |  |
| `--no-restart` | Write the variables without restarting. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db links

List the databases an application uses.

```bash
noust db links [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the list as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db list

List the databases on every running engine.

```bash
noust db list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Only this engine. Defaults to all of them. |  |
| `--open` | Print the panel URL for the database list, opening it if a display is available. |  |
| `--tag` | Only the databases that carry this tag. |  |
| `--team` | Only this team's. |  |
| `--project` | Only what lives in the projects with this name. |  |
| `--env` | Only what lives in the environments with this name. |  |
| `--json` | Print the database list as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db metrics

Show an engine's, or one database's, size, connections and cache hits.

```bash
noust db metrics [OPTIONS] ENGINE [DATABASE]
```

Arguments: `engine`, `database`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the metrics as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db move

Move DATABASE to another engine: another version, the host's or an instance.

```bash
noust db move [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--from` | The engine it is on, such as postgresql@pg16. |  |
| `--to` | The engine it goes to. |  |
| `--replace` | Replace a database of that name the target already holds, after a safety copy. |  |
| `--drop-source` | Drop it from the engine it leaves, after a last dump. It stays otherwise. |  |
| `--plan` | Only say what it would do. |  |
| `--yes`, `-y` | Do not ask before moving. |  |
| `--json` | Print the plan or what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db pitr

Recover PostgreSQL to an instant: the log archived, base backups, and the recovery.

```bash
noust db pitr [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`base`](#noust-db-pitr-base), [`disable`](#noust-db-pitr-disable), [`enable`](#noust-db-pitr-enable), [`fetch`](#noust-db-pitr-fetch), [`restore`](#noust-db-pitr-restore), [`run`](#noust-db-pitr-run), [`status`](#noust-db-pitr-status), [`sync`](#noust-db-pitr-sync)

## noust db pitr base

Take a base backup now, and apply retention.

```bash
noust db pitr base [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the base backup as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db pitr disable

Stop archiving the log. The archive and the base backups stay unless --delete-archive.

```bash
noust db pitr disable [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--delete-archive` | Also delete the archived log, the base backups and what the destinations hold of them. |  |
| `--yes`, `-y` | Do not ask before restarting PostgreSQL. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db pitr enable

Start archiving the write-ahead log, prove it works and take the first base backup.

```bash
noust db pitr enable [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--every` | Take a base backup when the last is this many hours old. | `168` |
| `--keep` | Base backups to keep, or 'none' for no limit by number. | `none` |
| `--keep-days` | How many days back a recovery must be possible, or 'none'. With both limits, the one that keeps more wins. | `7` |
| `--to` | Send the log and the base backups to this backup destination. Repeatable. |  |
| `--plan` | Say what it would do and change nothing. |  |
| `--yes`, `-y` | Do not ask before restarting PostgreSQL. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db pitr fetch

Bring the base backups and the log back from DESTINATION, for a recovery.

```bash
noust db pitr fetch [OPTIONS] DESTINATION
```

Arguments: `destination`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what was downloaded as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db pitr restore

Recover the whole cluster to an instant.

```bash
noust db pitr restore [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--time` | Recover to this instant, such as '2026-10-17 12:34:56' (UTC unless it carries an offset). |  |
| `--latest` | Recover to the end of the archived log. |  |
| `--base` | Start from this base backup (see: status). |  |
| `--plan` | Say what it would do and change nothing. |  |
| `--yes`, `-y` | Do not ask before replacing the cluster. |  |
| `--json` | Print the plan or the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db pitr run

Do the upkeep: a base backup when one is due, retention, and sending the archive.

```bash
noust db pitr run [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what the run did as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db pitr status

Show whether the log is archived, the base backups, and the window a recovery can reach.

```bash
noust db pitr status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db pitr sync

Send the log and the base backups to the destinations, and prune them there.

```bash
noust db pitr sync [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what was sent as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db provision

Create a database and an account for an application, and link them.

```bash
noust db provision [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine to create it on. |  |
| `--name` | Database name. Derived from the application by default. |  |
| `--env-var` | Variable to write. DATABASE_URL, or REDIS_URL for Redis. |  |
| `--extra-vars` | Also write DB_HOST, DB_PORT, DB_NAME, ... |  |
| `--no-restart` | Write the variables without restarting. |  |
| `--version` | The version of the engine the database is for, such as 17 or 11.4 ('noust db choices' lists them). The installed one when omitted. |  |
| `--install` | Install the engine, in --version, first when it is not installed: the same as 'noust db install'. |  |
| `--instance` | Make it on this instance Noust runs ('noust db instance list') instead of the host's engine. One is also chosen by itself when --version is what an instance runs and the host does not. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db public

Make a database reachable from the network on purpose, and private again.

```bash
noust db public [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`close`](#noust-db-public-close), [`list`](#noust-db-public-list), [`open`](#noust-db-public-open), [`show`](#noust-db-public-show)

## noust db public close

Make DATABASE private again: remove the port, the account, the TLS line and the firewall rule.

```bash
noust db public close [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print what was removed as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db public list

List the databases that are reachable from the network.

```bash
noust db public list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the databases as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db public open

Make DATABASE reachable from the network: a public port, an account of its own, the firewall.

```bash
noust db public open [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--port` | The public port. A free one near the engine's is chosen. |  |
| `--bind` | Address to listen on: 0.0.0.0 (every IPv4 address, the default), :: or one address. |  |
| `--from` | Let only this address or network (CIDR) in; repeat for several. Anyone when omitted. |  |
| `--allow-plaintext` | Do not require TLS. The password and the data then cross the network in clear. |  |
| `--access` | What the account made for it may do on this database. | `owner` |
| `--yes`, `-y` | Accept every warning without asking. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the outcome (with the password, once) as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db public show

Show how DATABASE is reachable, and whether it listens now.

```bash
noust db public show [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--reveal` | Print the account's password too, in the connection details. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the exposure (and, with --reveal, the connection) as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db query

Run one statement against a database, read-only unless told otherwise.

```bash
noust db query [OPTIONS] DATABASE QUERY
```

Arguments: `database`, `query`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--write` | Allow the statement to change data. Without it the engine runs one statement as the database's read-only account. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db replica

Run read replicas of this server's PostgreSQL, over TLS, with an account of their own.

```bash
noust db replica [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`join`](#noust-db-replica-join), [`prepare`](#noust-db-replica-prepare), [`promote`](#noust-db-replica-promote), [`remove`](#noust-db-replica-remove), [`status`](#noust-db-replica-status), [`token`](#noust-db-replica-token)

## noust db replica join

Make this server a replica of the primary CODE names.

```bash
noust db replica join [OPTIONS] [CODE]
```

Arguments: `code`

| Option | What it does | Default |
|---|---|---|
| `--token-file` | Read the join code from this file. |  |
| `--replace-data` | Accept that this server's PostgreSQL data is replaced by the primary's. |  |
| `--discard-previous` | Delete this server's old data directory once the replica streams (it is kept otherwise). |  |
| `--plan` | Check everything and say what would be done. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db replica prepare

Make room for a replica called NAME on this server, and print its join code.

```bash
noust db replica prepare [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The engine: postgresql, or mysql for MySQL and MariaDB. | `postgresql` |
| `--from` | Where the replica connects from: its address or network (203.0.113.7, 10.0.0.0/24). |  |
| `--host` | The name the replica connects to. PostgreSQL's certificate must cover it. |  |
| `--listen` | Make PostgreSQL listen here too (an address of this server, or '*'). Needed when it listens on the loopback only; restarts it once. |  |
| `--ca-file` | The authority that signed PostgreSQL's certificate, when the replica does not trust it already (a private authority). |  |
| `--open-firewall` | Allow the port from the replica's address. |  |
| `--token-file` | Write the join code to this file (0600) instead of printing it. |  |
| `--plan` | Check everything and say what would be done. |  |
| `--yes`, `-y` | Do not ask before restarting PostgreSQL. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db replica promote

Stop following the primary: this server becomes a primary and accepts writes.

```bash
noust db replica promote [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The engine: postgresql, or mysql for MySQL and MariaDB. | `postgresql` |
| `--yes`, `-y` | Do not ask. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db replica remove

Take a replica away: its account, its slot and its pg_hba.conf line go.

```bash
noust db replica remove [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The engine: postgresql, or mysql for MySQL and MariaDB. | `postgresql` |
| `--restore-listen` | Put the address the engine listens on back as it was before the replica was prepared (restarts the engine; for MySQL and MariaDB it takes Noust's settings file off). |  |
| `--yes`, `-y` | Do not ask. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db replica status

Show the replicas prepared here, or the primary this server follows.

```bash
noust db replica status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Only this engine's. Without it, every engine installed. |  |
| `--json` | Print the status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db replica token

Print the join code of a replica prepared here again.

```bash
noust db replica token [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The engine: postgresql, or mysql for MySQL and MariaDB. | `postgresql` |
| `--token-file` | Write the join code to this file (0600) instead of printing it. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db restart

Restart an engine's service.

```bash
noust db restart [OPTIONS] ENGINE
```

Arguments: `engine`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db restore

Load a backup into a database, never losing what it held.

```bash
noust db restore [OPTIONS] DATABASE FILE
```

Arguments: `database`, `file`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--drop` | Drop the database before restoring it. A safety copy is taken first and put back if the restore fails. |  |
| `--as-new` | Restore into a new database of this name instead. |  |
| `--no-safety-copy` | Do not dump the database first when nothing is dropped. |  |
| `--as-superuser` | PostgreSQL: load a file Noust did not write as the server's superuser instead of the database's owner. A dump can run programs on this server (COPY ... FROM PROGRAM) with that account: use it only for a dump you made or have read, when the error says the owner may not do what it asks. Audited. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db restore-remote

Download a dump from a destination, verify it and restore it.

```bash
noust db restore-remote [OPTIONS] DATABASE FILE
```

Arguments: `database`, `file`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--from` | The backup destination it is on. |  |
| `--as-new` | Restore into a new database of this name instead. |  |
| `--drop` | Drop the database before restoring it. A safety copy is taken first and put back if the restore fails. |  |
| `--no-safety-copy` | Do not dump the database first when nothing is dropped. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db revoke

Take privileges away from a user.

```bash
noust db revoke [OPTIONS] USERNAME DATABASE
```

Arguments: `username`, `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--privileges` | Comma-separated privileges. Defaults to the engine's full set. |  |
| `--host` | Host the grant applies to. | `localhost` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db row

Insert, change or delete one row, found by its whole primary key.

```bash
noust db row [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`delete`](#noust-db-row-delete), [`insert`](#noust-db-row-insert), [`update`](#noust-db-row-update)

## noust db row delete

Delete one row; nothing changes unless exactly that row exists.

```bash
noust db row delete [OPTIONS] DATABASE TABLE
```

Arguments: `database`, `table`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--schema` | Schema. Defaults to public, or the database on MySQL. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--key` | column=value of the primary key. |  |
| `--json` | Print the change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db row insert

Insert one row; columns left out take their defaults.

```bash
noust db row insert [OPTIONS] DATABASE TABLE
```

Arguments: `database`, `table`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--schema` | Schema. Defaults to public, or the database on MySQL. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--set` | column=value, or column:=<json>; repeatable. |  |
| `--json` | Print the change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db row update

Change one row; nothing changes unless exactly that row exists.

```bash
noust db row update [OPTIONS] DATABASE TABLE
```

Arguments: `database`, `table`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--schema` | Schema. Defaults to public, or the database on MySQL. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--key` | column=value of the primary key. |  |
| `--set` | column=value, or column:=<json>. |  |
| `--json` | Print the change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db rows

Read a page of a table's rows, as the database's read-only account.

```bash
noust db rows [OPTIONS] DATABASE TABLE
```

Arguments: `database`, `table`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--schema` | Schema. Defaults to public, or the database on MySQL. |  |
| `--limit` |  | `100` |
| `--offset` | Rows to skip (sorted by other columns). | `0` |
| `--cursor` | Continue after a previous page (next cursor). |  |
| `--order` | column or column:desc; repeatable. |  |
| `--filter` | column:op:value (eq neq lt lte gt gte like ilike in null notnull). |  |
| `--count` | Also count every matching row. |  |
| `--timeout` | Seconds. | `30` |
| `--json` | Print the page as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db saved

Keep statements under a name.

```bash
noust db saved [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-db-saved-add), [`list`](#noust-db-saved-list), [`remove`](#noust-db-saved-remove)

## noust db saved add

Save a statement under a name.

```bash
noust db saved add [OPTIONS] NAME QUERY
```

Arguments: `name`, `query`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine it is for. |  |
| `--database`, `-d` | Database it is for; any when omitted. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db saved list

List your saved queries.

```bash
noust db saved list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Only this engine's. |  |
| `--database`, `-d` | Only those for this database or for any. |  |
| `--json` | Print them as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db saved remove

Delete one of your saved queries.

```bash
noust db saved remove [OPTIONS] SAVED_ID
```

Arguments: `saved_id`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db settings

Show an engine's settings, or change them with KEY=VALUE.

```bash
noust db settings [OPTIONS] ENGINE [KEY=VALUE]...
```

Arguments: `engine`, `assignments`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Accept what the change costs: listening beyond this server, a Redis that refuses writes or drops keys, persistence turned off. |  |
| `--json` | Print the settings or the outcome as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db slow-queries

List the statements that take longest on average, or how to turn that on.

```bash
noust db slow-queries [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--limit` |  | `20` |
| `--json` | Print them as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db sqlite

The SQLite databases an application keeps: list, check and copy them.

```bash
noust db sqlite [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`check`](#noust-db-sqlite-check), [`copy`](#noust-db-sqlite-copy), [`list`](#noust-db-sqlite-list)

## noust db sqlite check

Ask SQLite whether a database is sound. Changes nothing.

```bash
noust db sqlite check [OPTIONS] DOMAIN PATH
```

Arguments: `domain`, `path`

| Option | What it does | Default |
|---|---|---|
| `--full` | Run integrity_check, which also checks every index against its table; slower. |  |
| `--budget` | Seconds after which a check stops where it is and says so. | `30.0` |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db sqlite copy

Copy a database, consistently, while the application runs.

```bash
noust db sqlite copy [OPTIONS] DOMAIN PATH
```

Arguments: `domain`, `path`

| Option | What it does | Default |
|---|---|---|
| `--output`, `-o` | The file to write. It must not exist; it is created private (0600). |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the copy as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db sqlite list

List the SQLite databases applications keep, in their data directories.

```bash
noust db sqlite list [OPTIONS] [DOMAIN]
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the databases as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db start

Start an engine's service.

```bash
noust db start [OPTIONS] ENGINE
```

Arguments: `engine`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db status

Show which engines are installed and running, and their upstream support.

```bash
noust db status [OPTIONS] [ENGINE]
```

Arguments: `engine`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the statuses as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db stop

Stop an engine's service.

```bash
noust db stop [OPTIONS] ENGINE
```

Arguments: `engine`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db tables

List a database's tables and views, with estimated rows and sizes.

```bash
noust db tables [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--schema` | Only this schema's. |  |
| `--search` | Only names containing this. |  |
| `--kind` |  |  |
| `--json` | Print the tables as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db tag

Free labels on databases, to find them by.

```bash
noust db tag [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-db-tag-add), [`list`](#noust-db-tag-list), [`remove`](#noust-db-tag-remove), [`set`](#noust-db-tag-set)

## noust db tag add

Give a database more tags.

```bash
noust db tag add [OPTIONS] NAME TAGS...
```

Arguments: `name`, `tags`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The engine the database is on (postgresql, ...). |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db tag list

List the tags of a database, or every tagged one.

```bash
noust db tag list [OPTIONS] [NAME]
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--tag` | Only the databases with this tag. |  |
| `--engine`, `-e` | The engine the database is on (postgresql, ...). |  |
| `--json` | Print the tags as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db tag remove

Take tags off a database.

```bash
noust db tag remove [OPTIONS] NAME TAGS...
```

Arguments: `name`, `tags`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The engine the database is on (postgresql, ...). |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db tag set

Make a database carry exactly these tags (none clears them).

```bash
noust db tag set [OPTIONS] NAME [TAGS]...
```

Arguments: `name`, `tags`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The engine the database is on (postgresql, ...). |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db tls

Give a host engine a certificate clients can verify, and keep it current.

```bash
noust db tls [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`disable`](#noust-db-tls-disable), [`enable`](#noust-db-tls-enable), [`refresh`](#noust-db-tls-refresh), [`status`](#noust-db-tls-status)

## noust db tls disable

Take the certificate off the engine: its settings go back as they were.

```bash
noust db tls disable [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The engine. |  |
| `--yes`, `-y` | Do not ask before restarting the engine. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db tls enable

Give the engine the certificate of HOST, and prove it presents it.

```bash
noust db tls enable [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The engine. |  |
| `--host` | The name clients reach the engine by. |  |
| `--source` | acme: the Let's Encrypt lineage named after the host. lineage: another lineage. custom: a certificate you uploaded (noust cert upload). | `acme` |
| `--certificate` | The lineage's or the upload's name, for lineage and custom. |  |
| `--plan` | Check the certificate and say what would be done. |  |
| `--yes`, `-y` | Do not ask before restarting the engine. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db tls refresh

Bring each engine's copy up to its certificate, load it, and prove what is presented.

```bash
noust db tls refresh [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db tls status

Show which engines serve a certificate of Noust's, and whether it is current.

```bash
noust db tls status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db transfer

Move DATABASE from one server of the fleet to another.

```bash
noust db transfer [OPTIONS] DATABASE
```

Arguments: `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | The engine it is on at the source: postgresql, mysql (MariaDB too) or mongodb, or an instance such as postgresql@pg16. | `postgresql` |
| `--from` | The server that holds the database. |  |
| `--to` | The server that receives it. |  |
| `--to-engine` | The engine or instance on the target, when it is not the source's own. |  |
| `--as` | Its name on the target; the same by default. |  |
| `--replace` | Replace a database of that name the target holds, after a safety copy of it taken there. |  |
| `--accounts` | Also make the accounts with access to it, with the password the source holds for each and the profile they had. The passwords pass through this machine and are kept nowhere. |  |
| `--drop-source` | Drop it from the source once it has moved, after a last dump kept there. Refused while an application uses it. |  |
| `--plan` | Only show what would happen. |  |
| `-y`, `--yes` | Do not ask first. |  |
| `--json` | Print the plan, then the job's result, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db uninstall

Remove a database engine from this server.

```bash
noust db uninstall [OPTIONS] ENGINE
```

Arguments: `engine`

| Option | What it does | Default |
|---|---|---|
| `--purge` | Also delete the data and the configuration. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db unlink

Take a database away from an application.

```bash
noust db unlink [OPTIONS] DOMAIN DATABASE
```

Arguments: `domain`, `database`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the database is on. |  |
| `--drop` | Also drop the database, after a last dump. |  |
| `--no-restart` | Remove the variables without restarting. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db user-create

Create a database user, optionally with a profile on one database.

```bash
noust db user-create [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine to create the user on. |  |
| `--password`, `-p` | Password. One is generated and shown when omitted. |  |
| `--database`, `-d` | Database to give the new user access to. |  |
| `--profile` | Access profile on that database. |  |
| `--host` | Host the user may connect from. | `localhost` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db user-delete

Delete a database user.

```bash
noust db user-delete [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the user is on. |  |
| `--host` | Host the user was created for. | `localhost` |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db user-list

List the users of an engine.

```bash
noust db user-list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine to list the users of. |  |
| `--json` | Print the user list as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust db user-password

Give a user a new password, and the applications that use it too.

```bash
noust db user-password [OPTIONS] USERNAME
```

Arguments: `username`

| Option | What it does | Default |
|---|---|---|
| `--engine`, `-e` | Engine the user is on. |  |
| `--host` | Host the user connects from. | `localhost` |
| `--no-propagate` | Do not give the new password to the applications that sign in as the user. |  |
| `--first-password` | Give a Redis instance that has no password its first one; every client connecting without one gets NOAUTH. |  |
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |