Pages in Reference

noust db

Install engines, and manage databases, users, backups and application links.

Reference Updated 29 October 2026 View as Markdown

Shell

noust db [OPTIONS] COMMAND [ARGS]...

Subcommands: access, adopt, backup, backup-delete, backup-push, backup-remote, backup-run, backup-schedule, backup-verify, backups, catalog, choices, config, connect, connect-info, connection-string, create, describe, drop, engines, explain, export, exposure, extension, fix-owner, forget, globals, grant, history, import, import-all, info, install, instance, key, keys, limits, link, links, list, metrics, move, pitr, provision, public, query, replica, restart, restore, restore-remote, revoke, row, rows, saved, settings, slow-queries, sqlite, start, status, stop, tables, tag, tls, transfer, uninstall, unlink, user-create, user-delete, user-list, user-password

noust db access

List who can reach a database, or give one account a profile on it.

Shell

noust db access [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--user`, `-u`	Account whose access to change.
`--profile`	The account's new profile.
`--host`	The account's host.	`localhost`
`--json`	Print the access list as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db adopt

Track the databases created outside Noust.

Shell

noust db adopt [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	Only this engine. Defaults to all of them.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db backup

Write a database to a backup file.

Shell

noust db backup [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--output`, `-o`	Where to write the file. Defaults to the engine's backup directory. A name ending in .gz is gzipped; any other is written as the engine dumps it.
`--no-compress`	Write the dump without gzip.
`--format`	PostgreSQL's dump format. custom (pg_dump -Fc) by default.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db backup-delete

Delete a dump from this server, or its copy from a destination.

Shell

noust db backup-delete [OPTIONS] FILE

Arguments: file

Option	What it does	Default
`--engine`, `-e`	Engine the dump is of.
`--from`	Delete the copy on this destination instead of the local file.
`--database`, `-d`	The database the dump is of; needed with --from.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db backup-push

Send a dump to a backup destination, after checking it.

Shell

noust db backup-push [OPTIONS] FILE

Arguments: file

Option	What it does	Default
`--engine`, `-e`	Engine the dump is of.
`--to`	A backup destination.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db backup-remote

List what a backup destination holds: the databases, or one database's dumps.

Shell

noust db backup-remote [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	Engine to list dumps of.
`--from`	A backup destination.
`--database`, `-d`	List this database's dumps instead of the databases.
`--json`	Print the listing as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db backup-run

Run a database's backup policy now: dump, check, send, prune.

Shell

noust db backup-run [OPTIONS] [DATABASE]

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--all`	Run the policy that covers every database.
`--json`	Print what the run did as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db backup-schedule

Set, show or remove a database's backup policy (schedule, retention, destinations).

Shell

noust db backup-schedule [OPTIONS] COMMAND [ARGS]...

Subcommands: remove, set, show

noust db backup-schedule remove

Remove a database's backup policy and its timer. Its dumps stay.

Shell

noust db backup-schedule remove [OPTIONS] [DATABASE]

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--all`	The policy that covers every database.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db backup-schedule set

Create or replace a database's backup policy, and its timer.

Shell

noust db backup-schedule set [OPTIONS] [DATABASE]

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--all`	One policy for every database of the engine, those created later too.
`--exclude-database`	With --all, a database to skip. Repeatable.
`--exclude-schema`	PostgreSQL schema to leave out of every dump. Repeatable.
`--exclude-table`	Table (PostgreSQL, MySQL, MariaDB) or collection (MongoDB) to leave out. Repeatable.
`--schedule`	hourly, daily, weekly, monthly or a systemd OnCalendar expression.	`daily`
`--keep`	Scheduled dumps to keep here, or 'none'. Dumps taken by hand are never deleted.	`7`
`--keep-days`	Days to keep a scheduled dump here, or 'none'.	`30`
`--keep-gb`	The most the scheduled backups kept here may weigh together, in gigabytes, or 'none'. The newest always stays, whatever its size.	`none`
`--to`	Send each dump to this backup destination, keeping COUNT, DAYS and GB there. Repeatable.
`--format`	PostgreSQL's dump format. custom (pg_dump -Fc) by default.
`--verify-restore`	Load each dump into a temporary database, and drop it, as proof it restores.
`--remote-only`	Keep no copy on this server: a scheduled dump is deleted once every --to destination holds it (for a small disk). A dump that could not be sent everywhere stays.
`--disable`	Keep the settings but install no timer.
`--max-runtime`	Stop a run that takes longer than this: 90m, 2h, 1d or a number of seconds (1 minute to 7 days). No limit by default.
`--timezone`	Read the schedule in this time zone, such as Europe/Madrid (timedatectl list-timezones lists them). The server's clock by default.
`--json`	Print the policy as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db backup-schedule show

Show one database's backup policy, or every policy.

Shell

noust db backup-schedule show [OPTIONS] [DATABASE]

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--all`	The policy that covers every database.
`--json`	Print the policies as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db backup-verify

Check a dump: size, digest and the engine's own reading of it.

Shell

noust db backup-verify [OPTIONS] FILE

Arguments: file

Option	What it does	Default
`--engine`, `-e`	Engine the dump is of.
`--restore-test`	Also load it into a temporary database, dropped afterwards.
`--json`	Print the dump and its evidence as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db backups

List the database backups on this server.

Shell

noust db backups [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	Only this engine. Defaults to all of them.
`--database`, `-d`	Only backups of this database.
`--json`	Print the backup list as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db catalog

Show which engines and versions can be installed on this server.

Shell

noust db catalog [OPTIONS]

Option	What it does	Default
`--json`	Print the catalog as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db choices

List the engines and versions a database can be created on, and how.

Shell

noust db choices [OPTIONS]

Option	What it does	Default
`--json`	Print the choices as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db config

Store the account Noust signs in to an engine with, after trying it.

Shell

noust db config [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	Engine the credentials are for.
`--user`, `-u`	Administrative user, such as root.
`--password`, `-p`	Administrative password. Alone, it is asked for without echo, so it never reaches the shell history or the process list.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db connect

Open a session with the engine's own client.

Shell

noust db connect [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	Engine to connect to.
`--database`, `-d`	Database to open.
`--username`, `-u`	User to connect as.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db connect-info

Show the SSH tunnel to reach a database from your computer.

Shell

noust db connect-info [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--username`, `-u`	Account to connect as.
`--server`	This server's address as you reach it. Detected by default.
`--ssh-user`	Account to sign in to the server as. root by default.
`--json`	Print everything as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db connection-string

Print a connection string for an application to use.

Shell

noust db connection-string [OPTIONS] DATABASE USERNAME

Arguments: database, username

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--password`, `-p`	Password. A placeholder is printed when omitted.
`--host`	Host the application uses.	`localhost`
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db create

Create a database and record it in the store.

Shell

noust db create [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--engine`, `-e`	Engine to create it on.
`--owner`, `-o`	User that will own the database.
`--encoding`	Character encoding. Defaults to UTF8.
`--app`	Application it belongs to, so its backups include it.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db describe

Show a table's columns, primary key, indexes and constraints.

Shell

noust db describe [OPTIONS] DATABASE TABLE

Arguments: database, table

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--schema`	Schema. Defaults to public, or the database on MySQL.
`--json`	Print the structure as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db drop

Delete a database and everything in it, after a last dump.

Shell

noust db drop [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--no-backup`	Do not take a last dump before dropping.
`--unlink`	Also remove its variables from the applications using it.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db engines

List the engines Noust can manage, and their versions.

Shell

noust db engines [OPTIONS]

Option	What it does	Default
`--json`	Print the engine list as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db explain

Show how the engine would run a statement.

Shell

noust db explain [OPTIONS] DATABASE QUERY

Arguments: database, query

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--analyze`	Run the statement to time it, as the superuser, inside a transaction rolled back.
`--timeout`	Seconds.	`30`
`--json`	Print the plan as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db export

Print a read's whole result as CSV or JSON, to redirect into a file.

Shell

noust db export [OPTIONS] DATABASE QUERY

Arguments: database, query

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--format`		`csv`
`--max-rows`		`50000`
`--timeout`	Seconds.	`30`
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db exposure

List database ports open beyond this machine; exits 1 when there is one.

Shell

noust db exposure [OPTIONS]

Option	What it does	Default
`--json`	Print the open ports as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db extension

Load and unload the PostgreSQL extensions of a database.

Shell

noust db extension [OPTIONS] COMMAND [ARGS]...

Subcommands: add, list, remove

noust db extension add

Load an extension into a database (CREATE EXTENSION).

Shell

noust db extension add [OPTIONS] DATABASE NAME

Arguments: database, name

Option	What it does	Default
`--engine`, `-e`	The PostgreSQL it is on.
`--cascade`	Also load the extensions it needs (CREATE EXTENSION ... CASCADE).
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the extension as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db extension list

List the extensions of a database: the loaded ones, or with --all everything the server offers.

Shell

noust db extension list [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--engine`, `-e`	The PostgreSQL it is on.
`--all`	Also the extensions that are not loaded.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the extensions as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db extension remove

Unload an extension from a database (DROP EXTENSION).

Shell

noust db extension remove [OPTIONS] DATABASE NAME

Arguments: database, name

Option	What it does	Default
`--engine`, `-e`	The PostgreSQL it is on.
`--cascade`	Also drop what depends on it. Without it PostgreSQL refuses.
`--yes`, `-y`	Do not ask before unloading it.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the extension as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db fix-owner

Give a PostgreSQL database, and its objects, to its application's role.

Shell

noust db fix-owner [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--owner`	Role that must own it. Defaults to the one Noust provisioned.
`--apply`	Make the change; only show it without.
`--force`, `-f`, `-y`	Do not ask before applying.
`--json`	Print the plan as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db forget

Forget a tracked database that no longer exists on its engine.

Shell

noust db forget [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--engine`, `-e`	Engine the database was on.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db globals

The roles of a PostgreSQL server, which no database dump carries.

Shell

noust db globals [OPTIONS] COMMAND [ARGS]...

Subcommands: dump, list, restore

noust db globals dump

Dump the roles of the server with pg_dumpall --globals-only.

Shell

noust db globals dump [OPTIONS]

Option	What it does	Default
`--output`, `-o`	Write the file here instead of the backup directory.
`--json`	Print the result as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db globals list

List the files of roles this server has dumped, newest first.

Shell

noust db globals list [OPTIONS]

Option	What it does	Default
`--json`	Print the files as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db globals restore

Create the roles of a file that this server does not have.

Shell

noust db globals restore [OPTIONS] SOURCE

Arguments: source

Option	What it does	Default
`--yes`, `-y`	Do not ask for confirmation.
`--json`	Print the result as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db grant

Grant a user privileges on a database.

Shell

noust db grant [OPTIONS] USERNAME DATABASE

Arguments: username, database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--privileges`	Comma-separated privileges. Defaults to the engine's full set.
`--host`	Host the grant applies to.	`localhost`
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db history

List the statements you ran in the console, newest first.

Shell

noust db history [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	Only this engine's.
`--database`, `-d`	Only this database's.
`--limit`		`20`
`--clear`	Forget them instead of listing them.
`--json`	Print the history as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db import

Import a dump into DATABASE, creating it when it does not exist.

Shell

noust db import [OPTIONS] DATABASE FILE

Arguments: database, file

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--replace`	Drop the database and load the dump into a fresh one. A safety copy is taken first and put back if the import fails.
`--keep-owners`	PostgreSQL: keep the owners and privileges the dump names. By default they are left out, because they are the roles of the server it came from, and everything belongs to the database's owner.
`--no-safety-copy`	Do not dump the database first when nothing is dropped.
`--owner`	PostgreSQL: the account a database this import makes belongs to (it must exist), instead of the default. A database that is loaded over keeps its owner.
`--as-superuser`	PostgreSQL: load the dump as the server's superuser. By default it is loaded as the database's owner, so what a dump asks beyond that (COPY ... FROM PROGRAM, extensions that need a superuser) is refused. Use it only for a dump you made or have read. Audited.
`--inspect`	Say what the file is and whether the engine can load it, and stop.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--json`	Print what the import did as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db import-all

Import a dump of every database of an engine, and its accounts when asked.

Shell

noust db import-all [OPTIONS] FILE

Arguments: file

Option	What it does	Default
`--engine`, `-e`	Engine to import into.
`--users`	Also create the accounts of the dump (PostgreSQL: its roles, with the password hash it holds). Without superuser, role-creating, replication or row-security-bypassing power, and never over an account that exists. The databases then keep the owners and privileges the dump names for those accounts.
`--accounts-file`	MySQL and MariaDB: a file of CREATE USER and GRANT statements, one per line (SHOW CREATE USER and SHOW GRANTS print them, so does pt-show-grants); mysqldump does not write the accounts. Used with --users.
`--database`, `-d`	Load only this database (repeat for several). The server's own ones (postgres) are loaded only when named.
`--replace`	Drop each database that exists and load the dump into a fresh one. A safety copy is taken first and put back if its load fails.
`--no-safety-copy`	Do not dump a database first when it is loaded over rather than replaced.
`--as-superuser`	Load every database as the server's superuser instead of as its owner. By default a database is loaded as its owner, so what a dump asks beyond that (COPY ... FROM PROGRAM, extensions that need a superuser) is refused. Use it only for a file you made or have read. Audited.
`--plan`	Say what would be created, loaded over, replaced or left out, and stop.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--json`	Print the plan or what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db info

Show a database's size, owner, application, support and access.

Shell

noust db info [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--json`	Print the database's details as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db install

Install a database engine: postgresql, mysql, mariadb, redis, valkey or mongodb.

Shell

noust db install [OPTIONS] ENGINE

Arguments: engine

Option	What it does	Default
`--version`	Version to install (see 'noust db catalog'); the distribution's by default.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance

Run another version of an engine, or an engine the host lacks, in a container.

Shell

noust db instance [OPTIONS] COMMAND [ARGS]...

Subcommands: catalog, create, health, launch, limits, list, migrate, migrations, remove, renew-tls, rollback, show, start, stop, tls, tls-ca, upgrade

noust db instance catalog

List the engines Noust can run as an instance, and the versions it offers.

Shell

noust db instance catalog [OPTIONS]

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the catalog as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance create

Make an instance NAME and start it.

Shell

noust db instance create [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--engine`, `-e`	What to run: a flavour of the catalog.
`--version`	Its version, such as 16 or 8.4 ('noust db instance catalog'). The default one when omitted.
`--memory`	Its memory limit, such as 512m or 2g. Mandatory: the container is held to it and the engine sizes its caches to it.
`--port`	The port on 127.0.0.1. A free one just above the engine's own when omitted.
`--variant`	An image of the engine with something added, such as pgvector or postgis for PostgreSQL ('noust db instance catalog'). The engine's own image when omitted.
`--init-script`	A .sql file the engine runs, in name order, the first time it starts (PostgreSQL, MySQL and MariaDB; repeatable). It is not run again, and it is readable by the container: no secrets.
`--image`	An image of your own instead of the catalog's: repository[:tag]@sha256:DIGEST. The digest is mandatory (a tag can be moved after you looked; 'docker buildx imagetools inspect REPO:TAG' prints it) and --version says which version it is. Noust has not tested it.
`--args`	Arguments added after the ones Noust passes the engine, such as '-c max_connections=200'. Split like a shell would and never run by one. Not with --command. No secrets: a command line is visible to every local user.
`--command`	The container's whole command, instead of the engine's: Noust adds nothing to it (the memory share, TLS), so it is refused for an instance that serves TLS. Not with --args.
`--accept-untested`	Accept that Noust has not tested an image, a command or arguments you chose. Needed with --yes or --json for them; --yes alone answers the question, not this.
`--yes`, `-y`	Do not ask before making it.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the instance as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance health

Show or change how an instance is asked whether it is well.

Shell

noust db instance health [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--interval`	Seconds between probes. 'default' is 10.
`--timeout`	Seconds a probe may take. 'default' is 5.
`--retries`	Failed probes in a row before the engine is unhealthy. 'default' is 12.
`--plan`	Only say what it would do.
`--yes`, `-y`	Do not ask before restarting it.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the settings, the plan or what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance launch

Show or change what an instance's container is started with.

Shell

noust db instance launch [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--args`	Arguments added after the ones Noust passes the engine, such as '-c work_mem=8MB'. Split like a shell would and never run by one; no secrets.
`--command`	The container's whole command, instead of the engine's. Noust adds nothing to it.
`--reset`	Take both back to what Noust passes the engine.
`--plan`	Only say what it would do.
`--accept-untested`	Accept that Noust has not tested your words.
`--yes`, `-y`	Do not ask before restarting it.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the command, the plan or what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance limits

Show or change what an instance may use: memory, CPUs and swap.

Shell

noust db instance limits [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--memory`	Its memory limit, such as 2g. The engine's caches follow.
`--cpus`	How many CPUs it may use, such as 1.5. 'none' lifts the limit.
`--swap`	Swap it may use on top of its memory: 0 for none, or 512m. 'default' leaves Docker's.
`--plan`	Only say what it would do.
`--yes`, `-y`	Do not ask before restarting it.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the settings, the plan or what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance list

List the instances Noust runs, and how much of the server's memory they hold.

Shell

noust db instance list [OPTIONS]

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the instances and the memory they hold as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance migrate

Move an engine's databases to a new instance of a newer major version.

Shell

noust db instance migrate [OPTIONS] SOURCE

Arguments: source

Option	What it does	Default
`--to-version`	The version to go to, such as 17 ('noust db instance catalog'). Newer than the one it leaves.
`--name`	What to call the new instance. The engine and its version when omitted.
`--memory`	Its memory limit, such as 1g. The old instance's, or the engine's suggestion, when omitted.
`--port`	The port on 127.0.0.1. A free one when omitted.
`--plan`	Only say what it would do.
`--yes`, `-y`	Do not ask before moving.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the plan or what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance migrations

List the moves to a newer version, newest first, and which can be rolled back.

Shell

noust db instance migrations [OPTIONS]

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the moves as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance remove

Remove an instance, its container, its volumes and its data.

Shell

noust db instance remove [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--yes`, `-y`	Accept that its data is deleted, without asking.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print what was removed as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance renew-tls

Sign an instance's certificate again and restart it on the new one.

Shell

noust db instance renew-tls [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--yes`, `-y`	Do not ask before restarting it.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the new status as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance rollback

Point the applications back at the engine a move left.

Shell

noust db instance rollback [OPTIONS] MIGRATION

Arguments: migration

Option	What it does	Default
`--yes`, `-y`	Do not ask before going back.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance show

Show one instance: its image, its port, its memory, where its files are.

Shell

noust db instance show [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the instance as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance start

Start an instance and wait until its engine answers.

Shell

noust db instance start [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the instance as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance stop

Stop an instance. Its data stays; the applications that use it lose their database.

Shell

noust db instance stop [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the instance as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance tls

Show or change how an instance serves TLS.

Shell

noust db instance tls [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--mode`	off, optional (TLS when the client asks) or required (nothing else gets in). Only shows how it serves TLS when omitted.
`--plan`	Only say what it would do.
`--yes`, `-y`	Do not ask before restarting it.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the status, the plan or what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance tls-ca

Show Noust's certificate authority, the one applications trust.

Shell

noust db instance tls-ca [OPTIONS]

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the authority's certificate as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db instance upgrade

Move an instance to the newest image of its version.

Shell

noust db instance upgrade [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--no-backup`	Do not dump every database first. Only when its data does not matter.
`--image`	For an instance on an image of your own: the next one, repository[:tag]@sha256:DIGEST. Noust never looks for a newer image of one you pinned.
`--accept-untested`	Accept that Noust has not tested the image you name. Needed with --json.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print what changed as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db key

Show a bounded preview of one Redis key.

Shell

noust db key [OPTIONS] SLOT KEY

Arguments: slot, key

Option	What it does	Default
`--engine`, `-e`		`redis`
`--hex`	KEY is the key's bytes in hexadecimal.
`--json`	Print the preview as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db keys

Scan a Redis database's keys, with their type, TTL and memory.

Shell

noust db keys [OPTIONS] [SLOT]

Arguments: slot

Option	What it does	Default
`--engine`, `-e`		`redis`
`--match`	Glob pattern, such as 'session:*'.
`--cursor`	Continue a scan.	`0`
`--count`		`100`
`--type`
`--json`	Print the keys as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db limits

Show the limits of an engine on this host, or set them.

Shell

noust db limits [OPTIONS] ENGINE

Arguments: engine

Option	What it does	Default
`--memory`	Memory the engine may use: 4096, 512m or 4g. The kernel kills it above.
`--cpus`	Processors it may use: 0.5, 2 or 3.5.
`--swap`	Swap it may use besides its memory, in megabytes; 0 gives it none.
`--tasks`	Processes and threads it may have (256 or more).
`--remove`	Take a limit away; repeat it for several.
`--yes`, `-y`	Accept a memory limit below what the engine uses now.
`--json`	Print the limits or the outcome as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db link

Give an application a database's connection string, and restart it.

