@django-stack/cli 0.2.0 → 0.4.0

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { D as parseEnv, E as checkTools, O as setEnvValues, S as validateDomain, T as runDoctor, _ as toProjectName, a as decodePreset, b as CLI_VERSION, c as resolvePreset, d as LOCAL_S3, f as lockBackend, g as timeZones, h as scaffold, i as applies, l as stackOption, m as relativeDirectory, n as NAMED_PRESETS, o as encodePreset, r as STACK_OPTIONS, s as pendingChoices, t as DEFAULT_STACK, v as validateProjectName, w as generateSecret, x as productionEnv, y as validateTimeZone } from "./stack-CTyqYWCV.js";
+import { D as parseEnv, E as checkTools, O as setEnvValues, S as validateDomain, T as runDoctor, _ as encodePreset, a as relativeDirectory, b as stackOption, c as toProjectName, d as CLI_VERSION, f as DEFAULT_STACK, g as decodePreset, h as applies, l as validateProjectName, m as STACK_OPTIONS, n as LOCAL_S3, o as scaffold, p as NAMED_PRESETS, r as lockBackend, s as timeZones, u as validateTimeZone, v as pendingChoices, w as generateSecret, x as productionEnv, y as resolvePreset } from "./scaffold-DbgGYEsc.js";
 import { createRequire } from "node:module";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, delimiter, dirname, join, resolve } from "node:path";
@@ -9,6 +9,27 @@ import tab from "@bomb.sh/tab/commander";
 import * as p from "@clack/prompts";
 import { Command, InvalidArgumentError, Option } from "commander";
 import { homedir } from "node:os";
+// src/deploy/provider.ts
+/** The target of a platform with a web API and an API key. */
+function urlTarget(name, placeholder) {
+	return {
+		label: `${name} URL`,
+		placeholder,
+		normalize: normalizeUrl
+	};
+}
+/** Normalizes an instance URL: https by default, no trailing slash or path. */
+function normalizeUrl(value) {
+	const trimmed = value.trim();
+	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+	let parsed;
+	try {
+		parsed = new URL(withScheme);
+	} catch {
+		throw new Error(`${value} is not a URL. Enter one such as https://coolify.example.com.`);
+	}
+	return `${parsed.protocol}//${parsed.host}`;
+}
 // src/deploy/coolify.ts
 /**
 * Coolify (https://coolify.io), through its API at /api/v1 with a bearer
@@ -24,6 +45,21 @@ const PLATFORM_ENV = {
 	HTTP_PORT: "127.0.0.1:8080",
 	HTTPS_PORT: "127.0.0.1:8443"
 };
+/** Setup flags Coolify and Dokploy share; `deploy setup` shows each flag once. */
+const SHARED_SETUP_FLAGS = [
+	{
+		name: "server",
+		description: "The server on the platform, by name or id (Dokploy: dokploy for its own)"
+	},
+	{
+		name: "project",
+		description: "The platform's project, by name or id (default: the project name)"
+	},
+	{
+		name: "environment",
+		description: "The platform's environment (default: production)"
+	}
+];
 var CoolifyError = class extends Error {
 	status;
 	constructor(message, status) {
@@ -57,7 +93,7 @@ var CoolifyApi = class {
 			throw new CoolifyError(`Could not reach Coolify at ${this.url}: ${error.message}`, 0);
 		}
 		const text = await response.text();
-		if (!response.ok) throw new CoolifyError(errorMessage(response.status, text, this.url), response.status);
+		if (!response.ok) throw new CoolifyError(errorMessage$1(response.status, text, this.url), response.status);
 		if (!text) return void 0;
 		try {
 			return JSON.parse(text);
@@ -69,7 +105,7 @@ var CoolifyApi = class {
 	post = (path, body) => this.request("POST", path, body ?? {});
 	patch = (path, body) => this.request("PATCH", path, body);
 };
-function errorMessage(status, text, url) {
+function errorMessage$1(status, text, url) {
 	if (status === 401) return `Coolify at ${url} rejected the API key. Run dstack deploy login to enter a new one.`;
 	if (status === 403) return "The API key may not do this. Give it the read, write and deploy permissions in Coolify under Keys & Tokens.";
 	if (status === 404 && text.includes("<html")) return `${url} does not answer like Coolify; check the URL.`;
@@ -131,7 +167,7 @@ function composeDomains(app) {
 function appUrl(api, link) {
 	return `${api.url}/project/${link.project}/environment/${link.environment}/application/${link.application}`;
 }
-function toDeployment(api, link, item) {
+function toDeployment$1(api, link, item) {
 	const path = item.deployment_url;
 	return {
 		id: item.deployment_uuid,
@@ -145,7 +181,7 @@ function toDeployment(api, link, item) {
 	};
 }
 /** Finds a name or uuid in a list. */
-function find(items, wanted) {
+function find$1(items, wanted) {
 	return items.find((item) => item.uuid === wanted) ?? items.find((item) => item.name === wanted);
 }
 var CoolifyClient = class {
@@ -160,15 +196,16 @@ var CoolifyClient = class {
 	}
 	async setup(context) {
 		const { ask, options } = context;
+		if (!context.repository) throw new Error("Coolify builds from a git repository; pass --repository.");
 		const api = this.api;
 		const servers = await api.get("/servers");
 		if (!servers.length) throw new Error("This Coolify has no servers. Add one in Coolify first.");
 		let server;
 		if (options.server) {
-			server = find(servers, options.server);
+			server = find$1(servers, options.server);
 			if (!server) throw new Error(`Coolify has no server ${options.server}.`);
 		} else if (servers.length === 1) server = servers[0];
-		else server = find(servers, await ask.select("Server to deploy to", servers.map((item) => ({
+		else server = find$1(servers, await ask.select("Server to deploy to", servers.map((item) => ({
 			value: item.uuid,
 			label: item.name,
 			hint: item.ip
@@ -177,7 +214,7 @@ var CoolifyClient = class {
 		const projects = await api.get("/projects");
 		let project;
 		const projectName = options.project ?? context.name;
-		project = find(projects, projectName);
+		project = find$1(projects, projectName);
 		if (!options.project && ask.interactive && projects.length) {
 			const NEW = "";
 			const uuid = await ask.select("Coolify project", [...project ? [] : [{
@@ -188,7 +225,7 @@ var CoolifyClient = class {
 				label: item.name,
 				hint: item.description ?? void 0
 			}))], project?.uuid ?? NEW);
-			project = uuid === NEW ? void 0 : find(projects, uuid);
+			project = uuid === NEW ? void 0 : find$1(projects, uuid);
 		}
 		if (!project) {
 			if (options.project && /^[a-z0-9]{20,}$/.test(options.project)) throw new Error(`Coolify has no project ${options.project}.`);
@@ -202,7 +239,7 @@ var CoolifyClient = class {
 			ask.step(`Created the Coolify project ${projectName}`);
 		}
 		const environmentName = options.environment ?? "production";
-		let environment = find(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
+		let environment = find$1(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
 		if (!environment) {
 			environment = {
 				uuid: (await api.post(`/projects/${enc(project.uuid)}/environments`, { name: environmentName })).uuid,
@@ -212,7 +249,7 @@ var CoolifyClient = class {
 		}
 		let githubApp;
 		if (options.githubApp && options.githubApp !== "public") {
