# noust fleet

Enroll this server in a fleet, or see the fleet from its central.

```bash
noust fleet [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`access`](#noust-fleet-access), [`activity`](#noust-fleet-activity), [`apps`](#noust-fleet-apps), [`authorize`](#noust-fleet-authorize), [`backups`](#noust-fleet-backups), [`builder`](#noust-fleet-builder), [`certs`](#noust-fleet-certs), [`cloud`](#noust-fleet-cloud), [`deauthorize`](#noust-fleet-deauthorize), [`enroll`](#noust-fleet-enroll), [`jobs`](#noust-fleet-jobs), [`link`](#noust-fleet-link), [`logs`](#noust-fleet-logs), [`metrics`](#noust-fleet-metrics), [`placement`](#noust-fleet-placement), [`retry`](#noust-fleet-retry), [`run`](#noust-fleet-run), [`status`](#noust-fleet-status), [`unlink`](#noust-fleet-unlink), [`updates`](#noust-fleet-updates)

## noust fleet access

Show or set the most any central may do on this server.

```bash
noust fleet access [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--level` | The most any central may do here: read, deploy (operate and update applications) or admin. |  |
| `--host-access` | Whether centrals may reach the host itself: SSH keys, sshd, firewall, accounts, and root-equivalent changes (raw units, cron commands, backup hooks, raw site configuration); only counts with admin. |  |
| `--json` | Print the ceiling as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet activity

What happened lately on every node, newest first.

```bash
noust fleet activity [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--node` | Only this node (repeat for more). |  |
| `--limit` | Events per node. | `20` |
| `--json` | Print the view as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet apps

Every application of every node, with its state, type and last deployment.

```bash
noust fleet apps [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--node` | Only this node (repeat for more). |  |
| `--status` | Only applications in this state. |  |
| `--json` | Print the view as JSON: every node's outcome and every application. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet authorize

Let a central manage this server, and print the join code for it.

```bash
noust fleet authorize [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--central-key` | The central's public key line for this server, as 'noust node key' printed it. |  |
| `--name` | The central's name. |  |
| `--ssh-user` | Account the central's tunnel logs in as. The default is created and restricted in sshd; root needs --i-understand. | `noust-tunnel` |
| `--i-understand` | Confirm --ssh-user root: a key in root's authorized_keys can create Unix sockets as root, however it is restricted. |  |
| `--replace-root-key` | A central's old public key to take out of root's authorized_keys once the new line is in place, whatever its comment (a 0600 copy of the file is kept). 'noust node migrate-tunnel' prints it for a node a 3.0 central authorized as root. |  |
| `--access` | The most any central may do on this server: read, deploy (operate and update applications) or admin. Unchanged when omitted (admin on a server that never set it). |  |
| `--allow-host-access`, `--no-host-access` | Let centrals reach the host itself: change how this server is reached (SSH keys, sshd, firewall, accounts) and make root-equivalent changes (raw units, cron commands, backup hooks, raw site configuration), on top of --access admin. Off unless set. |  |
| `--allow-self` | Authorize even though this server looks like the central that issued the key (testing only). |  |
| `-y`, `--yes` | Replace an older token and move a background console to a service without asking. |  |
| `--json` | Print the result, join code included, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet backups

Every application's newest backup, the gaps first: none, old, unverified, unscheduled.

```bash
noust fleet backups [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--node` | Only this node (repeat for more). |  |
| `--json` | Print the view as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet builder

The server that builds an application for the others.

```bash
noust fleet builder [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`clear`](#noust-fleet-builder-clear), [`list`](#noust-fleet-builder-list), [`set`](#noust-fleet-builder-set), [`show`](#noust-fleet-builder-show)

## noust fleet builder clear

Go back to building DOMAIN where it runs. Touches no server.

```bash
noust fleet builder clear [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet builder list

List the applications that are built on a server other than the ones that run them.

```bash
noust fleet builder list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the builders as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet builder set

Choose NODE as the server that builds DOMAIN. Touches no server.

```bash
noust fleet builder set [OPTIONS] DOMAIN NODE
```

Arguments: `domain`, `node`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the builder as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet builder show

Say which server builds DOMAIN.

```bash
noust fleet builder show [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the builder as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet certs

Every certificate of every node, the soonest to expire first.

```bash
noust fleet certs [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--node` | Only this node (repeat for more). |  |
| `--expiring` | Only certificates expiring within DAYS. |  |
| `--json` | Print the view as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud

Create servers at a cloud provider and bring them into the fleet.

```bash
noust fleet cloud [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`account`](#noust-fleet-cloud-account), [`catalog`](#noust-fleet-cloud-catalog), [`providers`](#noust-fleet-cloud-providers), [`script`](#noust-fleet-cloud-script), [`server`](#noust-fleet-cloud-server)

## noust fleet cloud account

The provider accounts this central creates servers with.

```bash
noust fleet cloud account [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-fleet-cloud-account-add), [`list`](#noust-fleet-cloud-account-list), [`remove`](#noust-fleet-cloud-account-remove), [`token`](#noust-fleet-cloud-account-token), [`verify`](#noust-fleet-cloud-account-verify)

## noust fleet cloud account add

Keep a provider API token as NAME.

```bash
noust fleet cloud account add [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--provider` | hetzner, digitalocean or vultr. |  |
| `--token-stdin` | Read the token from one line of standard input. |  |
| `--note` | A note, such as which project the token belongs to. |  |
| `--no-verify` | Do not ask the provider whether it accepts the token. |  |
| `--json` | Print the account as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud account list

List the accounts. A token is never shown, only its last characters.

```bash
noust fleet cloud account list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the accounts as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud account remove

Forget an account and its token.

```bash
noust fleet cloud account remove [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--force` | Remove it although servers made with it are on record. |  |
| `--yes`, `-y` | Do not ask. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud account token

Replace the token of an account, after the provider accepted the new one.

```bash
noust fleet cloud account token [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--token-stdin` | Read the token from one line of standard input. |  |
| `--no-verify` | Do not ask the provider whether it accepts the token. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud account verify

Ask the provider whether it still accepts the token of NAME.

```bash
noust fleet cloud account verify [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud catalog

Show what ACCOUNT can create: locations, plans and images (with prices where known).

```bash
noust fleet cloud catalog [OPTIONS] ACCOUNT
```

Arguments: `account`

| Option | What it does | Default |
|---|---|---|
| `--only` | Show one list only. |  |
| `--json` | Print the catalog as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud providers

List the providers a server can be created at, and where each one's token is made.

```bash
noust fleet cloud providers [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the providers as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud script

The cloud-init library: scripts and fragments a new server can boot with.

```bash
noust fleet cloud script [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`delete`](#noust-fleet-cloud-script-delete), [`list`](#noust-fleet-cloud-script-list), [`preview`](#noust-fleet-cloud-script-preview), [`save`](#noust-fleet-cloud-script-save), [`show`](#noust-fleet-cloud-script-show)

## noust fleet cloud script delete

Delete one of your own library entries.

```bash
noust fleet cloud script delete [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Do not ask. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud script list

List the library: what ships with Noust, then your own.

```bash
noust fleet cloud script list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the library as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud script preview

Print the document a new server would boot with when given NAMES, its host key withheld.

```bash
noust fleet cloud script preview [OPTIONS] [NAMES]...
```

Arguments: `names`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud script save

Add a script or fragment to the library, or replace your own of the same name.

```bash
noust fleet cloud script save [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--kind` | A shell script, or a #cloud-config fragment. Guessed from the first line. |  |
| `--file` | Read it from this file (default: standard input). | `-` |
| `--description` | What it does, in a line. | `` |
| `--json` | Print the entry as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud script show

Print the text of a library entry.

```bash
noust fleet cloud script show [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud server

The machines this central created at a provider.

```bash
noust fleet cloud server [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`create`](#noust-fleet-cloud-server-create), [`delete`](#noust-fleet-cloud-server-delete), [`link`](#noust-fleet-cloud-server-link), [`list`](#noust-fleet-cloud-server-list), [`power-on`](#noust-fleet-cloud-server-power-on), [`show`](#noust-fleet-cloud-server-show), [`unlink`](#noust-fleet-cloud-server-unlink)

## noust fleet cloud server create

Create the server NAME at a provider, install Noust on it and join it to this central.

```bash
noust fleet cloud server create [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--account` | The cloud account to create it with. |  |
| `--location` | A location id from 'noust fleet cloud catalog'. |  |
| `--plan` | A plan id from the catalog. |  |
| `--image` | An image id from the catalog. |  |
| `--access` | The most this central may do on the server. | `admin` |
| `--allow-host-access`, `--no-host-access` | Also let this central reach the host itself. |  |
| `--ssh-key` | Id of one of the account's SSH keys to authorize for root too (repeat). |  |
| `--firewall` | Id of a firewall to attach (repeat where the provider allows). |  |
| `--network` | Id of a private network to attach (repeat where the provider allows). |  |
| `--ipv4`, `--no-ipv4` | A public IPv4 address. |  |
| `--ipv6`, `--no-ipv6` | A public IPv6 address. |  |
| `--backups` | Turn on the provider's backups (they cost extra). |  |
| `--script` | A library entry to boot with, in order (repeat). |  |
| `--delete-on-failure` | Delete the machine when it does not join the fleet. |  |
| `--yes`, `-y` | Do not ask: the machine costs money until it is deleted. |  |
| `--json` | Print the node as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud server delete

Delete the machine NAME at its provider: it is destroyed, and the charge for it stops.

```bash
noust fleet cloud server delete [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--remove-node` | Also remove the server from this central's fleet. |  |
| `--yes`, `-y` | Do not ask. The machine and its disk are destroyed. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud server link

Link the server NAME, already in the fleet, to its machine at a provider.

```bash
noust fleet cloud server link [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--account` | The cloud account the machine belongs to. |  |
| `--id` | The provider's id for the machine. |  |
| `--force` | Link even when the machine is not at the address the server is reached on. |  |
| `--json` | Print the machine as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud server list

List the machines this central created.

```bash
noust fleet cloud server list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the machines as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud server power-on

Start a machine that is off.

```bash
noust fleet cloud server power-on [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud server show

Describe a machine this central created.

```bash
noust fleet cloud server show [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--live` | Ask the provider for the machine's state too. |  |
| `--json` | Print the machine as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet cloud server unlink

Forget which machine NAME runs on. The machine and the server are not touched.

```bash
noust fleet cloud server unlink [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet deauthorize

Stop trusting a central: remove its SSH key lines and revoke its tokens.

```bash
noust fleet deauthorize [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--name` | The central's name. |  |
| `--ssh-user` | Only this account's key file. By default every file Noust writes: the tunnel account's and root's. |  |
| `--json` | Print what was removed as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet enroll

Enroll the server at --host as NAME: install Noust if needed, authorize this central, join it.

```bash
noust fleet enroll [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--host` | The server's address or name. |  |
| `--port` | Where its sshd listens. | `22` |
| `--ssh-user` | The account the credential is for: root, or an account with passwordless sudo. | `root` |
| `--key-file` | A private key to log in with instead of a password. It is read, used once and forgotten. |  |
| `--ask-passphrase` | The key has a passphrase: ask for it, without echo. |  |
| `--password-stdin` | Read the password from one line of standard input instead of asking for it. |  |
| `--host-key-fingerprint` | The server's ed25519 host key fingerprint, confirmed some other way (the provider's console, ssh-keygen -lf on the server). Without it the fingerprint is shown and asked. |  |
| `--access` | The most this central may do on the server. | `admin` |
| `--allow-host-access`, `--no-host-access` | Also let this central reach the host itself there (SSH keys, sshd, the firewall). |  |
| `--no-install` | Do not install Noust on the server: fail when it is not there. |  |
| `--replace-token` | The server may already trust a token of this central: revoke it and issue a new one. |  |
| `--json` | Print the registered node as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet jobs

List the fleet jobs, or show one with every node's state and words.

```bash
noust fleet jobs [OPTIONS] [JOB_ID]
```

Arguments: `job_id`

| Option | What it does | Default |
|---|---|---|
| `--limit` | How many jobs. | `20` |
| `--json` | Print the jobs, or the job, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet link

Dial a central that cannot reach this server, and print the link code for it.

```bash
noust fleet link [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--name` | The central's name. |  |
| `--as` | The name this server goes by on the central. Default: its host name. |  |
| `--host` | The address to dial to reach the central. |  |
| `--ssh-port` | The central's SSH port. | `22` |
| `--host-key` | The central's SSH host key line, as its invitation printed it. It is pinned. |  |
| `--remote-port` | The loopback port the link listens on at the central. |  |
| `--invite` | The invitation's nonce. |  |
| `--access` | The most any central may do on this server: read, deploy or admin. Unchanged when omitted (admin on a server that never set it). |  |
| `--allow-host-access`, `--no-host-access` | Let centrals reach the host itself (SSH keys, sshd, firewall); off unless set. |  |
| `-y`, `--yes` | Replace an older token and move a background console to a service without asking. |  |
| `--json` | Print the result, link code included, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet logs

Search the logs of every node at once, newest first.

```bash
noust fleet logs [OPTIONS] [WORDS]...
```

Arguments: `words`

| Option | What it does | Default |
|---|---|---|
| `--node` | Only this node (repeat for more). |  |
| `--since` | Start: 15m, 2h, 7d ago or a date (1h). |  |
| `--until` | End, in the same forms (now). |  |
| `--level` | The worst level kept: err, warning, info... |  |
| `--limit` | Lines per node. | `100` |
| `--json` | Print the view as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet metrics

Compare one metric of every node over the same window.

```bash
noust fleet metrics [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--node` | Only this node (repeat for more). |  |
| `--metric` | What to compare. | `cpu` |
| `--window` | How far back. | `24h` |
| `--json` | Print the view as JSON, with every point. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet placement

An application that runs on several servers: where, how it looks, rolling it out.

```bash
noust fleet placement [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add`](#noust-fleet-placement-add), [`copy`](#noust-fleet-placement-copy), [`list`](#noust-fleet-placement-list), [`remove`](#noust-fleet-placement-remove), [`rollout`](#noust-fleet-placement-rollout), [`ship`](#noust-fleet-placement-ship), [`status`](#noust-fleet-placement-status), [`upstreams`](#noust-fleet-placement-upstreams)

## noust fleet placement add

Record where DOMAIN runs, or change it; what you do not give is kept.

```bash
noust fleet placement add [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--nodes` | Comma-separated servers it runs on. |  |
| `--label` | Every server carrying this label runs it too (repeat: all must match). |  |
| `--serial` | Servers an update goes to at a time: 2 or 25%. |  |
| `--max-failures` | Failures that stop an update. |  |
| `--canary` | The server that goes first and alone. |  |
| `--rollback`, `--no-rollback` | Put the servers already moved back when an update stops (the default). |  |
| `--json` | Print the placement as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet placement copy

Put DOMAIN on the servers that lack it, from one that has it.

```bash
noust fleet placement copy [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--from` | The server to copy it from. |  |
| `--to` | Comma-separated servers to copy it to. |  |
| `--new-domain` | Make the copy under another domain. |  |
| `--no-secrets` | Leave the secret values out; the servers will ask for them. |  |
| `--no-match-commit` | Keep the commit the import builds (the branch head). |  |
| `--plan` | Only show what would happen. |  |
| `-y`, `--yes` | Do not ask first. |  |
| `--json` | Print the plan, then the job's result, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet placement list

List the applications that run on several servers (the central's own record).

```bash
noust fleet placement list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the placements as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet placement remove

Forget where DOMAIN runs. Nothing is touched on any server.

```bash
noust fleet placement remove [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `-y`, `--yes` | Do not ask. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet placement rollout

Roll DOMAIN out over its servers so that they all run the same commit.

```bash
noust fleet placement rollout [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--commit` | Deploy exactly this commit on every server. |  |
| `--tag` | Deploy the commit this tag points at. |  |
| `--image-tag` | For an application that runs a registry image: the tag every server pulls (build it once, push it, roll it out). |  |
| `--force` | Rebuild even a server already on it. |  |
| `--build-on-each` | Build on every server even though DOMAIN has a build server (noust fleet builder). |  |
| `--canary` | The server that goes first and alone. |  |
| `--rollback`, `--no-rollback` | Put the servers already moved back if it stops (the placement's own by default). |  |
| `--serial` | Servers at a time: 2 or 25%. |  |
| `--max-failures` | Failures that stop it; -1 never stops. |  |
| `--plan` | Only show what would happen. |  |
| `-y`, `--yes` | Do not ask first. |  |
| `--json` | Print the plan, then the job's result, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet placement ship

Build DOMAIN on one server and run that build on the others.

```bash
noust fleet placement ship [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--builder` | The server that builds it (the one recorded with 'noust fleet builder set' by default). |  |
| `--to` | Comma-separated servers to run it on (every member of the placement by default). |  |
| `--commit` | Build exactly this commit instead of the branch head. |  |
| `--keep` | Keep the release the build made on the builder. |  |
| `--schema-changed-ok` | Take a release older than a deployment that changed the database's schema. |  |
| `--during-freeze` | Switch although deploys are frozen. |  |
| `--force` | Send it even to a server already on its commit. |  |
| `--canary` | The server that goes first and alone. |  |
| `--rollback`, `--no-rollback` | Put the servers already moved back if it stops (the placement's own by default). |  |
| `--serial` | Servers at a time: 2 or 25%. |  |
| `--max-failures` | Failures that stop it; -1 never stops. |  |
| `--plan` | Only show what would happen. |  |
| `-y`, `--yes` | Do not ask first. |  |
| `--json` | Print the plan, then the job's result, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet placement status

Show DOMAIN across its servers: which commit each serves, and who differs.

```bash
noust fleet placement status [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the placement and its status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet placement upstreams

Write the servers DOMAIN runs on for the load balancer in front of them.

```bash
noust fleet placement upstreams [OPTIONS] DOMAIN
```

Arguments: `domain`

| Option | What it does | Default |
|---|---|---|
| `--format` | nginx: an upstream block. list: address:port per serving server. json: everything. | `nginx` |
| `--port` |  | `443` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet retry

Run a fleet job again on its nodes that failed or were not reached.

```bash
noust fleet retry [OPTIONS] JOB_ID
```

Arguments: `job_id`

| Option | What it does | Default |
|---|---|---|
| `--plan` | Only show what would happen. |  |
| `-y`, `--yes` | Do not ask before running. |  |
| `--json` | Print the plan, then the job's result, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet run

Run ACTION on several nodes: renew certificates, back up, update, restart, update Noust or the OS.

```bash
noust fleet run [OPTIONS] {certs_renew|backups_run|backups_verify|apps_
                       update|apps_restart|noust_update|index_refresh|os_updat
                       es|placement_rollout|placement_copy}
```

Arguments: `action`

| Option | What it does | Default |
|---|---|---|
| `--nodes` | Comma-separated nodes. | `` |
| `--label` | Nodes carrying KEY=VALUE (repeat: all must match). |  |
| `--serial` | Nodes at a time: a number or a percentage (25%). |  |
| `--max-failures` | Failures tolerated before the rest are skipped; -1 never stops. |  |
| `--canary` | A node that goes alone first; if it fails, nothing else runs. |  |
| `--domains` | Only these applications (comma-separated), for app and backup actions. |  |
| `--target-version` | For noust_update: update to this Noust version. A server already on it or newer is skipped, one whose package source does not offer it yet is skipped with the reason, and each server that is updated must end up on it. |  |
| `--option` | An action option, KEY=VALUE (force=true, scope=all). |  |
| `--plan` | Only show what would happen. |  |
| `-y`, `--yes` | Do not ask before running. |  |
| `--json` | Print the plan, then the job's result, as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet status

Show every node this central manages: reachability, version, apps, units, certificates.

```bash
noust fleet status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print every node's summary as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet unlink

Stop dialling a central: stop the link, remove its key and unit, revoke its tokens.

```bash
noust fleet unlink [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--name` | The central's name. |  |
| `--json` | Print what was removed as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust fleet updates

Every node's Noust (installed and available) and pending system updates.

```bash
noust fleet updates [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--node` | Only this node (repeat for more). |  |
| `--json` | Print the view as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |