Get started

The CLI

The whole platform from the terminal. The CLI is a client of the public API and nothing else; every command sends the same request the dashboard sends.

Install and sign in#

curl -fsSL https://ibel.ai/install/install.sh | sh

The installer downloads a single executable from our own server (ibel.ai/install) and needs nothing else. Before installing it checks the checksum list's signature against our release key and the file's checksum, and installs nothing if either is wrong. It goes in ~/.local/bin on macOS and Linux and in %LOCALAPPDATA%\cloudhost\bin on Windows (added to your user PATH). Builds: macOS on Apple chips and Intel, Linux x64 and arm64 (glibc), Windows x64. The npm package needs Node.js 22 or newer.

Installer setting	What it does
`CLOUDHOST_VERSION=1.2.0`	That version instead of the newest.
`CLOUDHOST_INSTALL_DIR=<dir>`	Where to install it.
`CLOUDHOST_DOWNLOAD_URL=<url>`	Another server with the same files (a company mirror, say); the signature is still checked.

Setting	What it does
`~/.config/cloudhost/config.json`	The API address and a key per team, as `cloudhost login` and `cloudhost teams switch` received them. Delete it to sign out.
`CLOUDHOST_API_KEY`	An API key, instead of the file; for CI.
`CLOUDHOST_API_URL`	Another API address. Default `https://api.ibel.ai`.
`--api <url>`	The same, for `login` only.
`cloudhost help [command]`	Every command and flag, or one command
`cloudhost status [show]`	The platform's own status: each component, 90-day uptime, open incidents and maintenance; no sign-in needed
`cloudhost status incidents [--limit <n>]`	Past incidents and maintenance, newest first
`cloudhost status incident <id>`	One incident with every update

cloudhost help lists every command and flag, and cloudhost help <command> one of them. Every command takes --json and then prints the API's answer as it is.

Updates and signatures#

Command	What it does
`cloudhost version`	The CLI's version and how it was installed (`cloudhost --version` says the same).
`cloudhost update`	Downloads the newest signed release from our server, checks and tries it, and puts it in place of this one. Installed with npm, it tells you the npm command instead.
`cloudhost update --check`	Only says whether a newer version is out.
`cloudhost update --to <نسخه>`	That version, older ones too.
`cloudhost update --notify off`	Turns the daily check and its notice off (`on` turns it back on).
`CLOUDHOST_NO_UPDATE_CHECK=1`	The same, as a variable. In CI (`CI` set) there is no check either.

Once a day the CLI looks for a newer version in the background, without making any command wait, and if there is one it writes one line to stderr, at most once a day. Nothing is written with --json or when the output is not a terminal.

Every release has a checksum list (SHA256SUMS) signed with the platform's release key. The public key is at https://ibel.ai/install/cli/release-key.pem, and inside the install scripts and the CLI itself; the installers and cloudhost update refuse any file that doesn't match the signed list. To check by hand:

Check by hand

curl -fsSLO https://ibel.ai/install/cli/latest/SHA256SUMS
curl -fsSLO https://ibel.ai/install/cli/latest/SHA256SUMS.sig
curl -fsSLO https://ibel.ai/install/cli/release-key.pem
openssl base64 -d -A -in SHA256SUMS.sig -out SHA256SUMS.bin
openssl dgst -sha256 -verify release-key.pem -signature SHA256SUMS.bin SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS   # beside the files you downloaded

Functions and apps#

Every one of these works for functions and for apps: cloudhost functions … or cloudhost apps …. With neither, functions are meant.

Command	What it does
`cloudhost init [name]`	Write a `cloudhost.toml` here
`cloudhost deploy`	Build and deploy the `cloudhost.toml` project here; Next.js and Astro are built on our builder
`cloudhost deploy <name> <entry.ts>`	Deploy a function from one file
`cloudhost apps deploy <name> <dir> [--function <entry.ts>] [--spa]`	Deploy static files, with an optional function
`--var NAME=value` · `--date YYYY-MM-DD`	A variable (repeatable) and the runtime date, for deploy
`--db DB=shop` · `--cache CACHE=sessions` · `--bucket BUCKET=uploads`	Bind a database, cache or bucket, for deploy
`--branch <b>`	A preview `<b>--<name>` instead of production, for deploy and build
`cloudhost <apps\|functions> list` · `create <name>`	List and create
`cloudhost <apps\|functions> rename <name> <new-name>`	Rename it; the address and previews move to the new name and the old address stops answering (owner or admin)
`cloudhost <apps\|functions> delete <name>`	Delete it with its versions, previews, secrets and logs (owner or admin; clear its crons first)
`cloudhost <apps\|functions> versions <name>` · `rollback <name> [--to <v>]`	Versions and rollback
`cloudhost <apps\|functions> checks <name> [build]` · `checks settings <name>` · `checks set <name> [--smoke on\|off\|/path] [--test <command>] [--typecheck on\|off] [--require a,b] [--timeout <min>] [--scan none\|high\|critical]`	Deployment checks
`cloudhost <apps\|functions> checks report <name> <build> <check> <status> [--summary <text>] [--url <url>]` · `checks rerun <name> <build> <check>` · `checks promote <name> <build>`	Report, re-run and promote checks
`cloudhost <apps\|functions> vulns <name> [build]` · `vulns rescan <name> <build>`	Dependency vulnerabilities
`cloudhost <apps\|functions> previews <name>` · `previews delete <name> <branch>`	Previews
`cloudhost build [name] [--branch b]` · `cloudhost <apps\|functions> builds <name>`	A build on our servers with its live log, and the build history
`cloudhost <apps\|functions> builds cancel <name> <build>` · `builds redeploy <name> <build> [--no-cache]`	Cancel a queued or running build, and build the same source again (without the build cache with --no-cache)
`cloudhost <apps\|functions> builds secrets <name> <build>` · `builds sbom <name> <build> [--output <file>]` · `builds provenance <name> <build> [--verify]`	Supply chain: where the secret scan found secrets, the bill of materials (SBOM), and the signed provenance record and its check
`cloudhost <apps\|functions> build-config <name>` · `build-config set <name> <field> <value>` · `build-config clear <name> <field>`	Build settings: root folder, ignored build step, install and build commands, output folder, Node.js version, secret scan and build cache
`cloudhost <apps\|functions> build-cache <name>` · `build-cache clear <name>`	The project's build cache, and emptying it
`cloudhost <apps\|functions> env ls [--environment <env>] [--branch <branch>] [--project <name>]`	The project's environment variables: key, environments (production, preview, development), branch and type; values are not shown
`cloudhost <apps\|functions> env add <KEY> [--environment <env>]… [--branch <branch>] [--sensitive] [--project <name>]`	Add a variable, read as `env.KEY`. The value comes from a prompt (not echoed) or stdin, never from the command line. Default: all three environments, or production and preview for a sensitive value. `--branch`: only that branch's previews, over the preview value. A sensitive value is never shown again, only replaced.
`cloudhost <apps\|functions> env rm <KEY> [--environment <env>]… [--branch <branch>] [--project <name>]`	Remove a variable: everywhere, or only from the given environments or branch
`cloudhost <apps\|functions> env pull [file] [--environment <env>] [--branch <branch>] [--yes] [--project <name>]`	Write the development values (or the given environment's) to `.env.local`, or [file]. Refuses to overwrite without `--yes`, and adds the file to `.gitignore`. Sensitive values are not written.
`cloudhost <apps\|functions> secrets put <name> <KEY>` · `secrets list <name>` · `secrets delete <name> <KEY>`	The old form of the same: `secrets put` sets a sensitive variable for production and preview (the value from stdin), `secrets list` shows the keys and `secrets delete` removes the key from every environment
`cloudhost <apps\|functions> crons <name>` · `crons set <name> "<cron>"… [--tz zone]` · `crons clear <name>`	Crons
`cloudhost functions starters` · `cloudhost functions new <name> [--starter <id>] [--db DB=<database>] [--cache CACHE=<cache>]`	The starter functions; create and deploy a function from one, as the dashboard does
`cloudhost functions source <name> [dir] [--version <n>]` · `cloudhost functions source deploy <name> <file.js\|dir> [--main <file.js>] [--no-deploy]`	Read a version's code; deploy .js files as they are, without bundling, so they open in the dashboard's editor
`cloudhost apps upload <name> <dir\|archive> [--branch <branch>]`	Upload a folder, .zip or .tar.gz: a static site goes live at once, a framework project is built
`cloudhost <apps\|functions> logs <name> [--limit n]` · `tail <name>` · `usage <name> [--from ISO] [--to ISO]`	Logs, the live log and usage
`cloudhost <apps\|functions> stats <name> [--range 1h\|24h\|7d]`	Requests, error rate and latency (p50, p95, p99), in total and per route
`cloudhost domains ls [--project <name>]`	The team's custom domains (or one project's) and their state
`cloudhost domains add <domain> [--project <name>] [--www apex\|www\|none] [--redirect-to <domain>] [--redirect-status <code>] [--branch <branch>]`	Serve the project at your own domain; shows the DNS records to set (Custom domains)
`cloudhost domains inspect <domain>`	A domain's state, its DNS records and its certificate
`cloudhost domains verify <domain>`	Check a domain's DNS records now
`cloudhost domains rm <domain>`	Stop serving a domain and delete its certificate

Databases, caches and storage#

Command	What it does
`cloudhost db list` · `show <name>` · `create <name>` · `password <name>` · `delete <name>`	Databases and a new password
`cloudhost db branches <name>` · `branch <name> <branch> [--from b] [--at time \| --lsn lsn]`	Branches
`cloudhost db branch delete <name> <branch>` · `restore <name> <branch> --at <time>`	Delete a branch, restore to a point in time
`cloudhost db stats <name> [--range 1h\|24h\|7d]`	Compute, size, connections, cache hit ratio, transactions and the top statements
`cloudhost cache list` · `create <name> [--memory 64] [--max-storage 256] [--no-eviction]` · `delete <name>`	Caches
`cloudhost cache tokens <name> [create [--ro] \| revoke <id>]`	Cache tokens
`cloudhost cache run <name> <COMMAND> [args…]`	Run one cache command
`cloudhost cache stats <name> [--range 1h\|24h\|7d]`	Keys, hit rate and stored size against the limit, then commands, memory, evictions and bandwidth over time
`cloudhost cache update <name> [--memory <MB>] [--max-storage <MB>] [--eviction on\|off]` · `cloudhost cache limits`	Change memory, the stored-size limit or eviction; and the sizes, checkpoint days and command rate on your plan
`cloudhost cache checkpoints <name>` · `cloudhost cache checkpoint <name>` · `cloudhost cache restore <name> <checkpoint> [--to <new>] [--yes]`	A cache's checkpoints (kept 7 to 30 days by plan), taking one now, and restoring one over the cache (its data is replaced) or into a new cache
`cloudhost buckets list` · `create <name>` · `delete <name>`	Buckets
`cloudhost buckets stats <name> [--range 24h\|7d\|30d]`	Size, objects, reads, writes and downloads
`cloudhost storage credentials`	Create or rotate the team's storage key (shown once)

Queues and background jobs#

Command	What it does
`cloudhost queues list`	Queues, the messages waiting in each and their consumers
`cloudhost queues create <name> [--visibility-timeout 30] [--max-retries 3] [--retry-delay 5] [--retention <seconds>] [--delay <seconds>] [--dead-letter-queue <queue>]`	Create a queue
`cloudhost queues show <name>` · `cloudhost queues update <name> [same flags]`	A queue's settings, and change them
`cloudhost queues pause <name>` · `cloudhost queues resume <name>`	Stop and resume delivery; sends are still accepted while paused
`cloudhost queues delete <name>`	Delete a queue with its messages (needs a second factor)
`cloudhost queues consumer <name> [function] [--url <https://…>] [--pull] [--batch-size 10] [--batch-wait 1] [--concurrency 1]`	Who gets the messages: a function (its queue(batch, env) handler), a URL (one signed POST per message) or --pull
`cloudhost queues consumer clear <name>`	Remove the consumer; messages wait
`cloudhost queues consumer rotate-secret <name>`	A new signing secret for a URL consumer (shown once)
`cloudhost queues send <name> <json \| text \| -> [--delay <seconds>] [--dedup <id>]`	Send one message (JSON or text; - reads stdin)
`cloudhost queues peek <name> [--state ready\|delayed\|in_flight] [--limit <n>]`	Look at the waiting messages without taking them
`cloudhost queues pull <name> [--max 10] [--visibility-timeout <seconds>]`	Take messages from a pull queue; ack them before the timeout
`cloudhost queues ack <name> <lease>… [--retry] [--delay <seconds>]`	Ack pulled messages (--retry: deliver them again)
`cloudhost queues backlog <name>`	Messages ready, delayed and in flight now, and per minute
`cloudhost queues dead-letters <name> [--limit <n>]`	The queue's messages that ran out of retries
`cloudhost queues dead-letters retry <name> [id…] [--limit <n>]`	Put dead letters back in the queue
`cloudhost queues dead-letters purge <name>`	Delete the queue's dead letters (needs a second factor)
`cloudhost queues purge <name>`	Delete every message in a queue
`cloudhost queues redrive <dead-letter queue> [--limit <n>] [--to <queue>]`	Move dead-lettered messages back to the queue each came from
`cloudhost queues stats <name> [--range 1h\|24h\|7d]`	Messages waiting, age of the oldest, sent, processed, failed and dead-lettered
`cloudhost schedules list`	Schedules, their target and last run
`cloudhost schedules create "<cron>" --queue <name> \| --function <name> \| --url <https://…> [--name <name>] [--timezone Asia/Tehran] [--body <json>]`	Send a message on a schedule (Tehran time by default) to a queue, a function or a URL
`cloudhost schedules show <id \| name>`	A schedule, its next and last run
`cloudhost schedules update <id \| name> [--cron <cron>] [--timezone <zone>] [--body <json>] [--name <name>] [--pause] [--resume]`	Change a schedule, or pause and resume it
`cloudhost schedules delete <id \| name>`	Delete a schedule

Example

cloudhost queues create emails --dead-letter-queue emails-dead
cloudhost deploy mailer mailer.ts --queue QUEUE=emails   # env.QUEUE.send(...)
cloudhost queues consumer emails mailer --batch-size 20
cloudhost queues send emails '{"to":"a@example.com"}' --delay 30

Account, teams and billing#

Command	What it does
`cloudhost whoami`	The current key, team, email and role
`cloudhost teams list` · `teams switch <team>`	The teams this computer is signed in to, and the current one; switch team (the first time, approve in the browser)
`cloudhost teams members` · `teams invite <email> [--role r]` · `teams invites delete <id>`	Members and open invites; invite by email; withdraw an invite
`cloudhost teams role <member> <role>` · `teams remove <member>` · `teams roles`	Change a member's role (owner only), remove a member, and the list of roles
`cloudhost teams limit <member>` · `teams unlimit <member>`	Limit a developer or viewer to chosen projects (they see only what they and their groups are given); give them the whole team again
`cloudhost access groups` · `access groups create <name>` · `access groups show <group>` · `access groups delete <group>`	The team's access groups; make one, show its members and projects, delete it
`cloudhost access groups add <group> <member>` · `access groups remove <group> <member>`	Put a member in a group, or take them out
`cloudhost access allow <group\|member email> <name> [--kind k] [--role developer\|viewer]` · `access deny <group\|member email> <name> [--kind k]`	Give a group or a member a role (developer or viewer) on an app, function, database, cache or bucket; take it away
`cloudhost access who <name> [--kind k]`	Who has access to one project or store
`cloudhost keys list` · `create <name> [--role r] [--expires days]` · `revoke <id>` · `rotate <id>`	API keys
`cloudhost audit [--limit n]`	The audit log
`cloudhost billing [show]` · `billing usage [--period 1405-08]` · `billing transactions` · `billing prices`	Wallet, usage, transactions and prices
`cloudhost billing invoices` · `billing invoice <number\|preview>`	Invoices
`cloudhost billing topup <tomans> [--method m]` · `billing plan <pro\|hobby>`	A top-up link and a plan change
`cloudhost billing tax` · `billing tax set --type person\|company --legal-name … --national-id … [--economic-code …] [--postal-code …] [--address …]`	The tax details on invoices (owner, admin or billing)
`cloudhost billing budget` · `billing budget set <tomans\|default> [--pause]`	The monthly usage budget (Pro), what is used, and whether sites pause at it

The CLI shows amounts in tomans; the API gives every amount in rials.

Alerts#

Command	What it does
`cloudhost alerts list`	Rules and recent alerts
`cloudhost alerts create <name> <metric> --above n\|--below n [--window m] [--kind app\|function]`	An alert on a function or app; metric is error_rate, p95_ms, p99_ms or requests
`--email` · `--sms` · `--webhook <url>` · `--bale-chat <chat>` · `--eitaa-chat <chat>`	Channels, for `alerts create`; a Bale or Eitaa bot token is read from stdin
`cloudhost alerts delete <id>` · `alerts test <id>`	Delete a rule, and send a test alert (an id or its first characters)

Example

cloudhost functions stats my-api --range 24h
cloudhost alerts create my-api error_rate --above 2% --email
# alert 3f9c1a2b: function my-api error_rate > 2% over 5 min → email
cloudhost alerts test 3f9c

Support#

Command	What it does
`cloudhost support list [--status open\|pending\|closed\|active] [--severity <s>]`	The team's support cases (owners and admins: all; others: the ones they opened)
`cloudhost support open "<subject>" --category <c> [--severity <s>] [--resource kind:name] [--message "..."] [--file <path>]`	Open a case; the message from --message or stdin; urgent is for Pro
`cloudhost support show <case>`	A case and its messages (its number, e.g. 12)
`cloudhost support reply <case> [--message "..."] [--file <path>]`	Reply on a case; a closed case opens again
`cloudhost support close <case>`	Close a case

Example

cloudhost support open "Deploys fail since this morning" --category function --severity high \
  --resource function:my-api --file build.log --message "Every deploy fails at the build step."
# case #12 opened (high)
cloudhost support show 12
echo "It works now, thanks" | cloudhost support reply 12
cloudhost support close 12

Connected repositories#

Command	What it does
`cloudhost git connections`	The team's GitHub and GitLab connections
`cloudhost git remote [name] [--add]`	Our git remote for a project, the push commands and how to sign in (the password is an API key)
`cloudhost git connect <github\|gitlab> [--url <gitlab address>] [--application <id>]`	A new connection: prints the address to open and approve (a self-hosted GitLab with --url; your own application with --application, its secret on stdin)
`cloudhost git disconnect <connection> [--unlink]`	Remove a connection (owner or admin); --unlink also unlinks the projects that use it
`cloudhost git repos <connection> [search]`	The repositories the connection can reach and the projects linked to them
`cloudhost <apps\|functions> git link <name> <connection> <owner/repo> [--branch <production branch>] [--no-previews]`	Link a project to a repository: a push to the production branch deploys production, any other branch gets a preview
`cloudhost <apps\|functions> git show <name>`	The repository a project is linked to
`cloudhost <apps\|functions> git unlink <name>`	Stop building from the repository
`cloudhost <apps\|functions> git deploy <name> [--branch <branch>]`	Build the latest commit of a branch now (default: the production branch)
`cloudhost <apps\|functions> git import <name> <connection> <owner/repo> [--branch <production branch>] [--no-previews]`	Make a new project from a repository and build it

Example

cloudhost git connect github
# open the printed address, choose the repositories, approve
cloudhost git connections
cloudhost git repos acme
cloudhost apps git import shop acme acme/shop
cloudhost apps git link docs acme acme/docs --branch release
cloudhost apps git deploy shop --branch feature/cart

Webhooks, log export and traces#

Command	What it does
`cloudhost webhooks list [--project <name>]`	The team's webhooks (Pro 20, free 1)
`cloudhost webhooks events`	The event types a webhook can ask for
`cloudhost webhooks add <url> --events a,b [--project <name>] [--description "..."]`	Add a webhook; the signing secret is shown once
`cloudhost webhooks show <id>`	One webhook
`cloudhost webhooks update <id> [--url <url>] [--events a,b] [--description "..."]`	Change the address, events or note
`cloudhost webhooks enable <id>` · `cloudhost webhooks disable <id>`	Turn on or off (also after it was disabled for failing)
`cloudhost webhooks rm <id>`	Delete a webhook and its delivery log
`cloudhost webhooks rotate <id>`	A new signing secret; the old one stops working
`cloudhost webhooks test <id>`	Send a ping and show the answer
`cloudhost webhooks deliveries <id> [--status ok\|failed\|pending] [--limit <n>]`	The delivery log: event, answer, tries
`cloudhost webhooks redeliver <id> <delivery>`	Send a logged event again
`cloudhost drains list [--project <name>]`	The team's log exports (Pro) with their health
`cloudhost drains add <name> --kind https\|syslog --url <url> [--project <name>] [--sources a,b] [--levels a,b] [--sampling <percent>] [--no-gzip] [--header Name:value]`	Send logs to your endpoint: HTTPS (NDJSON) or syslog over TLS; the signing secret is shown once
`cloudhost drains show <id>`	A log export's health and its last sends
`cloudhost drains update <id> [--url <url>] [--sources a,b] [--levels a,b] [--sampling <percent>] [--no-gzip]`	Change the address or filters
`cloudhost drains enable <id>` · `cloudhost drains disable <id>`	Turn on or off; logs flow from that moment
`cloudhost drains rm <id>`	Delete a log export
`cloudhost drains test <id>`	Send one sample line
`cloudhost traces list [--project <name>] [--status 5xx] [--errors] [--min-ms <ms>] [--limit <n>]`	Recent request traces
`cloudhost traces show <trace id>`	One trace as a waterfall of its spans

Example

cloudhost webhooks add https://example.com/hooks/deploys --events deployment.ready,deployment.failed --project shop
# signing secret (shown only now, keep it): whsec_…
cloudhost webhooks test 4f3a9c2e
cloudhost webhooks deliveries 4f3a9c2e --status failed
cloudhost drains add "errors" --kind https --url https://logs.example.com/ingest --levels warn,error \
  --header "Authorization:Bearer $TOKEN"
cloudhost drains show 7b1d0e55
cloudhost traces list --project shop --status 5xx
cloudhost traces show 0123456789abcdef0123456789abcdef

Feature flags#

Command	What it does
`cloudhost flags list [--project <name>]`	A project's flags and what each environment serves
`cloudhost flags add <key> [--type boolean\|string\|number\|json] [--value <v>] [--description "..."]`	Make a flag; the first value goes to every environment
`cloudhost flags show <key>`	One flag: every environment's value, rules and rollout
`cloudhost flags set <key> <value> [--environment production\|preview\|development\|all] [--branch <b>]`	What it serves when no rule or rollout applies
`cloudhost flags kill <key> [--environment <env>] [--branch <b>]`	The kill switch: serve the off value at once
`cloudhost flags revive <key> [--environment <env>] [--branch <b>]`	Switch a killed flag back on
`cloudhost flags rollout <key> <percent> --value <v> [--by <attribute>] [--environment <env>]`	Percentage rollout: the same keys get the new value every time
`cloudhost flags rule add <key> <attribute> <op> <values> --value <v> [--percentage <n>]`	A targeting rule (equals, in, contains …)
`cloudhost flags rule rm <key> <rule id>`	Remove a rule
`cloudhost flags history <key> [--limit <n>]`	Who changed what, newest first
`cloudhost flags rollback <key> <version>`	Put the flag back as it was at a version (also restores a deleted flag)
`cloudhost flags rm <key>`	Delete a flag; its history stays
`cloudhost flags eval <key> [--context <json>] [--environment <env>] [--branch <b>]`	What a caller with this context gets, and why
`cloudhost flags tokens`	The read-only tokens for reading flags over REST
`cloudhost flags tokens create [name] [--environment <env>]`	A read-only token for one environment (shown once)
`cloudhost flags tokens rm <id>`	Revoke a token
`cloudhost flags on <key>` · `cloudhost flags off <key>`	Switch a flag on, or off everywhere at once
`cloudhost flags browser <key> <on\|off>`	Whether browser keys can read this flag
`cloudhost flags segments` · `cloudhost flags segments show <key>`	Segments: reusable lists of users for rules
`cloudhost flags segments add <key> [--include <ids>] [--exclude <ids>] [--attribute <name>]`	A new segment; use it in a rule with op in_segment
`cloudhost flags segments include <key> <ids>` · `cloudhost flags segments exclude <key> <ids>` · `cloudhost flags segments rm <key>`	Add or keep out ids, delete a segment
`cloudhost flags keys` · `cloudhost flags keys create [name] [--kind server\|browser] [--environment <env>]` · `cloudhost flags keys rm <id>`	Flag keys for apps outside the platform (OpenFeature)
`cloudhost flags audit [--limit <n>]`	Every flag and segment change, newest first

Example

cloudhost flags add new-checkout --type boolean --description "New checkout flow"
cloudhost flags rule add new-checkout email ends_with @acme.ir --value true --environment production
cloudhost flags rollout new-checkout 10 --value true --environment production
cloudhost flags kill new-checkout
cloudhost flags history new-checkout
cloudhost flags rollback new-checkout 3

Firewall#

Command	What it does
`cloudhost firewall [show] [--project <name>]`	Status, the always-on protections, the rules in order and the plan's limits
`cloudhost firewall rules`	The custom rules, in the order they run
`cloudhost firewall add --name <n> --action deny\|allow\|log\|rate_limit --if "<cond>" [--if …] [--or --if …] [--limit <n> --window <s> --key ip\|header:<name> --then deny\|log] [--position <n>] [--disabled] [--description "..."]`	Add a rule; consecutive `--if` are ANDed, `--or` starts the next group
`cloudhost firewall edit <id> [same flags]`	Change a rule; `--if` replaces its conditions
`cloudhost firewall enable <id>`	Switch a rule on
`cloudhost firewall disable <id>`	Switch a rule off (it stays in the list)
`cloudhost firewall rm <id>`	Delete a rule
`cloudhost firewall move <id> <position>`	Move a rule in the order (0 runs first)
`cloudhost firewall check --ip <addr> [--country <CC>] [--method <m>] [--path <p>] [--host <h>] [--ua <ua>] [--header name=value]`	What the rules would do with this request
`cloudhost firewall metrics [--range 1h\|24h\|7d]`	Requests allowed, denied, rate limited and logged; hits per rule; the addresses and countries stopped
`cloudhost firewall audit [--limit <n>]`	Who changed the firewall and how

Example

cloudhost firewall add --project my-api --name "Block admin" --action deny --if "path starts /admin" --if "ip not in 10.0.0.0/8"
cloudhost firewall add --project my-api --name "Login limit" --action rate_limit --if "path eq /login" --limit 10 --window 60
cloudhost firewall check --project my-api --ip 203.0.113.7 --path /admin
cloudhost firewall move fwr_abc123def456 0 --project my-api
cloudhost firewall metrics --project my-api --range 1h

Protection, releases and versions#

Command	What it does
`cloudhost protection [show] [--project <name>]`	Who may open previews (and production), the bypass token and the shareable links
`cloudhost protection set [--previews off\|team\|password] [--production on\|off] [--password <p>\|-] [--options on\|off] [--exceptions <domains>\|none]`	Protect previews with team sign-in or a password (Pro); exception domains; let OPTIONS through
`cloudhost protection bypass` · `cloudhost protection bypass rm`	A bypass token for automation (shown once), and deleting it
`cloudhost protection sign-out`	Every visitor signs in again
`cloudhost protection links` · `cloudhost protection link create [--label <t>] [--hours <n>] [--url <address>]` · `cloudhost protection link rm <id>`	Shareable links that skip protection, with expiry and revoke (Pro)
`cloudhost promote <version>`	Make a version live now (ends a gradual release)
`cloudhost release [show]` · `cloudhost release list`	The gradual release in progress, with requests and errors per version; and past releases
`cloudhost release start <version> [--steps 10,25,50,100] [--every <minutes>] [--error-rate <percent>]`	Send a share of production traffic to a version step by step; it stops by itself if errors pass the limit
`cloudhost release set <percent>` · `cloudhost release next` · `cloudhost release stop`	A manual step (100 makes it production), the plan's next step, or all traffic back
`cloudhost routing [show]` · `cloudhost routing set [--auto-promote on\|off] [--skew on\|off] [--skew-hours <h>]`	Deploy without promoting, and keep each open page's version (version skew protection)

Example

cloudhost protection set --previews team --production off --project shop
cloudhost protection bypass --project shop
# bypass token (shown only now): chb_…
curl -H "x-protection-bypass: $TOKEN" https://feature-x--shop.app.trustpage.ir/
cloudhost routing set --auto-promote off --skew on --skew-hours 12
cloudhost release start 42 --steps 10,25,50,100 --every 30 --error-rate 2
cloudhost release stop

Secrets#

Command	What it does
`cloudhost secrets projects` · `cloudhost secrets create <project> [--env production,preview,development] [--rotate-days 90] [--restricted]`	The team's secrets projects; make one, with its environments, a rotation reminder and restricted access
`cloudhost secrets delete-project <project>`	Delete a secrets project with its secrets and tokens (owner or admin; unlink it first)
`cloudhost secrets list [--project <name>] [--env <env>]`	Names, types and versions per environment; never the values
`cloudhost secrets get <NAME> [--env <env>] [--version <n>]`	Print a secret's value
`cloudhost secrets set <NAME> [--env a,b] [--type plain\|sensitive] [--note <text>]`	Set a secret; the value from stdin or a hidden prompt, never the command line
`cloudhost secrets rm <NAME> [--env <env>]`	Delete a secret with its history, or from one environment
`cloudhost secrets rotate <NAME> [--generate [--length 40]]`	A new value from stdin, or a random one shown once
`cloudhost secrets versions <NAME> [--env <env>]` · `cloudhost secrets rollback <NAME> --env <env> --to <n>`	A secret's versions; bring back an earlier version's value
`cloudhost secrets import <FILE> [--env <env>]`	Add the secrets of a .env file
`cloudhost secrets pull [--env <env>] [--file .env.local] [--yes]`	Write one environment's non-sensitive secrets to a .env file (mode 600); sensitive ones are left out
`cloudhost run [--project <name>] [--env <env>] -- <command...>`	Run a command with the secrets in its environment; nothing is written to disk; also works with a project token in CLOUDHOST_SECRETS_TOKEN
`cloudhost secrets tokens [list]` · `cloudhost secrets tokens create <name> [--access read\|write] [--env <env>] [--expires <days>]` · `cloudhost secrets tokens revoke <id>`	Project tokens for apps, CI and servers (the token is shown once)
`cloudhost secrets link --to <function\|app> [--mode binding\|variables]` · `cloudhost secrets unlink --to <function\|app>`	Let a function or app read the project: env.SECRETS, or each secret as env.NAME; changes reach it without a redeploy
`cloudhost secrets audit [--project <name>]` · `cloudhost secrets usage [--project <name>]`	Every read and change of secrets; secrets stored, reads and writes this month

Example

cloudhost secrets create shop
printf %s "$STRIPE_KEY" | cloudhost secrets set PAYMENT_KEY --project shop --type sensitive
cloudhost secrets pull --project shop --env development
cloudhost run --project shop --env development -- npm run dev
cloudhost secrets link --project shop --to my-site

Web analytics and speed insights#

Command	What it does
`cloudhost analytics [project] [--period 24h\|7d\|30d\|90d\|12mo] [--environment production\|preview\|all] [--path <p>] [--referrer <host>] [--country <CC>] [--device <d>]`	Visitors, page views and bounce rate against the period before, with the top pages, referrers, countries and devices
`cloudhost analytics [project] --by path\|referrer\|country\|device\|os\|browser [--limit <n>]`	One full list (up to 500 rows)
`cloudhost analytics list`	The team's apps and functions: what is on, and the last 7 days
`cloudhost analytics enable [project] [--web] [--speed]` · `cloudhost analytics disable [project] [--web] [--speed]`	Turn web analytics and speed insights on or off (or only one); turning on needs Pro
`cloudhost analytics settings [project] [--speed-sample <percent>]`	What is on, the speed sample and the script tag; --speed-sample changes the sample
`cloudhost analytics delete [project] [--yes]`	Turn both off and delete every count kept (asks first)
`cloudhost speed [project] [--device mobile\|desktop] [--period <p>] [--route <route>]`	The speed score, the 75th percentile of each web vital with its rating, and the slowest routes

Example

cloudhost analytics enable shop
cloudhost analytics shop --period 30d
cloudhost analytics shop --by referrer --limit 50
cloudhost speed shop --device desktop

Image resizing#

Command	What it does
`cloudhost images [show] [--project <name>]`	An app's image resizing: settings, this month's transformations, the cache
`cloudhost images set [--resizing on\|off] [--widths 640,1080] [--qualities 50,75,90] [--formats webp,avif\|none] [--ttl <seconds>]`	Change image settings; only what you pass changes
`cloudhost images hosts add <host...>`	Allow remote images from a host (img.example.com or *.example.com, https only)
`cloudhost images hosts rm <host...>`	Stop allowing a host
`cloudhost images usage [--days <n>]`	Transformations, cache hits and originals per day
`cloudhost images purge --yes`	Forget every resized image of an app
`cloudhost images team`	Every app's transformations this month and the team's cache

Example

cloudhost images hosts add images.example.com
cloudhost images set --formats webp,avif
cloudhost images usage --days 7

In the dashboard only#

Making and deleting teams, moving an app or function to another team, leaving a team and second-factor settings are in the dashboard only: they need a signed-in person, not an API key.