-			const app = find(await api.get("/github-apps"), options.githubApp);
+			const app = find$1(await api.get("/github-apps"), options.githubApp);
 			if (!app) throw new Error(`Coolify has no GitHub App ${options.githubApp}.`);
 			githubApp = app.uuid;
 		} else if (!options.githubApp && ask.interactive) {
@@ -281,11 +318,11 @@ var CoolifyClient = class {
 		return id;
 	}
 	async deployment(link, id) {
-		return toDeployment(this.api, link, await this.api.get(`/deployments/${enc(id)}`));
+		return toDeployment$1(this.api, link, await this.api.get(`/deployments/${enc(id)}`));
 	}
 	async deployments(link, limit) {
 		const result = await this.api.get(`/deployments/applications/${enc(link.application)}?take=${limit}`);
-		return (Array.isArray(result) ? result : result?.deployments ?? []).map((item) => toDeployment(this.api, link, item));
+		return (Array.isArray(result) ? result : result?.deployments ?? []).map((item) => toDeployment$1(this.api, link, item));
 	}
 	async status(link) {
 		const app = await this.api.get(`/applications/${enc(link.application)}`);
@@ -301,28 +338,729 @@ var CoolifyClient = class {
 const coolify = {
 	id: "coolify",
 	name: "Coolify",
-	tokenEnv: "DSTACK_COOLIFY_TOKEN",
+	auth: {
+		kind: "token",
+		env: "DSTACK_COOLIFY_TOKEN",
+		help: (url) => `Create one in Coolify under Keys & Tokens › API tokens (${url}/security/api-tokens) with the read, write and deploy permissions. API access must be on under Settings › Advanced.`
+	},
+	source: "remote",
+	target: urlTarget("Coolify", "https://coolify.example.com"),
 	platformEnv: PLATFORM_ENV,
-	tokenHelp: (url) => `Create one in Coolify under Keys & Tokens › API tokens (${url}/security/api-tokens) with the read, write and deploy permissions. API access must be on under Settings › Advanced.`,
-	setupFlags: [
-		{
-			name: "server",
-			description: "The Coolify server, by name or uuid"
-		},
-		{
-			name: "project",
-			description: "The Coolify project, by name or uuid (default: the project name)"
-		},
-		{
-			name: "environment",
-			description: "The Coolify environment (default: production)"
-		},
-		{
-			name: "githubApp",
-			description: "A Coolify GitHub App for a private repository, or public"
+	setupFlags: [...SHARED_SETUP_FLAGS, {
+		name: "githubApp",
+		description: "A Coolify GitHub App for a private repository, or public"
+	}],
+	connect: (url, token) => {
+		if (!token) throw new Error("Coolify needs an API key.");
+		return new CoolifyClient(url, token);
+	}
+};
+const systemSsh = (args, input) => new Promise((resolve, reject) => {
+	const child = spawn("ssh", args, { stdio: [
+		"pipe",
+		"pipe",
+		"pipe"
+	] });
+	const stdout = [];
+	const stderr = [];
+	child.stdout.on("data", (chunk) => stdout.push(chunk));
+	child.stderr.on("data", (chunk) => stderr.push(chunk));
+	child.on("error", (error) => reject(/* @__PURE__ */ new Error(error.code === "ENOENT" ? "There is no ssh command here. Install OpenSSH." : `Could not run ssh: ${error.message}`)));
+	child.on("close", (code) => resolve({
+		code: code ?? 1,
+		stdout: Buffer.concat(stdout).toString("utf8"),
+		stderr: Buffer.concat(stderr).toString("utf8")
+	}));
+	child.stdin.on("error", () => {});
+	child.stdin.end(input);
+});
+const USER = /^[a-z_][\w.-]*$/i;
+const HOST = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?)(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$|^\[[0-9a-f:.]+\]$/i;
+/** Reads deploy@example.com, example.com:2222 or ssh://deploy@example.com:2222. */
+function parseTarget(value) {
+	const match = value.trim().replace(/^ssh:\/\//i, "").replace(/\/$/, "").match(/^(?:([^@\s]+)@)?(\[[^\]]+\]|[^:@\s]+)(?::(\d+))?$/);
+	const reason = `${value} is not an SSH target. Enter one such as deploy@example.com or deploy@example.com:2222.`;
+	if (!match) throw new Error(reason);
+	const [, user, host = "", port] = match;
+	if (user && !USER.test(user) || !HOST.test(host)) throw new Error(reason);
+	const number = port ? Number(port) : void 0;
+	if (number !== void 0 && (number < 1 || number > 65535)) throw new Error(reason);
+	return {
+		user,
+		host,
+		port: number
+	};
+}
+function formatTarget(target) {
+	return `ssh://${target.user ? `${target.user}@` : ""}${target.host}${target.port ? `:${target.port}` : ""}`;
+}
+/** Quotes a value for the remote POSIX shell. */
+function shellQuote(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** A Compose project name: lower case letters, digits, dashes and underscores. */
+function composeName(name) {
+	return name.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^[^a-z0-9]+|-+$/g, "") || "site";
+}
+/** A deploy id that sorts by time: 20261105-183000-abc1234. */
+function deployId(date, suffix) {
+	const pad = (value) => String(value).padStart(2, "0");
+	return `${`${date.getUTCFullYear()}${pad(date.getUTCMonth() + 1)}${pad(date.getUTCDate())}`}-${`${pad(date.getUTCHours())}${pad(date.getUTCMinutes())}${pad(date.getUTCSeconds())}`}-${suffix}`;
+}
+const ID = /^[\w.-]+$/;
+/** The status file: building, finished or failed, and whether the deploy's process lives. */
+function recordStatus(status, alive) {
+	const value = status.trim();
+	if (value === "finished") return "finished";
+	if (value === "failed") return "failed";
+	if (value === "queued") return alive ? "queued" : "failed";
+	if (value === "building") return alive ? "building" : "failed";
+	return "failed";
+}
+/** `docker compose ps --format json` prints an array (older) or one object per line (newer). */
+function parseComposePs(output) {
+	const text = output.trim();
+	if (!text) return [];
+	if (text.startsWith("[")) return JSON.parse(text);
+	return text.split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
+}
+function composeState(containers) {
+	if (!containers.length) return {
+		state: "stopped",
+		detail: "no containers"
+	};
+	const running = containers.filter((item) => item.State === "running");
+	const unhealthy = containers.filter((item) => item.Health === "unhealthy" || item.State === "restarting");
+	const summary = `${running.length}/${containers.length} running`;
+	if (!running.length) return {
+		state: "stopped",
+		detail: summary
+	};
+	if (unhealthy.length) return {
+		state: "degraded",
+		detail: `${summary}, unhealthy: ${unhealthy.map((item) => item.Service).join(", ")}`
+	};
+	if (running.length < containers.length) return {
+		state: "degraded",
+		detail: `${summary}, not running: ${containers.filter((item) => item.State !== "running").map((item) => item.Service).join(", ")}`
+	};
+	return {
+		state: "running",
+		detail: summary
+	};
+}
+/** Splits the output of a remote command whose parts are separated by MARK lines. */
+const MARK = "--dstack-8f2c--";
+function parts(output) {
+	return output.split(`\n${MARK}\n`);
+}
+/**
+* The script that runs a deploy on the server, detached. It builds and
+* starts the release, moves `current` to it on success and removes the
+* oldest releases beyond KEEP_RELEASES.
+*/
+function deployScript(path, project, id, release, force) {
+	const q = shellQuote;
+	const compose = `docker compose -p ${q(project)}`;
+	return `#!/bin/sh
+set -u
+app=${q(path)}
+status="$app/deploys/${id}.status"
+trap 'rm -rf "$app/deploy.lock"' EXIT
+cd "$app/releases/${release}" || { echo failed > "$status"; exit 1; }
+echo building > "$status"
+echo "Deploy ${id}: release ${release}"
+${force ? `${compose} build --no-cache --pull && ` : ""}${compose} up -d --build --remove-orphans --wait --wait-timeout 600
+code=$?
+if [ "$code" -ne 0 ]; then
+  echo "docker compose exited with $code"
+  ${compose} ps --all
+  echo failed > "$status"
+  exit "$code"
+fi
+ln -sfn "releases/${release}" "$app/current"
+cd "$app/releases"
+ls -1 | sort -r | tail -n +6 | while read -r old; do
+  [ "$old" = ${q(release)} ] || rm -rf -- "$old"
+done
+echo "Started release ${release}"
+echo finished > "$status"
+`;
+}
+var SshClient = class {
+	run;
+	git;
+	target;
+	constructor(target, run = systemSsh, git = defaultGit) {
+		this.run = run;
+		this.git = git;
+		this.target = parseTarget(target);
+	}
+	get destination() {
+		return `${this.target.user ? `${this.target.user}@` : ""}${this.target.host.replace(/^\[|\]$/g, "")}`;
+	}
+	/** Runs a POSIX shell script on the server; fails with a one-line reason. */
+	async sh(script, input) {
+		const args = [
+			"-o",
+			"BatchMode=yes",
+			"-o",
+			"ConnectTimeout=15",
+			...this.target.port ? ["-p", String(this.target.port)] : [],
+			"--",
+			this.destination,
+			`sh -c ${shellQuote(script)}`
+		];
+		const result = await this.run(args, input);
+		if (result.code === 0) return result.stdout;
+		throw new Error(this.errorMessage(result));
+	}
+	errorMessage(result) {
+		const stderr = result.stderr.trim();
+		const where = formatTarget(this.target);
+		if (/REMOTE HOST IDENTIFICATION HAS CHANGED/i.test(stderr)) return `The host key of ${where} changed. If you reinstalled the server, remove the old key with ssh-keygen -R ${this.target.host}; otherwise do not connect.`;
+		if (/Host key verification failed|No .* host key is known/i.test(stderr)) return `${where} is not in your known_hosts yet. Connect once with ssh ${this.destination}${this.target.port ? ` -p ${this.target.port}` : ""}, check the fingerprint and answer yes, then try again.`;
+		if (/Permission denied/i.test(stderr)) return `${where} refused your SSH key. Add it with ssh-copy-id ${this.destination}, or load it into the agent with ssh-add.`;
+		if (result.code === 255) return `Could not connect to ${where}: ${stderr.split("\n").at(-1) || "ssh failed"}`;
+		const last = (stderr || result.stdout.trim()).split("\n").at(-1) ?? "";
+		return `The command on ${where} failed (exit ${result.code})${last ? `: ${last}` : "."}`;
+	}
+	/** Checks the connection and Docker; returns their versions. */
+	async verify() {
+		const output = await this.sh(`
+command -v docker >/dev/null 2>&1 || { echo missing:docker; exit 0; }
+docker compose version --short 2>/dev/null || echo missing:compose
+docker info --format '{{.ServerVersion}}' 2>/dev/null || echo missing:permission
+`);
+		if (output.includes("missing:docker")) throw new Error(`${formatTarget(this.target)} has no Docker. Install Docker Engine with the Compose plugin: https://docs.docker.com/engine/install/`);
+		if (output.includes("missing:compose")) throw new Error(`${formatTarget(this.target)} has Docker without the Compose plugin. Install docker-compose-plugin: https://docs.docker.com/compose/install/linux/`);
+		if (output.includes("missing:permission")) throw new Error(`${this.destination} may not use Docker on the server. Run sudo usermod -aG docker ${this.target.user ?? "$USER"} there and connect again.`);
+		const [compose = "", engine = ""] = output.trim().split("\n");
+		return `Docker ${engine.trim()}, Compose ${compose.trim().replace(/^v/, "")}`;
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		let path = options.path ?? `/srv/${composeName(context.name)}`;
+		if (path.startsWith("~/")) path = `${(await this.sh("printf %s \"$HOME\"")).trim()}/${path.slice(2)}`;
+		if (!path.startsWith("/")) throw new Error(`Give --path as an absolute path, such as /srv/${composeName(context.name)}.`);
+		path = path.replace(/\/+$/, "");
+		const q = shellQuote;
+		if (!(await this.sh(`
+if mkdir -p ${q(`${path}/releases`)} ${q(`${path}/shared`)} ${q(`${path}/deploys`)} 2>/dev/null && [ -w ${q(path)} ]; then echo ok; fi
+`)).includes("ok")) {
+			const home = (await this.sh("printf %s \"$HOME\"")).trim();
+			throw new Error(`${this.destination} cannot write to ${path} on the server. Create it there with sudo mkdir -p ${path} && sudo chown ${this.target.user ?? "$USER"} ${path}, or pass a directory you own, such as --path ${home}/${composeName(context.name)}.`);
+		}
+		ask.step(`Created ${path} on the server`);
+		const project = composeName(context.name);
+		const link = {
+			project: path,
+			environment: "production",
+			application: project
+		};
+		await this.pushEnv({
+			provider: "ssh",
+			url: formatTarget(this.target),
+			...link
+		}, context.env);
+		ask.step("Uploaded the variables as shared/.env");
+		return link;
+	}
+	async pushEnv(link, env) {
+		const text = Object.entries(env).map(([key, value]) => `${key}=${envValue(value)}`).join("\n");
+		const file = shellQuote(`${link.project}/shared/.env`);
+		await this.sh(`umask 077 && cat > ${file}.new && chmod 600 ${file}.new && mv ${file}.new ${file}`, `${text}\n`);
+	}
+	async deploy(link, options) {
+		const { directory } = options;
+		const [commit = "", message = ""] = this.git([
+			"-C",
+			directory,
+			"log",
+			"-1",
+			"--format=%h%n%s"
+		]).toString("utf8").split("\n");
+		const id = deployId(/* @__PURE__ */ new Date(), commit || "local");
+		await this.lock(link, id);
+		const archive = this.git([
+			"-C",
+			directory,
+			"archive",
+			"--format=tar",
+			"HEAD"
+		]);
+		const release = shellQuote(`${link.project}/releases/${id}`);
+		await this.sh(`mkdir -p ${release} && tar -x -C ${release} && ln -sfn ../../shared/.env ${release}/.env`, archive);
+		await this.start(link, {
+			id,
+			release: id,
+			commit,
+			message,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}, options.force);
+		return id;
+	}
+	async rollback(link, to) {
+		const deployments = await this.records(link, 50);
+		const current = (await this.sh(`readlink ${shellQuote(`${link.project}/current`)} || true`)).trim().replace(/^releases\//, "");
+		const releases = new Set((await this.sh(`ls -1 ${shellQuote(`${link.project}/releases`)}`)).split("\n").filter(Boolean));
+		let target;
+		if (to) {
+			target = deployments.find((item) => item.record.id === to)?.record;
+			if (!target) throw new Error(`There is no deploy ${to} on the server.`);
+		} else {
+			target = deployments.find((item) => item.status === "finished" && item.record.release !== current && releases.has(item.record.release))?.record;
+			if (!target) throw new Error("There is no earlier release on the server to roll back to.");
+		}
+		if (!releases.has(target.release)) throw new Error(`The release of ${target.id} is no longer on the server; only the last 5 are kept.`);
+		const id = deployId(/* @__PURE__ */ new Date(), "rollback");
+		await this.lock(link, id);
+		await this.start(link, {
+			id,
+			release: target.release,
+			commit: target.commit,
+			message: `Rollback to ${target.id}`,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			rollbackOf: target.id
+		}, false);
+		return id;
+	}
+	/** Takes the server's deploy lock, or fails when a deploy is running. */
+	async lock(link, id) {
+		const lock = shellQuote(`${link.project}/deploy.lock`);
+		const output = await this.sh(`
+if mkdir ${lock} 2>/dev/null; then echo ${id} > ${lock}/id; echo ok; exit 0; fi
+pid=$(cat ${lock}/pid 2>/dev/null)
+if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then echo "busy:$(cat ${lock}/id 2>/dev/null)"; exit 0; fi
+rm -rf ${lock} && mkdir ${lock} && echo ${id} > ${lock}/id && echo ok
+`);
+		const busy = output.match(/busy:(\S*)/);
+		if (busy) throw new Error(`Deploy ${busy[1]} is still running on the server. Follow it with dstack deploy status --watch.`);
+		if (!output.includes("ok")) throw new Error("Could not take the deploy lock on the server.");
+	}
+	async start(link, record, force) {
+		if (!ID.test(record.id) || !ID.test(record.release)) throw new Error(`Invalid deploy id ${record.id}.`);
+		const deploys = `${link.project}/deploys`;
+		const q = shellQuote;
+		const script = deployScript(link.project, link.application, record.id, record.release, force);
+		await this.sh(`
+cd ${q(deploys)} || exit 1
+cat > ${q(`${record.id}.sh`)}
+printf '%s\\n' ${q(JSON.stringify(record))} > ${q(`${record.id}.json`)}
+echo queued > ${q(`${record.id}.status`)}
+nohup sh ${q(`${record.id}.sh`)} > ${q(`${record.id}.log`)} 2>&1 < /dev/null &
+echo $! > ${q(`${record.id}.pid`)}
+echo $! > ${q(`${link.project}/deploy.lock/pid`)}
+`, script);
+	}
+	/** The newest deploy records first, with their status. */
+	async records(link, limit) {
+		const output = await this.sh(`
+cd ${shellQuote(`${link.project}/deploys`)} 2>/dev/null || exit 0
+for file in $(ls -1 *.json 2>/dev/null | sort -r | head -n ${Math.max(1, Math.floor(limit))}); do
+  id="\${file%.json}"
+  cat "$file"
+  pid=$(cat "$id.pid" 2>/dev/null)
+  if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then alive=1; else alive=0; fi
+  printf '%s %s %s\\n' "$(cat "$id.status" 2>/dev/null || echo failed)" "$alive" "$(date -u -r "$id.status" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"
+  echo ${MARK}
+done
+`);
+		const items = [];
+		for (const part of parts(`\n${output}`)) {
+			const lines = part.trim().split("\n");
+			if (lines.length < 2) continue;
+			try {
+				const record = JSON.parse(lines[0] ?? "");
+				const [status = "", alive = "0", updatedAt] = (lines[1] ?? "").split(" ");
+				items.push({
+					record,
+					status: recordStatus(status, alive === "1"),
+					updatedAt: updatedAt || void 0
+				});
+			} catch {}
+		}
+		return items;
+	}
+	async deployment(link, id) {
+		if (!ID.test(id)) throw new Error(`Invalid deploy id ${id}.`);
+		const deploys = shellQuote(`${link.project}/deploys`);
+		const output = await this.sh(`
+cd ${deploys} || exit 1
+[ -f ${shellQuote(`${id}.json`)} ] || { echo missing; exit 0; }
+cat ${shellQuote(`${id}.json`)}
+pid=$(cat ${shellQuote(`${id}.pid`)} 2>/dev/null)
+if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then alive=1; else alive=0; fi
+printf '%s %s %s\\n' "$(cat ${shellQuote(`${id}.status`)} 2>/dev/null || echo failed)" "$alive" "$(date -u -r ${shellQuote(`${id}.status`)} +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"
+echo ${MARK}
+cat ${shellQuote(`${id}.log`)} 2>/dev/null
+`);
+		if (output.trim() === "missing") throw new Error(`There is no deploy ${id} on the server.`);
+		const [head = "", log = ""] = output.split(`\n${MARK}\n`);
+		const [json = "{}", state = ""] = head.split("\n");
+		const record = JSON.parse(json);
+		const [status = "", alive = "0", updatedAt] = state.split(" ");
+		return {
+			...toDeployment(record, recordStatus(status, alive === "1"), updatedAt || void 0),
+			log: log ? log.replace(/\n$/, "").split("\n").map((text) => ({
+				text,
+				stderr: false
+			})) : []
+		};
+	}
+	async deployments(link, limit) {
+		return (await this.records(link, limit)).map((item) => ({
+			...toDeployment(item.record, item.status, item.updatedAt),
+			log: []
+		}));
+	}
+	async status(link) {
+		const [ps = "", site = ""] = parts(await this.sh(`
+docker compose -p ${shellQuote(link.application)} ps --all --format json
+echo ${MARK}
+sed -n 's/^SITE_URL=//p' ${shellQuote(`${link.project}/shared/.env`)} 2>/dev/null
+`));
+		const { state, detail } = composeState(parseComposePs(ps));
+		const domain = site.trim().replace(/^["']|["']$/g, "");
+		return {
+			state,
+			detail,
+			domains: domain ? [domain] : []
+		};
+	}
+};
+function toDeployment(record, status, updatedAt) {
+	return {
+		id: record.id,
+		status,
+		commit: record.commit,
+		message: record.message,
+		createdAt: record.createdAt,
+		updatedAt
+	};
+}
+/**
+* A value for a Compose .env line: bare when safe, else single-quoted (taken
+* literally), or double-quoted with escapes when it holds a single quote.
+*/
+function envValue(value) {
+	if (/^[\w@%+=:,./-]*$/.test(value)) return value;
+	if (!value.includes("'") && !value.includes("\n")) return `'${value}'`;
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "$$$$").replace(/\n/g, "\\n")}"`;
+}
+function defaultGit(args) {
+	return execFileSync("git", args, {
+		maxBuffer: 1073741824,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+}
+const ssh = {
+	id: "ssh",
+	name: "SSH server",
+	auth: { kind: "ssh" },
+	source: "local",
+	target: {
+		label: "Server",
+		placeholder: "deploy@example.com",
+		normalize: (value) => formatTarget(parseTarget(value))
+	},
+	platformEnv: {},
+	setupFlags: [{
+		name: "path",
+		description: "The project directory on the server (default: /srv/<project>)"
+	}],
+	connect: (target) => new SshClient(target)
+};
+// src/deploy/dokploy.ts
+var DokployError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+var DokployApi = class {
+	url;
+	token;
+	fetchImpl;
+	constructor(url, token, fetchImpl = fetch) {
+		this.url = url;
+		this.token = token;
+		this.fetchImpl = fetchImpl;
+	}
+	async request(method, procedure, input) {
+		let path = `${this.url}/api/${procedure}`;
+		if (method === "GET" && input) {
+			const query = new URLSearchParams();
+			for (const [key, value] of Object.entries(input)) if (value !== void 0) query.set(key, String(value));
+			path += `?${query}`;
+		}
+		let response;
+		try {
+			response = await this.fetchImpl(path, {
+				method,
+				headers: {
+					"x-api-key": this.token,
+					Accept: "application/json",
+					...method === "POST" ? { "Content-Type": "application/json" } : {}
+				},
+				body: method === "POST" ? JSON.stringify(input ?? {}) : void 0,
+				signal: AbortSignal.timeout(3e4)
+			});
+		} catch (error) {
+			throw new DokployError(`Could not reach Dokploy at ${this.url}: ${error.message}`, 0);
+		}
+		const text = await response.text();
+		if (!response.ok) throw new DokployError(errorMessage(response.status, text, this.url), response.status);
+		if (!text) return void 0;
+		try {
+			return JSON.parse(text);
+		} catch {
+			return text;
+		}
+	}
+	get = (procedure, input) => this.request("GET", procedure, input);
+	post = (procedure, input) => this.request("POST", procedure, input);
+};
+function errorMessage(status, text, url) {
+	if (status === 401) return `Dokploy at ${url} rejected the API key. Run dstack deploy login to enter a new one.`;
+	if (status === 403) return "The API key may not do this. Create it as a user who may manage projects in Dokploy.";
+	if (status === 404 && text.includes("<html")) return `${url} does not answer like Dokploy; check the URL.`;
+	let message = "";
+	try {
+		const body = JSON.parse(text);
+		message = body.message ?? body.error?.message ?? "";
+	} catch {
+		message = text.slice(0, 200);
+	}
+	return `Dokploy answered ${status}${message ? `: ${message.trim()}` : "."}`;
+}
+/** A deployment's status: running, done, error or cancelled in Dokploy. */
+function dokployDeploymentStatus(value) {
+	if (value === "done") return "finished";
+	if (value === "running") return "building";
+	if (value === "queued" || value === "idle") return "queued";
+	if (value === "cancelled") return "cancelled";
+	return "failed";
+}
+/** The service state from the compose status, which tracks the last deploy. */
+function dokployAppState(value) {
+	if (value === "done") return "running";
+	if (value === "error") return "degraded";
+	if (value === "idle") return "stopped";
+	return "unknown";
+}
+/** A .env text for Dokploy, which writes it next to compose.yaml. */
+function envText(env) {
+	return Object.entries(env).map(([key, value]) => `${key}=${envValue(value)}`).join("\n");
+}
+function composeUrl(api, link) {
+	return `${api.url}/dashboard/project/${link.project}/environment/${link.environment}/services/compose/${link.application}`;
+}
+/** Finds a name or id in a list. */
+function find(items, wanted, id, name) {
+	return items.find((item) => id(item) === wanted) ?? items.find((item) => name(item) === wanted);
+}
+const LOCAL_SERVER = "dokploy";
+var DokployClient = class {
+	api;
+	constructor(url, token, fetchImpl) {
+		this.api = new DokployApi(url, token, fetchImpl);
+	}
+	async verify() {
+		await this.api.get("project.all");
+		const version = await this.api.get("settings.getDokployVersion").catch(() => void 0);
+		return typeof version === "string" && version.trim() ? version.trim() : "(version unknown)";
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		if (!context.repository) throw new Error("Dokploy builds from a git repository; pass --repository.");
+		const api = this.api;
+		const servers = await api.get("server.all").catch(() => []) ?? [];
+		let serverId;
+		if (options.server && options.server !== LOCAL_SERVER) {
+			const server = find(servers, options.server, (item) => item.serverId, (item) => item.name);
+			if (!server) throw new Error(`Dokploy has no server ${options.server}.`);
+			serverId = server.serverId;
+		} else if (!options.server && servers.length && ask.interactive) {
+			const choice = await ask.select("Server to deploy to", [{
+				value: LOCAL_SERVER,
+				label: "The Dokploy server"
+			}, ...servers.map((item) => ({
+				value: item.serverId,
+				label: item.name,
+				hint: item.ipAddress
+			}))], LOCAL_SERVER);
+			serverId = choice === LOCAL_SERVER ? void 0 : choice;
+		}
+		const projects = await api.get("project.all") ?? [];
+		const projectName = options.project ?? context.name;
+		let project = find(projects, projectName, (item) => item.projectId, (item) => item.name);
+		if (!options.project && ask.interactive && projects.length) {
+			const NEW = "";
+			const id = await ask.select("Dokploy project", [...project ? [] : [{
+				value: NEW,
+				label: `Create ${projectName}`
+			}], ...projects.map((item) => ({
+				value: item.projectId,
+				label: item.name,
+				hint: item.description ?? void 0
+			}))], project?.projectId ?? NEW);
+			project = id === NEW ? void 0 : find(projects, id, (item) => item.projectId, (item) => item.name);
+		}
+		if (!project) {
+			const created = await api.post("project.create", {
+				name: projectName,
+				description: "DjangoStack"
+			});
+			const projectId = created?.project?.projectId ?? created?.projectId;
+			if (!projectId) throw new Error("Dokploy created the project but did not return its id.");
+			project = {
+				projectId,
+				name: projectName
+			};
+			ask.step(`Created the Dokploy project ${projectName}`);
+		}
+		const environmentName = options.environment ?? "production";
+		let environment = find(await api.get("environment.byProjectId", { projectId: project.projectId }).catch((error) => {
+			if (error.status === 404) throw new Error("This Dokploy has no environments; update Dokploy to a version with environments.");
+			throw error;
+		}) ?? [], environmentName, (item) => item.environmentId, (item) => item.name);
+		if (!environment) {
+			const environmentId = (await api.post("environment.create", {
+				name: environmentName,
+				projectId: project.projectId
+			}))?.environmentId ?? (await api.get("environment.byProjectId", { projectId: project.projectId })).find((item) => item.name === environmentName)?.environmentId;
+			if (!environmentId) throw new Error("Dokploy created the environment but did not return its id.");
+			environment = {
+				environmentId,
+				name: environmentName
+			};
+			ask.step(`Created the environment ${environmentName}`);
+		}
+		let composeId = (await api.post("compose.create", {
+			name: context.name,
+			environmentId: environment.environmentId,
+			projectId: project.projectId,
+			composeType: "docker-compose",
+			description: "DjangoStack",
+			...serverId ? { serverId } : {}
+		}))?.composeId;
+		if (!composeId) composeId = ((await api.get("environment.one", { environmentId: environment.environmentId }))?.compose ?? []).filter((item) => item.name === context.name).at(-1)?.composeId;
+		if (!composeId) throw new Error("Dokploy created the compose service but did not return its id.");
+		await api.post("compose.update", {
+			composeId,
+			sourceType: "git",
+			customGitUrl: context.repository,
+			customGitBranch: context.branch,
+			composePath: "./compose.yaml",
+			env: envText(context.env)
+		});
+		ask.step(`Created the compose service ${context.name} from ${context.repository} (${context.branch})`);
+		if (!(await api.get("domain.byComposeId", { composeId }).catch(() => []) ?? []).some((item) => item.host === context.domain)) await api.post("domain.create", {
+			host: context.domain,
+			path: "/",
+			port: 80,
+			https: true,
+			certificateType: "letsencrypt",
+			composeId,
+			serviceName: "proxy",
+			domainType: "compose"
+		});
+		ask.step(`Gave the proxy service https://${context.domain}`);
+		return {
+			project: project.projectId,
+			environment: environment.environmentId,
+			application: composeId
+		};
+	}
+	async pushEnv(link, env) {
+		await this.api.post("compose.update", {
+			composeId: link.application,
+			env: envText(env)
+		});
+	}
+	async deploy(link) {
+		const before = new Set((await this.raw(link)).map((item) => item.deploymentId));
+		await this.api.post("compose.deploy", {
+			composeId: link.application,
+			title: "dstack deploy"
+		});
+		for (let attempt = 0; attempt < 20; attempt++) {
+			const fresh = (await this.raw(link)).find((item) => !before.has(item.deploymentId));
+			if (fresh) return fresh.deploymentId;
+			await new Promise((resolve) => setTimeout(resolve, this.pollMs));
 		}
-	],
-	connect: (url, token) => new CoolifyClient(url, token)
+		throw new Error(`Dokploy took the deploy but shows no deployment for it yet. See ${composeUrl(this.api, link)}`);
+	}
+	/** How long `deploy` waits between looks for the new deployment; tests set it to 0. */
+	pollMs = 1e3;
+	/** The deployments, newest first. */
+	async raw(link) {
+		return [...await this.api.get("deployment.allByCompose", { composeId: link.application }) ?? []].sort((a, b) => String(b.createdAt ?? "").localeCompare(String(a.createdAt ?? "")));
+	}
+	toDeployment(link, item) {
+		const status = dokployDeploymentStatus(item.status);
+		const url = composeUrl(this.api, link);
+		return {
+			id: item.deploymentId,
+			status,
+			message: item.title && item.title !== "dstack deploy" ? item.title : (item.description ?? void 0) || void 0,
+			createdAt: item.createdAt,
+			updatedAt: item.finishedAt ?? item.startedAt ?? void 0,
+			url,
+			log: [...item.errorMessage ? [{
+				text: item.errorMessage,
+				stderr: true
+			}] : [], {
+				text: `Dokploy shows the build log in its dashboard: ${url} (Deployments)`,
+				stderr: false
+			}]
+		};
+	}
+	async deployment(link, id) {
+		const item = (await this.raw(link)).find((deployment) => deployment.deploymentId === id);
+		if (!item) throw new Error(`Dokploy has no deployment ${id} for this service.`);
+		return this.toDeployment(link, item);
+	}
+	async deployments(link, limit) {
+		return (await this.raw(link)).slice(0, limit).map((item) => ({
+			...this.toDeployment(link, item),
+			log: []
+		}));
+	}
+	async status(link) {
+		const compose = await this.api.get("compose.one", { composeId: link.application });
+		const domains = (compose.domains ?? []).map((item) => `${item.https === false ? "http" : "https"}://${item.host}`);
+		return {
+			state: dokployAppState(compose.composeStatus),
+			detail: compose.composeStatus ?? "unknown",
+			domains,
+			branch: compose.customGitBranch ?? void 0,
+			url: composeUrl(this.api, link)
+		};
+	}
+};
+const dokploy = {
+	id: "dokploy",
+	name: "Dokploy",
+	auth: {
+		kind: "token",
+		env: "DSTACK_DOKPLOY_TOKEN",
+		help: (url) => `Create one in Dokploy under Settings › Profile › API/CLI (${url}/dashboard/settings/profile), as a user who may create projects.`
+	},
+	source: "remote",
+	target: urlTarget("Dokploy", "https://dokploy.example.com"),
+	platformEnv: PLATFORM_ENV,
+	setupFlags: SHARED_SETUP_FLAGS,
+	connect: (url, token) => {
+		if (!token) throw new Error("Dokploy needs an API key.");
+		return new DokployClient(url, token);
+	}
 };
 // src/deploy/credentials.ts
 /**
@@ -523,23 +1261,27 @@ function unpushedReason(directory, branch) {
 		`refs/remotes/origin/${branch}`
 	]) === void 0) return `Your last commit is not on origin/${branch}, so the deploy would not include it. Push first: git push`;
 }
-// src/deploy/provider.ts
-/** Normalizes an instance URL: https by default, no trailing slash or path. */
-function normalizeUrl(value) {
-	const trimmed = value.trim();
-	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
-	let parsed;
-	try {
-		parsed = new URL(withScheme);
-	} catch {
-		throw new Error(`${value} is not a URL. Enter one such as https://coolify.example.com.`);
-	}
-	return `${parsed.protocol}//${parsed.host}`;
+/**
+* Why an upload of HEAD would not match the working tree, or undefined when
+* it does. Providers that upload the local commit deploy HEAD only, so
+* changes to tracked files must be committed first.
+*/
+function uncommittedReason(directory) {
+	if (git(directory, ["rev-parse", "HEAD"]) === void 0) return "This project has no commit yet. Commit it first: git add -A && git commit";
+	if (git(directory, [
+		"status",
+		"--porcelain",
+		"--untracked-files=no"
+	])) return "You have uncommitted changes, so the deploy would not include them. Commit first.";
 }
 // src/deploy/index.ts
 const DEFAULT_PROVIDER = coolify;
 /** Every deploy provider. */
-const PROVIDERS = [coolify];
+const PROVIDERS = [
+	coolify,
+	dokploy,
+	ssh
+];
 function getProvider(id) {
 	const provider = PROVIDERS.find((item) => item.id === id);
 	if (!provider) throw new Error(`Unknown deploy provider ${id}. Choose one of: ${PROVIDERS.map((p) => p.id).join(", ")}.`);
@@ -822,8 +1564,13 @@ function deployEnv(directory, provider) {
 		...provider.platformEnv
 	};
 }
+/** The API key settings of a provider, or a one-line failure for one that uses SSH. */
+function tokenAuth(provider) {
+	if (provider.auth.kind !== "token") fail(`${provider.name} uses your SSH keys and ~/.ssh/config; there is no API key to save.`);
+	return provider.auth;
+}
 async function askToken(provider, instance) {
-	p.log.info(provider.tokenHelp(instance));
+	p.log.info(tokenAuth(provider).help(instance));
 	return unwrap(await p.password({
 		message: `${provider.name} API key`,
 		validate: (value) => value?.trim() ? void 0 : "Paste the API key."
@@ -836,14 +1583,15 @@ async function login(provider, instance, token) {
 	const version = await attempt(provider.connect(instance, token).verify(), spinner);
 	spinner.stop(`${provider.name} ${version} accepts the key`);
 	if (saveToken(provider.id, instance, token) === "keychain") p.log.success("Saved the key in the system keychain.");
-	else p.log.warn(`There is no system keychain here, so the key is in ~/.config/dstack/credentials.json, readable only by you. Set ${provider.tokenEnv} instead to keep it off disk.`);
+	else p.log.warn(`There is no system keychain here, so the key is in ~/.config/dstack/credentials.json, readable only by you. Set ${tokenAuth(provider).env} instead to keep it off disk.`);
 	return token;
 }
-/** A client for a provider instance: the saved key, or a new one when the CLI may ask. */
+/** A client for a provider target: the saved key, or a new one when the CLI may ask. */
 async function connect(provider, instance, interactive) {
-	const saved = getToken(provider.id, instance, provider.tokenEnv);
+	if (provider.auth.kind === "ssh") return attempt(Promise.resolve().then(() => provider.connect(instance)));
+	const saved = getToken(provider.id, instance, provider.auth.env);
 	if (saved) return provider.connect(instance, saved.token);
-	if (!interactive) fail(`No ${provider.name} API key for ${instance}. Run ${command("dstack deploy login")} or set ${provider.tokenEnv}.`);
+	if (!interactive) fail(`No ${provider.name} API key for ${instance}. Run ${command("dstack deploy login")} or set ${provider.auth.env}.`);
 	const token = await login(provider, instance, await askToken(provider, instance));
 	return provider.connect(instance, token);
 }
@@ -906,11 +1654,11 @@ async function deploySetup(options) {
 	if (!instance) {
 		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
 		instance = unwrap(await p.text({
-			message: `${provider.name} URL`,
-			placeholder: "https://coolify.example.com",
+			message: provider.target.label,
+			placeholder: provider.target.placeholder,
 			validate: (value) => {
 				try {
-					normalizeUrl(value ?? "");
+					provider.target.normalize(value ?? "");
 				} catch (error) {
 					return error.message;
 				}
@@ -918,7 +1666,7 @@ async function deploySetup(options) {
 		}));
 	}
 	try {
-		instance = normalizeUrl(instance);
+		instance = provider.target.normalize(instance);
 	} catch (error) {
 		fail(error.message);
 	}
@@ -926,15 +1674,17 @@ async function deploySetup(options) {
 	const domain = (env.SITE_URL ?? "").replace(/^https?:\/\//, "").replace(/\/.*$/, "");
 	if (!domain || domain.endsWith("localhost")) fail(`SITE_URL in ${PRODUCTION_ENV} is not a public domain. Run ${command("dstack production --domain example.com --force")}.`);
 	let repository = options.repository;
-	if (!repository) {
-		const remote = gitRemote(project.directory);
-		if (!remote) fail("This project has no git remote origin. Push it to GitHub first, or pass --repository.");
-		repository = remote;
-	}
-	try {
-		repository = httpsRepository(repository);
-	} catch (error) {
-		fail(error.message);
+	if (provider.source === "remote") {
+		if (!repository) {
+			const remote = gitRemote(project.directory);
+			if (!remote) fail("This project has no git remote origin. Push it to GitHub first, or pass --repository.");
+			repository = remote;
+		}
+		try {
+			repository = httpsRepository(repository);
+		} catch (error) {
+			fail(error.message);
+		}
 	}
 	const branch = options.branch ?? gitBranch(project.directory) ?? "main";
 	const client = await connect(provider, instance, interactive);
@@ -957,12 +1707,12 @@ async function deploySetup(options) {
 	};
 	writeLink(project.directory, link);
 	p.log.success(`Wrote ${pc.bold(LINK_FILE)}. It holds no secrets; commit it so others deploy to the same place.`);
-	p.note([`Point the DNS of ${pc.bold(domain)} at the ${provider.name} server.`, `Change variables in ${provider.name}, or in ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.`].join("\n"), "Next");
+	p.note([`Point the DNS of ${pc.bold(domain)} at the ${provider.auth.kind === "ssh" ? "" : `${provider.name} `}server.`, provider.auth.kind === "ssh" ? `To change variables, edit ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.` : `Change variables in ${provider.name}, or in ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.`].join("\n"), "Next");
 	if (options.deploy ?? (interactive ? unwrap(await p.confirm({
 		message: "Deploy now?",
 		initialValue: true
 	})) : false)) {
-		await startDeploy(project.directory, link, client, {
+		await startDeploy(project.directory, provider, link, client, {
 			force: false,
 			wait: true
 		});
@@ -1011,16 +1761,27 @@ async function follow(link, client, id) {
 	else spinner.error(summary);
 	return deployment;
 }
-async function startDeploy(directory, link, client, options) {
+/** Why the deploy would not include the local work, or undefined. */
+async function notDeployedReason(directory, provider, link, client) {
+	if (provider.source === "local") return uncommittedReason(directory);
+	const status = await attempt(client.status(link));
+	return status.branch ? unpushedReason(directory, status.branch) : void 0;
+}
+async function startDeploy(directory, provider, link, client, options) {
 	if (options.pushCheck !== false) {
-		const status = await attempt(client.status(link));
-		const reason = status.branch ? unpushedReason(directory, status.branch) : void 0;
+		const reason = await notDeployedReason(directory, provider, link, client);
 		if (reason) fail(`${reason} Or pass --no-push-check.`);
 	}
-	const id = await attempt(client.deploy(link, { force: options.force }));
-	if (!options.wait) {
+	await finishDeploy(link, client, await attempt(client.deploy(link, {
+		force: options.force,
+		directory
+	})), options.wait);
+}
+/** Follows a started deploy, or reports where it runs when not waiting. */
+async function finishDeploy(link, client, id, wait) {
+	if (!wait) {
 		const deployment = await attempt(client.deployment(link, id));
-		p.outro(`Started deploy ${pc.bold(id)}: ${url(deployment.url ?? link.url)}`);
+		p.outro(`Started deploy ${pc.bold(id)}${deployment.url ? `: ${url(deployment.url)}` : ""}. Follow it with ${command("dstack deploy status --watch")}`);
 		return;
 	}
 	p.log.message(pc.dim("Ctrl+C stops following; the deploy goes on."));
@@ -1039,7 +1800,7 @@ async function deploy(options) {
 	const provider = providerOrFail(link.provider);
 	intro(`Deploy to ${provider.name}`);
 	const client = await connect(provider, link.url, isInteractive(options.yes));
-	await startDeploy(project.directory, link, client, {
+	await startDeploy(project.directory, provider, link, client, {
 		force: Boolean(options.force),
 		wait: options.wait,
 		pushCheck: options.pushCheck
@@ -1110,6 +1871,17 @@ async function deployLogs(id, options) {
 	process.stderr.write(pc.dim(`Deploy ${deployment.id}: ${deployment.status}\n`));
 	if (deployment.status === "failed") process.exitCode = 1;
 }
+/** `dstack deploy rollback [deployment]`: run an earlier release again. */
+async function deployRollback(id, options) {
+	const link = linkOrFail(projectOrFail(options).directory);
+	const provider = providerOrFail(link.provider);
+	intro(`Roll back on ${provider.name}`);
+	const client = await connect(provider, link.url, isInteractive(options.yes));
+	if (!client.rollback) fail(`${provider.name} keeps no releases to roll back to. Deploy an earlier commit, or roll back in ${provider.name}.`);
+	const rollbackId = await attempt(client.rollback(link, id));
+	p.log.info(pc.dim("The database is not rolled back; migrations of the newer release stay applied."));
+	await finishDeploy(link, client, rollbackId, options.wait);
+}
 /** `dstack deploy env push`: upload .env.production to the platform again. */
 async function deployEnvPush(options) {
 	const project = projectOrFail(options);
@@ -1128,18 +1900,19 @@ async function loginTarget(options, interactive) {
 		link = readLink(readProject(options.dir ?? ".").directory);
 	} catch {}
 	const provider = providerOrFail(options.provider ?? link?.provider ?? DEFAULT_PROVIDER.id);
+	tokenAuth(provider);
 	let instance = options.url ?? link?.url;
 	if (!instance) {
 		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
 		instance = unwrap(await p.text({
-			message: `${provider.name} URL`,
-			placeholder: "https://coolify.example.com"
+			message: provider.target.label,
+			placeholder: provider.target.placeholder
 		}));
 	}
 	try {
 		return {
 			provider,
-			instance: normalizeUrl(instance)
+			instance: provider.target.normalize(instance)
 		};
 	} catch (error) {
 		fail(error.message);
@@ -1150,9 +1923,10 @@ async function deployLogin(options) {
 	const interactive = isInteractive(options.yes);
 	intro("Deploy login");
 	const { provider, instance } = await loginTarget(options, interactive);
-	let token = options.token ?? (options.yes ? process.env[provider.tokenEnv] : void 0);
+	const auth = tokenAuth(provider);
+	let token = options.token ?? (options.yes ? process.env[auth.env] : void 0);
 	if (!token) {
-		if (!interactive) fail(`Pass --token or set ${provider.tokenEnv}.`);
+		if (!interactive) fail(`Pass --token or set ${auth.env}.`);
 		token = await askToken(provider, instance);
 	}
 	await login(provider, instance, token);
@@ -1263,7 +2037,7 @@ function updateCommand(location = import.meta.url, env = process.env) {
 	if (path.includes("/pnpm/global/")) return `pnpm add -g ${PACKAGE_NAME}@latest`;
 	if (path.includes("/.bun/install/global/")) return `bun add -g ${PACKAGE_NAME}@latest`;
 	if (env.npm_config_user_agent?.startsWith("pnpm")) return `pnpm add -g ${PACKAGE_NAME}@latest`;
-	return `npm install -g ${PACKAGE_NAME}@latest`;
+	return `npm i -g ${PACKAGE_NAME}@latest`;
 }
 // src/global-install.ts
 /** The name of the installed command. */
@@ -1309,8 +2083,8 @@ function installCommand(runner = "npm") {
 	];
 	return [
 		"npm",
-		"install",
-		"--global",
+		"i",
+		"-g",
 		`${PACKAGE_NAME}@latest`
 	];
 }
@@ -1572,7 +2346,7 @@ async function init(directoryArgument, options) {
 		result = scaffold({
 			directory: target,
 			name,
-			frontend: "astro",
+			frontend: stack.frontend,
 			demoContent,
 			databaseUrl,
 			localS3: stack.storage === "s3",
@@ -1986,7 +2760,7 @@ function checkSteps(project, tests) {
 			devOnly: true
 		},
 		{
-			name: "Astro check",
+			name: "Frontend check",
 			service: "frontend",
 			args: [
 				"npm",
@@ -2227,9 +3001,9 @@ function createProgram() {
 	program.command("restore").description("Restore a backup over the database or the media (prod profile)").argument("<backup>", "A file name from `dstack backup --list`").addOption(dirOption()).option("--media", "Also restore the media backed up with this database dump").option("-y, --yes", "Don't ask for confirmation").action(restore);
 	program.command("types").description("Generate the frontend's API types from the backend's schema").addOption(dirOption()).action(types);
 	const providerOption = () => new Option("--provider <provider>", `The platform (default: ${DEFAULT_PROVIDER.id})`).choices(PROVIDERS.map((provider) => provider.id));
-	const deployCommand = program.command("deploy").description("Deploy to a platform such as Coolify, and show the status");
-	deployCommand.command("start", { isDefault: true }).description("Start a deploy and follow it; the same as `dstack deploy`").addOption(dirOption()).option("--force", "Rebuild the images without cache").option("--no-wait", "Don't follow the deploy; return once it started").option("--no-push-check", "Deploy even when the last commit is not pushed").option("-y, --yes", "Don't ask; fail when no API key is saved").action(deploy);
-	const setupCommand = deployCommand.command("setup").description("Create the project on the platform and link it to this directory").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address, such as https://coolify.example.com").option("--repository <url>", "The git repository the platform builds (default: the origin remote)").option("--branch <branch>", "The branch to deploy (default: the current one)").option("--deploy", "Deploy when done").option("--no-deploy", "Don't offer to deploy when done").option("--force", `Set up again, replacing the link in .dstack/deploy.json`).option("-y, --yes", "Don't ask; use the flags and the defaults").action(deploySetup);
+	const deployCommand = program.command("deploy").description("Deploy to Coolify, Dokploy or a server over SSH, and show the status");
+	deployCommand.command("start", { isDefault: true }).description("Start a deploy and follow it; the same as `dstack deploy`").addOption(dirOption()).option("--force", "Rebuild the images without cache").option("--no-wait", "Don't follow the deploy; return once it started").option("--no-push-check", "Deploy even when it would not include your local commits or changes").option("-y, --yes", "Don't ask; fail when no API key is saved").action(deploy);
+	const setupCommand = deployCommand.command("setup").description("Create the project on the platform and link it to this directory").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address, such as https://coolify.example.com, or the server, such as deploy@example.com").option("--repository <url>", "The git repository the platform builds (default: the origin remote)").option("--branch <branch>", "The branch to deploy (default: the current one)").option("--deploy", "Deploy when done").option("--no-deploy", "Don't offer to deploy when done").option("--force", `Set up again, replacing the link in .dstack/deploy.json`).option("-y, --yes", "Don't ask; use the flags and the defaults").action(deploySetup);
 	const seen = /* @__PURE__ */ new Set();
 	for (const flag of PROVIDERS.flatMap((provider) => provider.setupFlags)) {
 		if (seen.has(flag.name)) continue;
@@ -2239,6 +3013,7 @@ function createProgram() {
 	}
 	deployCommand.command("status").description("Show the state of the site and the last deploys").addOption(dirOption()).option("-n, --limit <count>", "How many deploys to list", "5").option("--watch", "Follow a running deploy until it ends").action(deployStatus);
 	deployCommand.command("logs").description("Print the build log of a deploy").argument("[deployment]", "A deploy id from `dstack deploy status` (default: the latest)").addOption(dirOption()).action(deployLogs);
+	deployCommand.command("rollback").description("Run an earlier release again (servers over SSH)").argument("[deployment]", "A deploy id from `dstack deploy status` (default: the one before the running one)").addOption(dirOption()).option("--no-wait", "Don't follow the rollback; return once it started").option("-y, --yes", "Don't ask").action(deployRollback);
 	deployCommand.command("env").description("Manage the platform's environment variables").command("push").description("Replace the platform's variables with .env.production").addOption(dirOption()).option("-y, --yes", "Don't ask for confirmation").action(deployEnvPush);
 	deployCommand.command("login").description("Check and save an API key in the system keychain").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address (default: the one in .dstack/deploy.json)").option("--token <token>", "The API key (default: ask, or the provider's environment variable with --yes)").option("-y, --yes", "Don't ask").action(deployLogin);
 	deployCommand.command("logout").description("Remove a saved API key").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address (default: the one in .dstack/deploy.json)").action(deployLogout);