CLI Reference
A Flui installation has three surfaces: this CLI, the dashboard, and the API both of them call. The CLI comes first. When you create the control cluster there is no dashboard yet, since the dashboard runs on the control cluster, so the first command is typed here or run for you by app.flui.cloud.
After that the three surfaces mostly do the same work, and which one you use is a matter of taste. The overlap is not complete, though, in either direction:
- Only the CLI creates and destroys the control cluster
(
flui env create,flui env destroy; app.flui.cloud creates one by running that same command), holds the vault that protects credentials on your own machine (flui vault), takes over an installation someone else provisioned (flui env adopt), and clears the provider resources an abandoned provisioning run left behind (flui env scrub). Those last three work from what is stored on your own machine (the vault, the profile, the provider credentials), which a browser cannot reach.flui env scrubdoes not call the API at all: it goes straight to the provider, because the installation it would have asked was never finished. - Only the dashboard and the API answer an agent’s paused
write. When an agent asks for something that stops to ask a
person, the person answers in the dashboard or through the
API; there is no
fluicommand for it. The same goes for minting an agent key by permission group:flui auth generate-api-keytakes raw scopes or--unscoped, and has no group flag.
This page is a map of what exists. For how to do a particular job (deploy an app, open a database, connect an agent), see the task pages, which show the same job on each surface that can do it.
How the CLI is organised
Commands are grouped into topics such as app, env,
backup and iam. Each topic owns a set of verbs
that act on the same kind of thing: flui app logs,
flui env create, flui iam grant add.
Some topics group their verbs one level deeper, when the
topic covers more than one kind of object:
flui backup policy list, flui migrate db create,
flui gateway routes add.
Every command has --help, which prints its usage, its
flags and its examples. flui <topic> --help lists the verbs
in that topic, and flui --help lists every topic. That
built-in help is generated from the CLI itself, so it is
never out of date. When this page and --help disagree,
--help is right.
Topics
| Topic | What it does | Read more |
|---|---|---|
alerts | Where this installation sends its alerts besides the dashboard (an email address or a signed webhook), and whether administrators also get warnings. | Alerts, audit and costs |
app | Everything about a running application: status, logs, metrics, HTTP traffic, alerts and crash reports; scale, restart, stop and start; releases, image versions and redeploys; volume snapshots and backups; scheduled jobs; variables; delete. | Applications |
audit | Who did what on this installation: every change, every refusal and every read of application data. | Alerts, audit and costs |
auth | Sign in through the browser, mint and revoke API keys, and list the keys you hold. | Authentication |
backup | Protect a whole cluster or one application, answer what needs a decision, manage destinations, policies and jobs, plus the platform’s own backup setup. The app backup volume snapshots are documented on the same page. | Backups |
catalog | List what this installation can install, install it, check how an install is going, and validate a manifest. | Deploy |
cluster | Create a workload cluster, list every cluster, rebuild one, recover access to it, manage the Flui firewall on its machines, destroy a workload cluster, and list storage left behind by applications that no longer exist. | Clusters and nodes |
config | Layered configuration: preferences, and the provider credentials the CLI keeps encrypted. | Profiles and config |
context | Profiles: create, list, switch and delete the installations this workstation talks to. | Profiles and config |
db | Reach a Flui database from your machine: credentials, a local tunnel, dumps and restores, disk usage, continuous-backup state, point-in-time restore. | Databases |
demo | The self-running cross-provider migration demonstration an installation can perform on itself. | flui demo --help |
dev | Helpers for people working on Flui itself, not for operating an installation. | Dev tools |
dns | The zones a cluster publishes under, the single wildcard record that covers all of its applications, and second-provider replicas. | flui dns --help |
env | The control cluster’s whole life: create, status, capacity, storage, scale, firewall, stop and restart, reinstall, upgrade, adopt, scrub, destroy. | Environments |
gateway | Named routes at the edge of an application, and the policies on them: sign-in, rate limits, IP allowlists. | flui gateway --help |
iam | Who can reach what: grants, groups, the built-in roles, your own effective permissions, and the policy file. | flui iam --help |
inference | What the assistant and the console copilots have spent, by model and by person. | Alerts, audit and costs |
integration | Connect GitHub for the installation and for your own account, and manage the token used to pull images. | Integrations |
mail | Connect mail providers, register sending domains, check what still blocks a message, send, and read delivery outcomes and suppressions. | flui mail --help |
migrate | Move a database, an application, or both together, to another cluster: create, cut over, abort, destroy the source. | flui migrate --help |
network | The private networks of this installation, and creating one on a provider that needs it before a cluster. | Clusters and nodes |
node | Join a machine you already own, list nodes, read a node’s logs, remove a machine you joined. | Clusters and nodes |
operating-context | Write down how this installation is run, so people and agents read it before acting. | flui operating-context --help |
repo | Connect, list and disconnect the repositories this installation can deploy from. | Integrations |
sandbox | The guest areas of a demonstration installation: what is being held, and ending one now. | flui sandbox --help |
scaling | What a cluster may buy for itself and where it must stop, what it decided, and what it would decide right now. | flui scaling --help |
server-types | The machine sizes a provider offers. | Clusters and nodes |
showcase | Publish an application to the showcase (the short list this installation puts in front of other people), or take it back out. | Alerts, audit and costs |
template | Start a new repository from a Flui framework template. | Templates |
topology | The fleet as the dashboard Topology shows it: clusters, the apps on them, the servers they run on and what needs attention, in a live navigator or printed. | Topology |
vault | The passphrase that protects the credentials this CLI stores on your machine. | Profiles and config |
Seven commands sit at the top level, outside any topic:
| Command | What it does | Read more |
|---|---|---|
flui costs | What your clusters cost, spent and forecast, month by month and provider by provider. | flui costs --help |
flui deploy | Deploy an application from a flui.yaml manifest. | Deploy |
flui operation <id> | Show an infrastructure operation, such as a cluster being created or a node being added, and follow it to the end. | flui operation --help |
flui reconcile | Bring the CLI’s local DNS state back in line with the API. | Utilities |
flui ssh | Open a shell on a cluster node. | Clusters and nodes |
flui update | Update the CLI itself. | Utilities |
flui version | The CLI version, and the platform release it pins. | Utilities |
Where the “read more” column says --help, there is no
hand-written page for that topic, and the command’s own help
is the reference.
Common conventions
A few flags recur across the CLI:
-c, --cluster <name|id>: pick the target cluster on the commands that act on one. When the installation has a single cluster, it is detected for you.-o, --output <format>: switch between human and machine-readable output. The exact set varies by command, butjsonis there for scripting; the human format istableortextdepending on the command’s shape.--no-wait/--detach/-d, --detached: on commands that start long work, return as soon as the job is queued instead of blocking until it finishes.-f, --force/-y, --yes: skip the confirmation on a destructive command.--dry-run: on a subset of commands, print what would happen and change nothing.
Commands that talk to the API first print a short context banner with the active profile and the API URL, so you always know which installation you are operating on.
Profiles on disk
The CLI keeps each installation’s state under
~/.flui/profiles/<name>/. A profile holds the API key, the
provider credentials, the SSH trust root used to reach
cluster nodes, and the local view of clusters, nodes,
firewalls and operations that installation knows about.
The active profile is named in ~/.flui/context, and
FLUI_PROFILE overrides it for one command.
Credentials in a profile are protected by a vault at
~/.flui/vault.json. One vault covers every profile: you
choose the passphrase once with flui vault init, open it
for a session with flui vault unlock, and close it with
flui vault lock. Profiles still get their own derived
keys, so two accounts stay apart behind one passphrase.
To switch installations, run flui context use <name>.
Every command after that targets the new profile.