# noust server

Manage this server: updates, reboots, disks, swap, the clock and the journal.

```bash
noust server [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`cleanup`](#noust-server-cleanup), [`cleanup-schedule`](#noust-server-cleanup-schedule), [`hostname`](#noust-server-hostname), [`logs`](#noust-server-logs), [`migrate`](#noust-server-migrate), [`processes`](#noust-server-processes), [`reboot`](#noust-server-reboot), [`security`](#noust-server-security), [`shutdown`](#noust-server-shutdown), [`status`](#noust-server-status), [`storage`](#noust-server-storage), [`swap`](#noust-server-swap), [`time`](#noust-server-time), [`updates`](#noust-server-updates)

## noust server cleanup

Free disk space with one of a closed list of actions.

```bash
noust server cleanup [OPTIONS] {journal|pkg-cache|docker-build-
                            cache|docker-dangling-images|docker-
                            image|releases}
```

Arguments: `action`

| Option | What it does | Default |
|---|---|---|
| `--size-mb` | journal: vacuum to this size. |  |
| `--days` | journal: keep this many days. |  |
| `--target` | docker-image: the image id. |  |
| `--plan` | Say what it would do and change nothing. |  |
| `-y`, `--yes` | Do not ask. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server cleanup-schedule

Clean the disk by itself: when, how full it must be, what is run, and what ran.

```bash
noust server cleanup-schedule [OPTIONS] [COMMAND] [ARGS]...
```

Subcommands: [`history`](#noust-server-cleanup-schedule-history), [`run`](#noust-server-cleanup-schedule-run), [`set`](#noust-server-cleanup-schedule-set), [`show`](#noust-server-cleanup-schedule-show)

## noust server cleanup-schedule history

List the cleanups that ran, the newest first: scheduled ones and by hand.

```bash
noust server cleanup-schedule history [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--limit` | How many runs. | `20` |
| `--json` | Print the runs as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server cleanup-schedule run

Run the cleanup policy now (the timer's own command is --scheduled).

```bash
noust server cleanup-schedule run [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--scheduled` | Run as the timer does: only when the disk is as full as the policy asks. |  |
| `--json` | Print the run as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server cleanup-schedule set

Change the cleanup policy; what is not given stays as it was.

```bash
noust server cleanup-schedule set [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--enable`, `--disable` | Switch the timer on or off. |  |
| `--schedule` | daily, weekly, monthly, hourly or a systemd calendar. |  |
| `--threshold` | Run only when the fullest disk is this percent full (0: always). |  |
| `--action` | What to run, in order (repeat). Default: journal, pkg-cache, releases. |  |
| `--journal-mb` | Vacuum the journal to this size. |  |
| `--allow-docker`, `--no-docker` | Accept that the Docker actions delete build cache and images with no name. |  |
| `--json` | Print the policy as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server cleanup-schedule show

Show the cleanup policy and its timer.

```bash
noust server cleanup-schedule show [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the policy as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server hostname

Show the host name, or rename the machine to NAME.

```bash
noust server hostname [OPTIONS] [NAME]
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--keep-against-cloud-init` | Tell cloud-init not to rename it back. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the names as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server logs

Read the journal of any unit, with filters, a query, or the entries around one.

```bash
noust server logs [OPTIONS] [UNIT]
```

Arguments: `unit`

| Option | What it does | Default |
|---|---|---|
| `-n`, `--lines` |  | `100` |
| `-p`, `--priority` | err, warning... or 0 to 7: it and worse. |  |
| `--since` | 2026-09-29, '2026-09-29 10:30' or -30min, -2h, -7d. |  |
| `--until` |  |  |
| `-k`, `--kernel` | Only the kernel's messages. |  |
| `-b`, `--boot` | 0 this boot, -1 the previous. |  |
| `-g`, `--grep` | Only lines containing this, ignoring case. |  |
| `-f`, `--follow` | Keep printing new entries as they are written. |  |
| `-Q`, `--query` | Fields, AND, OR, - and "phrases": @unit:nginx error -timeout. See --help below. |  |
| `--scan` | With --query: how many of the newest entries of the range to examine. | `5000` |
| `--around` | Show the entries around the one with this cursor (from --json). |  |
| `--before` |  | `25` |
| `--after` |  | `25` |
| `--json` | Print the entries as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server migrate

Move this server's applications, data and state to another server.

```bash
noust server migrate [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`check`](#noust-server-migrate-check), [`plan`](#noust-server-migrate-plan), [`prepare`](#noust-server-migrate-prepare)

## noust server migrate check

Ask every application the questions to answer before pointing DNS at this server.

```bash
noust server migrate check [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the report as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server migrate plan

Say what moving this server would take and whether it can start. Changes nothing.

```bash
noust server migrate plan [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--to` | A backup destination both servers reach. |  |
| `--json` | Print the plan as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server migrate prepare

Copy everything now and send it to a destination, ready for 'noust restore-server'.

```bash
noust server migrate prepare [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--to` | A backup destination both servers reach. |  |
| `--app` | Move only this application's copies. Repeatable. |  |
| `--no-data` | Do not copy the applications' data. |  |
| `--stored-passphrase` | Seal the bundle under the passphrase 'noust self-backup schedule' keeps. |  |
| `--passphrase-file` | Read the passphrase from this file (mode 600), not from a prompt. |  |
| `--yes`, `-y` | Do not ask first. |  |
| `--json` | Print the report as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server processes

List the processes, or the units that use the machine. Observation only.

```bash
noust server processes [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--sort` |  | `cpu` |
| `--by-unit` | Add the processes up by the unit they belong to. |  |
| `-n`, `--limit` |  | `20` |
| `--json` | Print the processes as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server reboot

Reboot the server, now or later, after looking at what it would break.

```bash
noust server reboot [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--in` | In 5, 5m or 2h. |  |
| `--at` | At 04:00 (next one) or 2026-09-30T04:00. |  |
| `--now` | Right now, with no minute to change your mind. |  |
| `--cancel` | Cancel the scheduled reboot or shutdown. |  |
| `--status` | Show what is scheduled and the checks. |  |
| `--force` | Go ahead although a check warned. |  |
| `--message` | What to tell logged-in users. |  |
| `-y`, `--yes` | Do not ask. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--json` | Print the status as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security

Hardening checks, SSH, the firewall, fail2ban and accepted risks.

```bash
noust server security [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`accept`](#noust-server-security-accept), [`checks`](#noust-server-security-checks), [`confirm`](#noust-server-security-confirm), [`fail2ban`](#noust-server-security-fail2ban), [`firewall`](#noust-server-security-firewall), [`fix`](#noust-server-security-fix), [`pending`](#noust-server-security-pending), [`revert`](#noust-server-security-revert), [`risks`](#noust-server-security-risks), [`ssh`](#noust-server-security-ssh), [`status`](#noust-server-security-status), [`unaccept`](#noust-server-security-unaccept)

## noust server security accept

Accept a check's finding as a documented risk, until a date (a year at most).

```bash
noust server security accept [OPTIONS] CHECK_ID
```

Arguments: `check_id`

| Option | What it does | Default |
|---|---|---|
| `--why` | Why the risk is acceptable (10 to 500 characters); required under the ENS profile or with security.exception_reasons on. |  |
| `--until` | Until when: 2026-12-31. |  |
| `--days` | For this many days. |  |
| `--json` | Print the acceptance as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security checks

Run the hardening checks and print what needs attention.

```bash
noust server security checks [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--all` | Also list the checks that pass. |  |
| `--quick` | Skip the package manager and system checks (seconds faster). |  |
| `--json` | Print every check as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security confirm

Keep a pending change, once a new SSH login since it was applied is on record.

```bash
noust server security confirm [OPTIONS] [CHANGE_ID]
```

Arguments: `change_id`

| Option | What it does | Default |
|---|---|---|
| `--yes`, `-y` | Accepted like the other commands of the group take it; keeping a change asks nothing. |  |
| `--json` | Print the change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security fail2ban

fail2ban: its jails and bans, lifting a ban, installing it.

```bash
noust server security fail2ban [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`install`](#noust-server-security-fail2ban-install), [`status`](#noust-server-security-fail2ban-status), [`unban`](#noust-server-security-fail2ban-unban), [`web`](#noust-server-security-fail2ban-web)

## noust server security fail2ban install

Install fail2ban with an sshd jail that never bans the SSH sessions open now.

```bash
noust server security fail2ban install [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--epel` | Allow enabling EPEL, where fail2ban comes from on RHEL rebuilds. |  |
| `-y`, `--yes` | Do not ask. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security fail2ban status

Show whether fail2ban runs, its jails and the addresses banned now.

```bash
noust server security fail2ban status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print fail2ban's state as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security fail2ban unban

Lift the ban of an address.

```bash
noust server security fail2ban unban [OPTIONS] ADDRESS
```

Arguments: `address`

| Option | What it does | Default |
|---|---|---|
| `--jail` | Only this jail. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security fail2ban web

Make fail2ban watch nginx as well, or stop.

```bash
noust server security fail2ban web [OPTIONS] {on|off}
```

Arguments: `state`

| Option | What it does | Default |
|---|---|---|
| `-y`, `--yes` | Do not ask. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security firewall

The firewall against the ports that really answer, changed without locking you out.

```bash
noust server security firewall [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`allow`](#noust-server-security-firewall-allow), [`delete`](#noust-server-security-firewall-delete), [`deny`](#noust-server-security-firewall-deny), [`disable`](#noust-server-security-firewall-disable), [`enable`](#noust-server-security-firewall-enable), [`status`](#noust-server-security-firewall-status)

## noust server security firewall allow

Open a port, to everyone or to one address or network. Undone unless confirmed.

```bash
noust server security firewall allow [OPTIONS] PORT
```

Arguments: `port`

| Option | What it does | Default |
|---|---|---|
| `--proto` |  | `tcp` |
| `--from` | An address or network. | `any` |
| `--comment` | A note on the rule. | `` |
| `--json` | Print the pending change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security firewall delete

Delete a rule by the id 'firewall status' shows. Undone unless confirmed.

```bash
noust server security firewall delete [OPTIONS] RULE_ID
```

Arguments: `rule_id`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the pending change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security firewall deny

Close a port. Never SSH's or a public console's. Undone unless confirmed.

```bash
noust server security firewall deny [OPTIONS] PORT
```

Arguments: `port`

| Option | What it does | Default |
|---|---|---|
| `--proto` |  | `tcp` |
| `--from` | An address or network. | `any` |
| `--comment` | A note on the rule. | `` |
| `--json` | Print the pending change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security firewall disable

Turn the firewall off. It comes back on unless confirmed.

```bash
noust server security firewall disable [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-y`, `--yes` | Do not ask. |  |
| `--json` | Print the pending change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security firewall enable

Turn ufw on, denying incoming by default, SSH and a public console allowed first.

```bash
noust server security firewall enable [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-y`, `--yes` | Do not ask. |  |
| `--json` | Print the pending change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security firewall status

Show the firewall's rules and every port that answers, with the verdict for each.

```bash
noust server security firewall status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the firewall and the ports as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security fix

Apply a check's automatic fix, with its guard.

```bash
noust server security fix [OPTIONS] CHECK_ID
```

Arguments: `check_id`

| Option | What it does | Default |
|---|---|---|
| `--epel` | Allow enabling EPEL (fail2ban on RHEL rebuilds). |  |
| `-y`, `--yes` | Do not ask. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security pending

List the SSH and firewall changes, the ones waiting for confirmation first.

```bash
noust server security pending [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the changes as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security revert

Undo a pending SSH or firewall change now.

```bash
noust server security revert [OPTIONS] [CHANGE_ID]
```

Arguments: `change_id`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security risks

List accepted risks, withdrawn and expired ones included.

```bash
noust server security risks [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the acceptances as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security ssh

sshd's effective configuration, its fixes and the administrators' keys.

```bash
noust server security ssh [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`add-key`](#noust-server-security-ssh-add-key), [`harden`](#noust-server-security-ssh-harden), [`keys`](#noust-server-security-ssh-keys), [`plan`](#noust-server-security-ssh-plan), [`remove-key`](#noust-server-security-ssh-remove-key), [`status`](#noust-server-security-ssh-status)

## noust server security ssh add-key

Let a public key log in as root or an account that can become root.

```bash
noust server security ssh add-key [OPTIONS] [PUBLIC_KEY]
```

Arguments: `public_key`

| Option | What it does | Default |
|---|---|---|
| `--user` | The account. | `root` |
| `--file` | A .pub file. |  |
| `--json` | Print what was done as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security ssh harden

Apply an sshd fix safely: proof of another way in, sshd -t, reload, verify.

```bash
noust server security ssh harden [OPTIONS] {disable-passwords|no-empty-
                                        passwords|root-no|root-prohibit-
                                        password|sensible-defaults|verbose-
                                        logging}
```

Arguments: `fix`

| Option | What it does | Default |
|---|---|---|
| `-y`, `--yes` | Do not ask. |  |
| `--json` | Print the pending change as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security ssh keys

List root's and every administrator's keys, with when each was last used.

```bash
noust server security ssh keys [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the keys as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security ssh plan

Show what a fix would change (before and after) and whether its guard holds.

```bash
noust server security ssh plan [OPTIONS] {disable-passwords|no-empty-
                                      passwords|root-no|root-prohibit-
                                      password|sensible-defaults|verbose-
                                      logging}
```

Arguments: `fix`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the plan as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security ssh remove-key

Remove a key by its SHA256 fingerprint.

```bash
noust server security ssh remove-key [OPTIONS] FINGERPRINT
```

Arguments: `fingerprint`

| Option | What it does | Default |
|---|---|---|
| `--user` | The account. | `root` |
| `--force` | Remove it even when the guard refuses. |  |
| `-y`, `--yes` | Do not ask. |  |
| `--json` | Print what was removed as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security ssh status

Show sshd's effective values (sshd -T -C), Noust's drop-in and the open sessions.

```bash
noust server security ssh status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print sshd's state as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security status

Show the security summary: the quick checks' counts, what needs attention, pending changes.

```bash
noust server security status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the summary as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server security unaccept

Withdraw a check's acceptance, so its finding shows again.

```bash
noust server security unaccept [OPTIONS] CHECK_ID
```

Arguments: `check_id`

| Option | What it does | Default |
|---|---|---|
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server shutdown

Power the server off.

```bash
noust server shutdown [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--in` | In 5, 5m or 2h. |  |
| `--at` | At 04:00 (next one) or 2026-09-30T04:00. |  |
| `--now` | Right now. |  |
| `--force` | Go ahead although a check warned. |  |
| `--message` | What to tell logged-in users. |  |
| `-y`, `--yes` | Do not ask. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server status

Show how the server is, in one look.

```bash
noust server status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the summary as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server storage

Show the real filesystems and what takes their space.

```bash
noust server storage [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--analyze` | Also measure caches, releases, backups and logs (slow). |  |
| `--json` | Print the storage report as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server swap

Swap: what there is, making a swap file, removing it.

```bash
noust server swap [OPTIONS] [COMMAND] [ARGS]...
```

Subcommands: [`create`](#noust-server-swap-create), [`remove`](#noust-server-swap-remove), [`status`](#noust-server-swap-status), [`swappiness`](#noust-server-swap-swappiness)

## noust server swap create

Make /swapfile, switch it on, and keep it across reboots.

```bash
noust server swap create [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--size` | For example 2G or 2048M. |  |
| `--swappiness` | Default 10. |  |
| `-y`, `--yes` | Do not ask. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server swap remove

Switch off and delete the swap file Noust made.

```bash
noust server swap remove [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-y`, `--yes` | Do not ask. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server swap status

Show the swap of this machine.

```bash
noust server swap status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the state as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server swap swappiness

Set how eagerly the kernel swaps, now and at boot.

```bash
noust server swap swappiness [OPTIONS] VALUE
```

Arguments: `value`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server time

The clock: time zone and synchronisation.

```bash
noust server time [OPTIONS] [COMMAND] [ARGS]...
```

Subcommands: [`ntp`](#noust-server-time-ntp), [`status`](#noust-server-time-status), [`timezone`](#noust-server-time-timezone)

## noust server time ntp

Turn time synchronisation on or off.

```bash
noust server time ntp [OPTIONS] {on|off}
```

Arguments: `state`

| Option | What it does | Default |
|---|---|---|
| `--install` | Install chrony when there is no time daemon. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server time status

Show the time, the zone and whether the clock is synchronised.

```bash
noust server time status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the clock as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server time timezone

Change the time zone, and list the cron and backup timers that move.

```bash
noust server time timezone [OPTIONS] ZONE
```

Arguments: `zone`

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server updates

List, refresh and apply operating system updates.

```bash
noust server updates [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`apply`](#noust-server-updates-apply), [`auto`](#noust-server-updates-auto), [`history`](#noust-server-updates-history), [`list`](#noust-server-updates-list), [`refresh`](#noust-server-updates-refresh), [`repair`](#noust-server-updates-repair), [`restart-services`](#noust-server-updates-restart-services)

## noust server updates apply

Apply updates, in their own systemd unit, following them to the end.

```bash
noust server updates apply [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--security-only` | Only the updates marked as security. |  |
| `--full` | A full upgrade (full-upgrade, dist-upgrade): may remove packages. |  |
| `--allow-removals` | Accept the removals a full upgrade lists. |  |
| `--detach` | Start it and return; it keeps running on its own. |  |
| `-y`, `--yes` | Do not ask. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server updates auto

The distribution's own automatic updates.

```bash
noust server updates auto [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`disable`](#noust-server-updates-auto-disable), [`enable`](#noust-server-updates-auto-enable), [`status`](#noust-server-updates-auto-status)

## noust server updates auto disable

Turn automatic updates off.

```bash
noust server updates auto disable [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server updates auto enable

Turn automatic updates on (installing their package if needed). Never reboots.

```bash
noust server updates auto enable [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--all-updates` | Not only security updates. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server updates auto status

Show whether automatic updates are on, and how.

```bash
noust server updates auto status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the state as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server updates history

Show the updates that were run, or one of them with its last output.

```bash
noust server updates history [OPTIONS] [UPDATE_ID]
```

Arguments: `update_id`

| Option | What it does | Default |
|---|---|---|
| `-n`, `--limit` |  | `10` |
| `--json` | Print the runs as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server updates list

List the pending updates, security ones first.

```bash
noust server updates list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the pending updates as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server updates refresh

Download fresh package metadata, then count what is pending.

```bash
noust server updates refresh [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server updates repair

Finish an update that was interrupted (dpkg --configure -a).

```bash
noust server updates repair [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust server updates restart-services

Restart the services an update left running on replaced libraries.

```bash
noust server updates restart-services [OPTIONS] [UNITS]...
```

Arguments: `units`

| Option | What it does | Default |
|---|---|---|
| `-y`, `--yes` | Do not ask. |  |
| `-v`, `--verbose` | Show the detail of each step. |  |
| `--dry-run` | Rehearse without changing anything. Read-only checks still run. |  |
| `--no-color` | Never emit colour. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |