CLI

hoststack login --key <api-key> [--url <url>]

Check the key against the API, then save it and its team id to ~/.hoststack/config.json. --url points the CLI at another API base URL (default https://hoststack.dev).

hoststack whoami

Who the key acts as: the user, or for an API key its id and permission — plus the team name, slug, id and your role.

hoststack help

Every command group, with examples. Also --help and -h.

hoststack version

The installed CLI version. Also --version and -v.

hoststack projects list [--json]

Projects in the team, with their id, region and creation date. The default when you run hoststack projects alone (alias: ls).

hoststack projects create --name <name> [--description <desc>] [--region <region>]

Create a project and print its prj_… id.

hoststack projects delete <project-id>

Delete a project (alias: rm).

hoststack services list [--repo <url|owner/name>] [--branch <name>] [--auto-deploy|--no-auto-deploy] [--json]

Services across every project in the team. --repo accepts an SSH or HTTPS remote, a browser URL or owner/name, and matches repos on any connected Git provider. The default when you run hoststack services alone (alias: ls).

hoststack services get <service-id>

Name, id, type, status, internal URL and creation date — and the configured image when one is set (alias: info).

hoststack services create --name <name> --type <web_service | private_service | worker | cron_job | static_site> --project <project-id|prj_…> [--repo <owner/name> [--branch <branch>] [--root <dir>] [--publish-path <dir>]] [--image <ref> [--port <n>]] [--template <id>] [--runtime <runtime>] [--build <cmd>] [--start <cmd>] [--install <cmd>] [--machine <name|id>]

Create a service. --repo owner/name is resolved against your connected GitHub repos server-side. --template attaches the template’s volumes, generated secrets and companion database before the first deploy; a packaged app (WordPress, Ghost, n8n) also needs --image and --port. --machine pins it to one of your own machines, and placement cannot be changed afterwards.

hoststack services delete <service-id>

Delete a service (alias: rm).

hoststack services scale <service-id> <min[:max]>

2 pins the service at two instances; 2:5 autoscales between two and five.

hoststack services suspend <service-id>

Stop the service and keep its configuration and data.

hoststack services resume <service-id>

Start a suspended service again.

hoststack services update <service-id> [flags]

Change build and runtime settings. Build and repo fields (--branch, --auto-deploy, --root-directory, --install-command, --build-command, --start-command, --dockerfile-path, --pre-deploy-command) apply on the next deploy; "" clears a command. Health checks: --health-check/--no-health-check, --health-check-path ("" = TCP only), --health-check-interval 5–300, --health-check-timeout 1–60, --health-check-grace 1–1800. Resources apply without a redeploy: --memory-mb 128–16384, --cpu-shares 128–4096, --disk-size-gb 1–100, --port, --protocol http|tcp, --restart-policy always|on-failure|no, --deploy-strategy rolling|recreate, --instances (pins min and max), --min-instances, --max-instances, --scale-cpu-threshold and --scale-memory-threshold 10–100, --search-indexing/--no-search-indexing (alias: config).

hoststack services metrics <service-id> [--history] [--from <t>] [--to <t>] [--json]

CPU, memory against its limit, disk and network for the container, plus the latest sample from the host it runs on. --history gives a time series; omit --from/--to (ISO 8601) for the last hour. There is no swap in a container, so memory in the nineties is the state that ends in an OOM kill, not “nearly full”.

hoststack services templates [--json]

The template ids services create --template accepts. Packaged apps are listed with the image and port you must pass alongside the id.

hoststack services links <service-id> [--json]

The managed resources linked into this service today.

hoststack services link <service-id> --type <database|object_storage|queue|search|email_domain> --resource <numeric-id> --alias <PREFIX>

Link any managed resource — object storage, a queue, a search index, an email domain, a database. --resource is the numeric id, not a public id; --alias is the upper-case prefix of the injected variables. For a database, hoststack db link is shorter.

hoststack services unlink <service-id> <link-id>

Remove a link. The resource itself is untouched; its variables disappear on the next deploy.

hoststack deploy trigger <service-id> [--commit <hash>] [--branch <name>] [--clear-cache]

Start a deploy and print its dpl_… id. --clear-cache empties the build cache first (alias: create).

hoststack deploy list <service-id> [--json]

Recent deploys of a service (alias: ls).

hoststack deploy logs <service-id> <deploy-id> [--json]

The build log of one deploy.

hoststack deploy cancel <service-id> <deploy-id>

Cancel a deploy that is still in progress.

hoststack deploy rollback <service-id> <deploy-id>

Roll the service back to an earlier deploy.

hoststack deploy diagnose <service-id> <deploy-id> [--build-lines N] [--runtime-lines N] [--json]

The deploy record, the tail of its build log (200 lines by default) and the runtime log since it started (100 lines). The runtime half is skipped when the deploy never reached a container, because it would show the previous release’s output. --runtime-lines 0 skips it yourself.

hoststack deploy promote <service-id> <deploy-id> --to <env-id|env_…>

Run a deploy’s already-built image on the sibling service in another environment — no rebuild. Env vars, secret files, volumes, IP allowlists and custom domains are per environment and do not come with it.

hoststack logs <service-id> [--lines <n>] [--since <duration>]

Recent runtime output of a service: 100 lines from the last hour unless you say otherwise. --since takes 30m, 1h, 1d (alias: log).

hoststack env list <service-id> [--json]

Variables on a service. Secret values are masked (alias: ls).

hoststack env get <service-id> <KEY>

One variable. A secret value is masked.

hoststack env set <service-id> KEY=VALUE [--secret|--no-secret] [--target <t>]

Create or update one variable. Without --secret/--no-secret an existing variable keeps its classification and a new one is not secret.

hoststack env delete <service-id> <KEY|env-var-id>

Delete a variable by key or by numeric id (alias: rm).

hoststack env bulk <service-id> KEY1=VAL1 KEY2=VAL2 ... [--merge] [--secret] [--target <t>]

Replace every variable on the service with this set — anything not listed is deleted. With --merge (CLI 0.31+) it only adds and updates the listed keys and deletes nothing; an existing key keeps its secret/target setting unless you pass a flag. --secret and --target apply to every listed key.

hoststack env import <service-id> <file> [--apply] [--replace] [--target <t>] [--no-secret]

Import a .env file byte for byte. Without --apply it only prints what would be added, changed or removed, and it refuses — with the line number — any line that could be read two ways, such as an unquoted $ or #. Imported values are runtime secrets unless you pass --no-secret or --target; --replace also removes keys the file does not mention. Output names keys, never values.

hoststack environments list <project-id> [--json]

Environments in a project (alias: ls; the group is also environment and envs).

hoststack environments create <project-id> --name <name> --type <type> [--protected]

--type is production, staging, development or preview (alias: new).

hoststack environments delete <project-id> <env-id>

Delete an environment (alias: rm).

hoststack db list --project <project-id> [--json]

Databases in a project (alias: ls).

hoststack db get <database-id>

One database’s details (alias: info).

hoststack db create --project <project-id|prj_…> --name <name> --engine <postgres|redis|mysql|mariadb|mongodb> [--version <version>] [--plan <micro|starter|standard|pro>] [--machine <name|id>]

Provision a managed database. On your own machine (--machine) it is reachable only from that machine, so run the app that uses it there too.

hoststack db credentials <database-id>

Host, port, user, password, database name and the internal connection URL — and the external URL and allowlist when external access is on (alias: creds).

hoststack db connect <database-id>

Open psql, mysql, mongosh or redis-cli with the credentials filled in. The client must be installed on your machine.

hoststack db external <database-id> --enable [--allow <cidr> ...] | --disable

Expose the database on a public host and port, TLS required. Postgres only. Repeat --allow to restrict source addresses; without it any IP may connect over TLS.

hoststack db update <database-id> [--name <name>] [--plan <free|micro|starter|standard|pro>] [--disk <gb>]

Rename, change the plan, or grow the disk. The disk cannot shrink, so there is no undo for a size you overshoot (alias: edit).

hoststack db query <database-id> "<sql>" [--json]

Run one read-only statement against a Postgres database — a single SELECT, WITH, SHOW or EXPLAIN. Enforced server-side: a read-only transaction, a 30-second timeout, at most 1,000 rows, and every call audit-logged. A truncated result says so. Pass - as the SQL to read it from stdin (alias: sql).

hoststack db delete <database-id>

Deprovision a database (alias: rm).

hoststack db suspend <database-id>

Stop the container and keep the data.

hoststack db resume <database-id>

Start a suspended database again.

hoststack db restart <database-id>

Restart the container in place: same volume, same connection URL, every open connection dropped.

hoststack db link <database-id> --service <service-id> [--alias <PREFIX>]

Link the database to a service. The alias defaults to the database name in upper case.

hoststack db links --service <service-id>

The managed resources linked to a service.

hoststack db unlink --service <service-id> --link <link-id>

Remove a link. Its variables disappear on the next deploy.

hoststack db upgrade-version <database-id> --to <version>

In-place major upgrade — Postgres 15–18, Redis 6–8, newer versions only. The database is dumped, recreated at the new version under the same name and restored, so connection URLs keep working. It runs in the background: poll db get until the version matches.

hoststack db upgrade-to-ha <database-id>

Move a standalone Postgres to a three-node high-availability cluster. The team must have HA enabled.

hoststack db cluster <database-id> [--json]

An HA cluster’s members and failover history.

hoststack db backups <database-id> [--json]

The off-site archives you could restore from. A dump that only exists on the database’s own machine is not listed — it would be lost with the database.

hoststack volumes list <service-id> [--json]

Volumes attached to a service (alias: ls; the group is also disks).

hoststack volumes create <service-id> <name> <mount-path> [--size N (10-10240, default 10)]

Attach a new volume, 10–10240 GB, 10 GB by default (alias: add).

hoststack volumes resize <service-id> <volume-id> <size-gb>

Grow a volume. Volumes can only grow.

hoststack volumes delete <service-id> <volume-id>

Detach and delete a volume (alias: rm).

hoststack volumes backup <service-id> <volume-id> on|off

Turn nightly backups on or off. Turning them off keeps the archives you already have.

hoststack volumes backups <service-id> <volume-id> [--json]

The archives you can restore from. Backups being on is not the same as having one.

hoststack volumes restore <service-id> <volume-id> <backup-id> --yes

Replace the volume’s contents with an archive. There is no undo and no snapshot of the current state; without --yes it only shows what it would restore.

hoststack domains list [--json]

Custom domains in the team (alias: ls).

hoststack domains add <domain> --service <service-id|svc_…> [--path-prefix <prefix>]

Attach a domain to a service. Every custom domain points at a service (alias: create).

hoststack domains verify <hostname|dom_…|id>

Check the domain’s DNS now and report whether it is active — or, for a zone HostStack hosts, that the registry is not delegating it here.

hoststack domains update <hostname|dom_…|id> [--primary] [--ssl|--no-ssl] [--redirect <url>|--no-redirect] [--strip-trailing-slash|--keep-trailing-slash]

--primary makes this the service’s primary hostname: the one ${service.url} resolves to, the uptime check probes and the monitoring page shows. With no primary, all three use the oldest domain on the service. Promoting one demotes the other (alias: edit).

hoststack domains delete <hostname|dom_…|id>

Remove a custom domain (alias: rm).

hoststack dns zones [--json]

Hosted zones, and whether the registry actually delegates each one to HostStack (aliases: zone, ls).

hoststack dns check <zone|domain> [--json]

Read the registry’s nameservers for a zone, live. A zone can be active and full of correct records while the registry still points at the old host. Exits 1 when the zone is delegated elsewhere and 0 otherwise — including when the answer could not be determined — so it works as a cutover gate.

hoststack dns records <zone|domain> [--json]

Every record in a zone (alias: list).

hoststack dns add <zone|domain> <type> <name> <value> [--ttl N] [--priority N]

Create a record (alias: create).

hoststack dns update <record-id> <type> <name> <value> [--ttl N] [--priority N]

Replace a record — a full write, not a patch (alias: edit).

hoststack dns delete <record-id>

Delete a record (alias: rm).

hoststack dns resync <record-id>

Push a record stuck at status failed to the nameservers again.

hoststack dev new [--name <name>] [--github-id <n> | --repo <git-url>] [--branch <name>] [--db postgres,redis,meilisearch] [--plan <size>] [--machine <name|id>]

A standalone box from a connected GitHub repo (--github-id), any http(s) clone URL (--repo), or blank. --db attaches separate managed companion databases; the box also runs its own Postgres, Redis and Meilisearch. --size is accepted for --plan.

hoststack dev list

Your dev boxes and their companion services (alias: ls).

hoststack dev create --project <project-id|prj_…> [--name <name>] [--size <plan>] [--disk <gb>] [--repo <git-url>] [--branch <name>] [--hoststack-key <key>] [--poststack-key <key>] [--env KEY=VALUE] [--machine <name|id>] [--no-deploy]

A box inside a project. --repo is cloned into /workspace on first boot; public URLs and connected GitHub repos need no key, and if the clone fails the box still boots. --disk is 10–10240 GB (default 10). --hoststack-key and --poststack-key set the keys the built-in MCP servers use; --env is repeatable; --no-deploy creates the box without its first deploy.

hoststack dev create --service <service-id|svc_…> [--no-db] [--name <name>] [--machine <name|id>]

A box that runs a clone of an existing service, with its env vars, a clone of its linked database (unless --no-db) and its own dev URL. Without --machine it runs wherever the source service runs.

hoststack dev delete <service-id|svc_…>

Remove the box together with its cloned database and its /workspace volume (alias: rm).

hoststack task list --project <id>

The project’s task backlog (alias: ls; the group is also tasks).

hoststack task add --project <id> [--box <id>] [--body <text> | --body-file <path|->] <title>

File a task. --box pins it to a dev box; --body is the prompt, and --body-file reads it from a file, or from stdin with - (alias: create).

hoststack task show <task-id>

One task with its full prompt (alias: get).

hoststack task done <task-id>

Mark a task finished.

hoststack task reopen <task-id>

Put a task back in the backlog.

hoststack task delete <task-id>

Delete a task (alias: rm).

hoststack machines list [--json]

Enrolled machines, whether each is online, and what runs on it (alias: ls).

hoststack machines show <machine> [--json]

One machine and everything running on it — worth reading before you switch it off (alias: get).

hoststack machines add <name>

Register a machine and print the installer to run on it — for Linux and macOS as root, and for Windows PowerShell as Administrator. The command carries a single-use pairing token with an expiry, and installs Docker if the machine has none (aliases: create, enrol, enroll).

hoststack machines remove <machine>

Unenrol a machine and print the command that removes the agent from it. Refused while anything is still pinned to it (aliases: rm, delete).

hoststack cron list <service-id> [--limit <n>] [--json]

Recent executions of a cron job, with exit codes (alias: ls).

hoststack cron get <service-id> <execution-id> [--json]

One execution (alias: info).

hoststack cron trigger <service-id>

Run the job now (alias: run).

hoststack errors list [--service <id>] [--status <s>] [--sort count] [--limit <n>] [--json]

Exceptions your apps reported, grouped into issues. --status is unresolved, resolved or ignored; --sort is last_seen (the default), first_seen or count (alias: ls).

hoststack errors show <issue-id> [--json]

One issue and its recent stack traces (alias: get).

hoststack errors resolve <issue-id>

Mark it fixed; you hear about it again if it comes back.

hoststack errors ignore <issue-id>

Keep counting it and stop being told about it.

hoststack errors reopen <issue-id>

Undo resolve or ignore.

hoststack errors fix <issue-id> [--box <service-id>]

Write an agent task for the error in the project’s dev box. The task is written, not started.

hoststack errors keys <list|new|rm> <service-id> [...]

List, mint (new, with an optional name) and revoke (rm <key-id>) the write-only ingest keys your app reports with. A new key is shown once.

hoststack alerts list [--since -1h] [--until <iso>] [--limit N] [--raw] [--all] [--json]

What is on fire: every open alert, with repeats of the same alert collapsed into one row. --raw shows every row, --all includes resolved history. hoststack alerts alone, or with only flags, means list (alias: ls).

hoststack alerts resolve --action <action> --severity <info|warning|error|critical> [--type <resource-type>] [--id <resource-id>]

Say the condition has ended, for an alert nothing on the platform will close by itself — a certificate failure for a domain since removed, a deploy failure on a deleted service.

hoststack alerts ack --action <action> --severity <severity> [--type <t>] [--id <n>] [--hours N] [--note "..."]

Say only that you have seen it. The alert stays open; it is muted for --hours (alias: acknowledge).

hoststack alerts unack --action <action> --severity <severity> [--type <t>] [--id <n>]

Remove an acknowledgement (alias: unacknowledge).

hoststack alerts channels [--json]

Where alerts are delivered — Slack, Discord or email — with webhook URLs masked and the number of events each channel subscribes to. An active channel with no events delivers nothing (alias: channel).

hoststack alerts channels add --type <slack|discord|email> --name <name> --url <webhook-url|email> --events <a,b|all>

Create a channel. --events takes a comma list or all and has no default. The destination cannot be changed afterwards; delete the channel and add a new one.

hoststack alerts channels update <channel-id> [--name <name>] [--on|--off] [--events <a,b|all>]

Rename a channel, switch it on or off, or change its events.

hoststack alerts channels test <channel-id>

Send a test event and report whether the provider accepted it. Exits 1 when it was not delivered.

hoststack alerts channels delete <channel-id>

Delete a channel. Alerts subscribed only to it stop being delivered anywhere.

hoststack alerts events [--json]

Every event a channel can subscribe to — the values --events accepts.

hoststack activity list [--action <a>] [--type <t>] [--resource <id>] [--user <id>] [--severity <s>] [--since <t>] [--until <t>] [--page <n>] [--per-page <n>] [--json]

Who changed what, and when. --since/--until take ISO 8601 or an offset such as -15m, -2h, -7d; --per-page is at most 100 (default 25). Dev-box lifecycle events are hidden from the team feed; --resource <id> shows one resource’s full timeline. hoststack activity alone means list (aliases: ls; the group is also audit).

hoststack uptime get <service-id> [--json]

The check and its last result (alias: status).

hoststack uptime set <service-id> [--path /healthz] [--status 200] [--every 60] [--timeout 10000] [--after 3]

Create or update the check: the path, the expected HTTP status, the interval in seconds, the timeout in milliseconds, and how many failures in a row raise an alert. A change resets the check’s state to unknown (alias: enable).

hoststack uptime disable <service-id>

Keep the configuration and stop probing.

hoststack uptime rm <service-id>

Delete the check (aliases: remove, delete).

hoststack analytics sites [--json]

Every site the team tracks (alias: ls).

hoststack analytics add <domain> [--name <name>]

Start tracking a domain.

hoststack analytics set <domain> [--allowed-origins a,b] [--name <name>] [--retention <days>]

Change a site’s allowed origins, name or retention in days.

hoststack analytics check <domain> [--json]

Why a site shows no traffic, without generating any: a stale key, a refused origin, the hourly quota, events blocked in the browser, or simply no visitors yet.

hoststack analytics stats [domain] [--range 7d] [--json]

Traffic for one site, or every site side by side when you omit the domain.

hoststack analytics search <domain> [--range 30d] [--json]

Google Search Console for a linked site: clicks, impressions, top queries and pages, pages that lost their impressions, and sitemap URLs Google has not indexed. Link a site first with hoststack analytics gsc connect.

hoststack analytics gsc connect --all | connect|status|disconnect <domain> [--property sc-domain:example.com] [--json]

Link sites to Google Search Console. connect --all links every site with the access a member lent to agents (Analytics → Search); connect <domain> does the same for one site, or, with no access lent, prints a dashboard link for the owner to finish; status reads pending → active and says when the first 90-day pull is done; disconnect unlinks, deletes the pulled data and revokes the grant.

hoststack analytics bing key set|status|rm · sites · connect <domain>|--all · status|stats|disconnect <domain> [--range 30d] [--json]

Bing Webmaster Tools. key set saves the team’s Bing API key, read from stdin or a hidden prompt (admins only); connect --all links every site, adding and DNS-verifying the ones Bing lacks when their DNS is on HostStack (--no-add to skip); status and stats show a site’s link and its clicks, queries and pages; disconnect unlinks and deletes its Bing data.

hoststack analytics snippet <domain>

The script tag to paste into the site’s <head>.

hoststack analytics verify <domain> [--check]

Prove you own the domain with a DNS record — needed for an uptime check on it, not for analytics. Without --check it prints the record to publish.

hoststack analytics rotate <domain>

Issue a new site key. The old one keeps working for 30 days.

hoststack analytics rm <domain>

Delete a site and every event recorded for it.

hoststack github repos [filter] [--json]

Connected repositories, with the id dev new --github-id takes. It is a HostStack id, not GitHub’s. The optional filter matches part of owner/name (alias: list).

hoststack github sync

Re-read the repositories of your connected GitHub installations. Run it after creating a repo so HostStack can see it.

hoststack report "<title>" --description <text|-|@path> [--severity <low|normal|high|urgent>] [--service <id|svc_…>] [--database <id|db_…>]

Report a fault in the platform to the HostStack team — not a bug in your own code. --description - reads stdin and @path reads a file. --service attaches the service, its latest deploy and that deploy’s log. Severity defaults to normal; high and urgent mean something is down or losing data. At most 5 reports a minute.

hoststack init [--force]

Write a starter hoststack.yaml in the current directory. Refuses to overwrite an existing hoststack.yaml or hoststack.yml without --force.

hoststack validate

Check the hoststack.yaml (or .yml) in the current directory, locally — it makes no API call.