Shell

noust db link [OPTIONS] DOMAIN DATABASE

Arguments: domain, database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--user`, `-u`	Account to sign in as. Noust must know it.
`--env-var`	Variable to write. DATABASE_URL, or REDIS_URL for Redis.
`--extra-vars`	Also write DB_HOST, DB_PORT, DB_NAME, ...
`--tls`	Make the application encrypt the connection and, with verify-ca or verify-full, check the engine's certificate against Noust's authority. Needs an engine that serves TLS (noust db instance tls).
`--no-restart`	Write the variables without restarting.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db links

List the databases an application uses.

Shell

noust db links [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--json`	Print the list as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db list

List the databases on every running engine.

Shell

noust db list [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	Only this engine. Defaults to all of them.
`--open`	Print the panel URL for the database list, opening it if a display is available.
`--tag`	Only the databases that carry this tag.
`--team`	Only this team's.
`--project`	Only what lives in the projects with this name.
`--env`	Only what lives in the environments with this name.
`--json`	Print the database list as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db metrics

Show an engine's, or one database's, size, connections and cache hits.

Shell

noust db metrics [OPTIONS] ENGINE [DATABASE]

Arguments: engine, database

Option	What it does	Default
`--json`	Print the metrics as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db move

Move DATABASE to another engine: another version, the host's or an instance.

Shell

noust db move [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--from`	The engine it is on, such as postgresql@pg16.
`--to`	The engine it goes to.
`--replace`	Replace a database of that name the target already holds, after a safety copy.
`--drop-source`	Drop it from the engine it leaves, after a last dump. It stays otherwise.
`--plan`	Only say what it would do.
`--yes`, `-y`	Do not ask before moving.
`--json`	Print the plan or what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db pitr

Recover PostgreSQL to an instant: the log archived, base backups, and the recovery.

Shell

noust db pitr [OPTIONS] COMMAND [ARGS]...

Subcommands: base, disable, enable, fetch, restore, run, status, sync

noust db pitr base

Take a base backup now, and apply retention.

Shell

noust db pitr base [OPTIONS]

Option	What it does	Default
`--json`	Print the base backup as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db pitr disable

Stop archiving the log. The archive and the base backups stay unless --delete-archive.

Shell

noust db pitr disable [OPTIONS]

Option	What it does	Default
`--delete-archive`	Also delete the archived log, the base backups and what the destinations hold of them.
`--yes`, `-y`	Do not ask before restarting PostgreSQL.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db pitr enable

Start archiving the write-ahead log, prove it works and take the first base backup.

Shell

noust db pitr enable [OPTIONS]

Option	What it does	Default
`--every`	Take a base backup when the last is this many hours old.	`168`
`--keep`	Base backups to keep, or 'none' for no limit by number.	`none`
`--keep-days`	How many days back a recovery must be possible, or 'none'. With both limits, the one that keeps more wins.	`7`
`--to`	Send the log and the base backups to this backup destination. Repeatable.
`--plan`	Say what it would do and change nothing.
`--yes`, `-y`	Do not ask before restarting PostgreSQL.
`--json`	Print the result as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db pitr fetch

Bring the base backups and the log back from DESTINATION, for a recovery.

Shell

noust db pitr fetch [OPTIONS] DESTINATION

Arguments: destination

Option	What it does	Default
`--json`	Print what was downloaded as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db pitr restore

Recover the whole cluster to an instant.

Shell

noust db pitr restore [OPTIONS]

Option	What it does	Default
`--time`	Recover to this instant, such as '2026-10-17 12:34:56' (UTC unless it carries an offset).
`--latest`	Recover to the end of the archived log.
`--base`	Start from this base backup (see: status).
`--plan`	Say what it would do and change nothing.
`--yes`, `-y`	Do not ask before replacing the cluster.
`--json`	Print the plan or the result as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db pitr run

Do the upkeep: a base backup when one is due, retention, and sending the archive.

Shell

noust db pitr run [OPTIONS]

Option	What it does	Default
`--json`	Print what the run did as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db pitr status

Show whether the log is archived, the base backups, and the window a recovery can reach.

Shell

noust db pitr status [OPTIONS]

Option	What it does	Default
`--json`	Print the status as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db pitr sync

Send the log and the base backups to the destinations, and prune them there.

Shell

noust db pitr sync [OPTIONS]

Option	What it does	Default
`--json`	Print what was sent as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db provision

Create a database and an account for an application, and link them.

Shell

noust db provision [OPTIONS] DOMAIN

Arguments: domain

Option	What it does	Default
`--engine`, `-e`	Engine to create it on.
`--name`	Database name. Derived from the application by default.
`--env-var`	Variable to write. DATABASE_URL, or REDIS_URL for Redis.
`--extra-vars`	Also write DB_HOST, DB_PORT, DB_NAME, ...
`--no-restart`	Write the variables without restarting.
`--version`	The version of the engine the database is for, such as 17 or 11.4 ('noust db choices' lists them). The installed one when omitted.
`--install`	Install the engine, in --version, first when it is not installed: the same as 'noust db install'.
`--instance`	Make it on this instance Noust runs ('noust db instance list') instead of the host's engine. One is also chosen by itself when --version is what an instance runs and the host does not.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db public

Make a database reachable from the network on purpose, and private again.

Shell

noust db public [OPTIONS] COMMAND [ARGS]...

Subcommands: close, list, open, show

noust db public close

Make DATABASE private again: remove the port, the account, the TLS line and the firewall rule.

Shell

noust db public close [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--yes`, `-y`	Do not ask for confirmation.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print what was removed as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db public list

List the databases that are reachable from the network.

Shell

noust db public list [OPTIONS]

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the databases as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db public open

Make DATABASE reachable from the network: a public port, an account of its own, the firewall.

Shell

noust db public open [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--port`	The public port. A free one near the engine's is chosen.
`--bind`	Address to listen on: 0.0.0.0 (every IPv4 address, the default), :: or one address.
`--from`	Let only this address or network (CIDR) in; repeat for several. Anyone when omitted.
`--allow-plaintext`	Do not require TLS. The password and the data then cross the network in clear.
`--access`	What the account made for it may do on this database.	`owner`
`--yes`, `-y`	Accept every warning without asking.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the outcome (with the password, once) as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db public show

Show how DATABASE is reachable, and whether it listens now.

Shell

noust db public show [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--reveal`	Print the account's password too, in the connection details.
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the exposure (and, with --reveal, the connection) as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db query

Run one statement against a database, read-only unless told otherwise.

Shell

noust db query [OPTIONS] DATABASE QUERY

Arguments: database, query

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--write`	Allow the statement to change data. Without it the engine runs one statement as the database's read-only account.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db replica

Run read replicas of this server's PostgreSQL, over TLS, with an account of their own.

Shell

noust db replica [OPTIONS] COMMAND [ARGS]...

Subcommands: join, prepare, promote, remove, status, token

noust db replica join

Make this server a replica of the primary CODE names.

Shell

noust db replica join [OPTIONS] [CODE]

Arguments: code

Option	What it does	Default
`--token-file`	Read the join code from this file.
`--replace-data`	Accept that this server's PostgreSQL data is replaced by the primary's.
`--discard-previous`	Delete this server's old data directory once the replica streams (it is kept otherwise).
`--plan`	Check everything and say what would be done.
`--json`	Print the result as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db replica prepare

Make room for a replica called NAME on this server, and print its join code.

Shell

noust db replica prepare [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--engine`, `-e`	The engine: postgresql, or mysql for MySQL and MariaDB.	`postgresql`
`--from`	Where the replica connects from: its address or network (203.0.113.7, 10.0.0.0/24).
`--host`	The name the replica connects to. PostgreSQL's certificate must cover it.
`--listen`	Make PostgreSQL listen here too (an address of this server, or '*'). Needed when it listens on the loopback only; restarts it once.
`--ca-file`	The authority that signed PostgreSQL's certificate, when the replica does not trust it already (a private authority).
`--open-firewall`	Allow the port from the replica's address.
`--token-file`	Write the join code to this file (0600) instead of printing it.
`--plan`	Check everything and say what would be done.
`--yes`, `-y`	Do not ask before restarting PostgreSQL.
`--json`	Print the result as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db replica promote

Stop following the primary: this server becomes a primary and accepts writes.

Shell

noust db replica promote [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	The engine: postgresql, or mysql for MySQL and MariaDB.	`postgresql`
`--yes`, `-y`	Do not ask.
`--json`	Print the result as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db replica remove

Take a replica away: its account, its slot and its pg_hba.conf line go.

Shell

noust db replica remove [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--engine`, `-e`	The engine: postgresql, or mysql for MySQL and MariaDB.	`postgresql`
`--restore-listen`	Put the address the engine listens on back as it was before the replica was prepared (restarts the engine; for MySQL and MariaDB it takes Noust's settings file off).
`--yes`, `-y`	Do not ask.
`--json`	Print the result as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db replica status

Show the replicas prepared here, or the primary this server follows.

Shell

noust db replica status [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	Only this engine's. Without it, every engine installed.
`--json`	Print the status as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db replica token

Print the join code of a replica prepared here again.

Shell

noust db replica token [OPTIONS] NAME

Arguments: name

Option	What it does	Default
`--engine`, `-e`	The engine: postgresql, or mysql for MySQL and MariaDB.	`postgresql`
`--token-file`	Write the join code to this file (0600) instead of printing it.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db restart

Restart an engine's service.

Shell

noust db restart [OPTIONS] ENGINE

Arguments: engine

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db restore

Load a backup into a database, never losing what it held.

Shell

noust db restore [OPTIONS] DATABASE FILE

Arguments: database, file

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--drop`	Drop the database before restoring it. A safety copy is taken first and put back if the restore fails.
`--as-new`	Restore into a new database of this name instead.
`--no-safety-copy`	Do not dump the database first when nothing is dropped.
`--as-superuser`	PostgreSQL: load a file Noust did not write as the server's superuser instead of the database's owner. A dump can run programs on this server (COPY ... FROM PROGRAM) with that account: use it only for a dump you made or have read, when the error says the owner may not do what it asks. Audited.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db restore-remote

Download a dump from a destination, verify it and restore it.

Shell

noust db restore-remote [OPTIONS] DATABASE FILE

Arguments: database, file

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--from`	The backup destination it is on.
`--as-new`	Restore into a new database of this name instead.
`--drop`	Drop the database before restoring it. A safety copy is taken first and put back if the restore fails.
`--no-safety-copy`	Do not dump the database first when nothing is dropped.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db revoke

Take privileges away from a user.

Shell

noust db revoke [OPTIONS] USERNAME DATABASE

Arguments: username, database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--privileges`	Comma-separated privileges. Defaults to the engine's full set.
`--host`	Host the grant applies to.	`localhost`
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db row

Insert, change or delete one row, found by its whole primary key.

Shell

noust db row [OPTIONS] COMMAND [ARGS]...

Subcommands: delete, insert, update

noust db row delete

Delete one row; nothing changes unless exactly that row exists.

Shell

noust db row delete [OPTIONS] DATABASE TABLE

Arguments: database, table

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--schema`	Schema. Defaults to public, or the database on MySQL.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--key`	column=value of the primary key.
`--json`	Print the change as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db row insert

Insert one row; columns left out take their defaults.

Shell

noust db row insert [OPTIONS] DATABASE TABLE

Arguments: database, table

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--schema`	Schema. Defaults to public, or the database on MySQL.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--set`	column=value, or column:=; repeatable.
`--json`	Print the change as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db row update

Change one row; nothing changes unless exactly that row exists.

Shell

noust db row update [OPTIONS] DATABASE TABLE

Arguments: database, table

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--schema`	Schema. Defaults to public, or the database on MySQL.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--key`	column=value of the primary key.
`--set`	column=value, or column:=.
`--json`	Print the change as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db rows

Read a page of a table's rows, as the database's read-only account.

Shell

noust db rows [OPTIONS] DATABASE TABLE

Arguments: database, table

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--schema`	Schema. Defaults to public, or the database on MySQL.
`--limit`		`100`
`--offset`	Rows to skip (sorted by other columns).	`0`
`--cursor`	Continue after a previous page (next cursor).
`--order`	column or column:desc; repeatable.
`--filter`	column:op:value (eq neq lt lte gt gte like ilike in null notnull).
`--count`	Also count every matching row.
`--timeout`	Seconds.	`30`
`--json`	Print the page as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db saved

Keep statements under a name.

Shell

noust db saved [OPTIONS] COMMAND [ARGS]...

Subcommands: add, list, remove

noust db saved add

Save a statement under a name.

Shell

noust db saved add [OPTIONS] NAME QUERY

Arguments: name, query

Option	What it does	Default
`--engine`, `-e`	Engine it is for.
`--database`, `-d`	Database it is for; any when omitted.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db saved list

List your saved queries.

Shell

noust db saved list [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	Only this engine's.
`--database`, `-d`	Only those for this database or for any.
`--json`	Print them as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db saved remove

Delete one of your saved queries.

Shell

noust db saved remove [OPTIONS] SAVED_ID

Arguments: saved_id

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db settings

Show an engine's settings, or change them with KEY=VALUE.

Shell

noust db settings [OPTIONS] ENGINE [KEY=VALUE]...

Arguments: engine, assignments

Option	What it does	Default
`--yes`, `-y`	Accept what the change costs: listening beyond this server, a Redis that refuses writes or drops keys, persistence turned off.
`--json`	Print the settings or the outcome as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db slow-queries

List the statements that take longest on average, or how to turn that on.

Shell

noust db slow-queries [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--limit`		`20`
`--json`	Print them as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db sqlite

The SQLite databases an application keeps: list, check and copy them.

Shell

noust db sqlite [OPTIONS] COMMAND [ARGS]...

Subcommands: check, copy, list

noust db sqlite check

Ask SQLite whether a database is sound. Changes nothing.

Shell

noust db sqlite check [OPTIONS] DOMAIN PATH

Arguments: domain, path

Option	What it does	Default
`--full`	Run integrity_check, which also checks every index against its table; slower.
`--budget`	Seconds after which a check stops where it is and says so.	`30.0`
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the result as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db sqlite copy

Copy a database, consistently, while the application runs.

Shell

noust db sqlite copy [OPTIONS] DOMAIN PATH

Arguments: domain, path

Option	What it does	Default
`--output`, `-o`	The file to write. It must not exist; it is created private (0600).
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the copy as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db sqlite list

List the SQLite databases applications keep, in their data directories.

Shell

noust db sqlite list [OPTIONS] [DOMAIN]

Arguments: domain

Option	What it does	Default
`-v`, `--verbose`	Show the detail of each step.
`--dry-run`	Rehearse without changing anything. Read-only checks still run.
`--no-color`	Never emit colour.
`--json`	Print the databases as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db start

Start an engine's service.

Shell

noust db start [OPTIONS] ENGINE

Arguments: engine

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db status

Show which engines are installed and running, and their upstream support.

Shell

noust db status [OPTIONS] [ENGINE]

Arguments: engine

Option	What it does	Default
`--json`	Print the statuses as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db stop

Stop an engine's service.

Shell

noust db stop [OPTIONS] ENGINE

Arguments: engine

Option	What it does	Default
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db tables

List a database's tables and views, with estimated rows and sizes.

Shell

noust db tables [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--schema`	Only this schema's.
`--search`	Only names containing this.
`--kind`
`--json`	Print the tables as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db tag

Free labels on databases, to find them by.

Shell

noust db tag [OPTIONS] COMMAND [ARGS]...

Subcommands: add, list, remove, set

noust db tag add

Give a database more tags.

Shell

noust db tag add [OPTIONS] NAME TAGS...

Arguments: name, tags

Option	What it does	Default
`--engine`, `-e`	The engine the database is on (postgresql, ...).
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

List the tags of a database, or every tagged one.

Shell

noust db tag list [OPTIONS] [NAME]

Arguments: name

Option	What it does	Default
`--tag`	Only the databases with this tag.
`--engine`, `-e`	The engine the database is on (postgresql, ...).
`--json`	Print the tags as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db tag remove

Take tags off a database.

Shell

noust db tag remove [OPTIONS] NAME TAGS...

Arguments: name, tags

Option	What it does	Default
`--engine`, `-e`	The engine the database is on (postgresql, ...).
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db tag set

Make a database carry exactly these tags (none clears them).

Shell

noust db tag set [OPTIONS] NAME [TAGS]...

Arguments: name, tags

Option	What it does	Default
`--engine`, `-e`	The engine the database is on (postgresql, ...).
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db tls

Give a host engine a certificate clients can verify, and keep it current.

Shell

noust db tls [OPTIONS] COMMAND [ARGS]...

Subcommands: disable, enable, refresh, status

noust db tls disable

Take the certificate off the engine: its settings go back as they were.

Shell

noust db tls disable [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	The engine.
`--yes`, `-y`	Do not ask before restarting the engine.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db tls enable

Give the engine the certificate of HOST, and prove it presents it.

Shell

noust db tls enable [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	The engine.
`--host`	The name clients reach the engine by.
`--source`	acme: the Let's Encrypt lineage named after the host. lineage: another lineage. custom: a certificate you uploaded (noust cert upload).	`acme`
`--certificate`	The lineage's or the upload's name, for lineage and custom.
`--plan`	Check the certificate and say what would be done.
`--yes`, `-y`	Do not ask before restarting the engine.
`--json`	Print the result as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db tls refresh

Bring each engine's copy up to its certificate, load it, and prove what is presented.

Shell

noust db tls refresh [OPTIONS]

Option	What it does	Default
`--json`	Print what was done as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db tls status

Show which engines serve a certificate of Noust's, and whether it is current.

Shell

noust db tls status [OPTIONS]

Option	What it does	Default
`--json`	Print the status as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db transfer

Move DATABASE from one server of the fleet to another.

Shell

noust db transfer [OPTIONS] DATABASE

Arguments: database

Option	What it does	Default
`--engine`, `-e`	The engine it is on at the source: postgresql, mysql (MariaDB too) or mongodb, or an instance such as postgresql@pg16.	`postgresql`
`--from`	The server that holds the database.
`--to`	The server that receives it.
`--to-engine`	The engine or instance on the target, when it is not the source's own.
`--as`	Its name on the target; the same by default.
`--replace`	Replace a database of that name the target holds, after a safety copy of it taken there.
`--accounts`	Also make the accounts with access to it, with the password the source holds for each and the profile they had. The passwords pass through this machine and are kept nowhere.
`--drop-source`	Drop it from the source once it has moved, after a last dump kept there. Refused while an application uses it.
`--plan`	Only show what would happen.
`-y`, `--yes`	Do not ask first.
`--json`	Print the plan, then the job's result, as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db uninstall

Remove a database engine from this server.

Shell

noust db uninstall [OPTIONS] ENGINE

Arguments: engine

Option	What it does	Default
`--purge`	Also delete the data and the configuration.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db unlink

Take a database away from an application.

Shell

noust db unlink [OPTIONS] DOMAIN DATABASE

Arguments: domain, database

Option	What it does	Default
`--engine`, `-e`	Engine the database is on.
`--drop`	Also drop the database, after a last dump.
`--no-restart`	Remove the variables without restarting.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db user-create

Create a database user, optionally with a profile on one database.

Shell

noust db user-create [OPTIONS] USERNAME

Arguments: username

Option	What it does	Default
`--engine`, `-e`	Engine to create the user on.
`--password`, `-p`	Password. One is generated and shown when omitted.
`--database`, `-d`	Database to give the new user access to.
`--profile`	Access profile on that database.
`--host`	Host the user may connect from.	`localhost`
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db user-delete

Delete a database user.

Shell

noust db user-delete [OPTIONS] USERNAME

Arguments: username

Option	What it does	Default
`--engine`, `-e`	Engine the user is on.
`--host`	Host the user was created for.	`localhost`
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db user-list

List the users of an engine.

Shell

noust db user-list [OPTIONS]

Option	What it does	Default
`--engine`, `-e`	Engine to list the users of.
`--json`	Print the user list as JSON.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

noust db user-password

Give a user a new password, and the applications that use it too.

Shell

noust db user-password [OPTIONS] USERNAME

Arguments: username

Option	What it does	Default
`--engine`, `-e`	Engine the user is on.
`--host`	Host the user connects from.	`localhost`
`--no-propagate`	Do not give the new password to the applications that sign in as the user.
`--first-password`	Give a Redis instance that has no password its first one; every client connecting without one gets NOAUTH.
`--force`, `-f`, `-y`	Do not ask for confirmation.
`--reason`	Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on.

Something on this page is wrong or unclear? Report it on GitHub.

Help, contributing and the project’s policies are under Project.