@studiometa/forge-cli 0.4.6 → 0.4.7

package/README.md

@@ -46,7 +46,7 @@ forge <command> [subcommand] [options]
 | `config`          |         | Manage CLI configuration (`set`, `get`, `delete`)    |
 | `servers`         | `s`     | List, get, reboot servers                            |
 | `sites`           |         | List, get sites on a server                          |
-| `deployments`     | `d`     | List deployments, trigger deploys                    |
+| `deployments`     | `d`     | List deployments, trigger deploys, deploy script     |
 | `databases`       | `db`    | List, get databases on a server                      |
 | `database-users`  |         | List, get, create, delete database users on a server |
 | `daemons`         |         | List, get, restart daemons on a server               |
@@ -57,10 +57,11 @@ forge <command> [subcommand] [options]
 | `env`             |         | Get, update environment variables for a site         |
 | `nginx`           |         | Get, update Nginx configuration for a site           |
 | `nginx-templates` |         | List, get, create, update, delete Nginx templates    |
+| `php`             |         | PHP versions, config files, limits and OPcache       |
 | `certificates`    | `certs` | List, get, activate SSL certificates for a site      |
 | `firewall-rules`  | `fw`    | List, get firewall rules on a server                 |
 | `ssh`             |         | Open an SSH session to a server                      |
-| `ssh-keys`        |         | List, get SSH keys on a server                       |
+| `ssh-keys`        |         | List, get, sync SSH keys on servers                  |
 | `security-rules`  |         | List, get, create, delete security rules for a site  |
 | `redirect-rules`  |         | List, get, create, delete redirect rules for a site  |
 | `recipes`         |         | List, get, run recipes                               |
@@ -132,12 +133,37 @@ forge sites get <site_id> --server <id>     # Get site details
 ### `deployments` (`d`) — Manage deployments
 
 ```bash
-forge deployments list --server <id> --site <id>    # List deployments
-forge deployments deploy --server <id> --site <id>  # Trigger a deployment
+forge deployments list --server <id> --site <id>                          # List deployments
+forge deployments deploy --server <id> --site <id>                        # Trigger a deployment
+forge deployments deploy --server <id> --site <id> --script-file deploy.sh  # Upload the script, then deploy
+forge deployments logs [id] --server <id> --site <id>                     # Show deployment output (latest if no id)
+forge deployments script --server <id> --site <id>                        # Print the deployment script
+forge deployments update-script --server <id> --site <id> --file deploy.sh  # Update the script from a file
+forge deployments update-script --server <id> --site <id> --file -        # Update the script from stdin
+forge deployments update-script --server <id> --site <id> --content "..." # Update the script from a string
+forge deployments update-script --server <id> --site <id> --file deploy.sh --check  # Compare only, do not write
 ```
 
 The `deploy` command waits for deployment to complete, showing live progress. On completion it prints the deployment log and elapsed time.
 
+Keep the deployment script in your repository: `update-script` takes exactly one of `--file` or `--content` and rejects an empty script. With `deploy --script-file`, the script is uploaded first; if the upload fails, the deployment does not start and the command exits non-zero.
+
+#### Detect drift in CI with `--check`
+
+`--check` on `deployments update-script`, `env update`, `nginx update` and `php update-config` compares your local file with the content on Forge and does not write anything. Line endings (CRLF and LF) and a single trailing newline are ignored.
+
+- In sync: prints "in sync" and exits `0`.
+- Different: prints a unified line diff (`-` remote, `+` local) and exits `1`.
+- With `--format json`: prints `{ "inSync": true }` or `{ "inSync": false, "diff": "..." }`.
+
+Run it in a pipeline to fail the job when someone changed the deployment script in the Forge UI:
+
+```bash
+forge deployments update-script --server 123 --site 456 --file deploy.sh --check
+```
+
+For `env update --check`, the comparison uses variables, not text: comments, blank lines and order are ignored. The output gives only variable names (added, removed, changed) and never values, in human and json formats (`{ "inSync": false, "diff": { "added": [], "removed": [], "changed": [] } }`), because CI logs are often visible to the whole team.
+
 ### `databases` (`db`) — Manage databases
 
 ```bash
@@ -157,16 +183,46 @@ forge daemons restart <daemon_id> --server <id>     # Restart a daemon
 
 ```bash
 forge env get --server <id> --site <id>                             # Get .env content
-forge env update --server <id> --site <id> --content "KEY=value"    # Update .env
+forge env update --server <id> --site <id> --file .env              # Update .env from a file
+forge env update --server <id> --site <id> --file -                 # Update .env from stdin
+forge env update --server <id> --site <id> --content "KEY=value"    # Update .env from a string
+forge env update --server <id> --site <id> --file .env --check      # Compare variable names only, do not write
 ```
 
+`update` takes exactly one of `--file` or `--content` and rejects empty content. Prefer `--file`: a value given with `--content` stays in your shell history.
+
 ### `nginx` — Manage Nginx configuration
 
 ```bash
 forge nginx get --server <id> --site <id>                               # Get Nginx config
-forge nginx update --server <id> --site <id> --content "server { ... }" # Update Nginx config
+forge nginx update --server <id> --site <id> --file nginx.conf          # Update Nginx config from a file
+forge nginx update --server <id> --site <id> --file -                   # Update Nginx config from stdin
+forge nginx update --server <id> --site <id> --content "server { ... }" # Update Nginx config from a string
+forge nginx update --server <id> --site <id> --file nginx.conf --check  # Compare only, do not write
+```
+
+`update` takes exactly one of `--file` or `--content` and rejects empty content.
+
+### `php` — Manage PHP
+
+```bash
+forge php list --server <id>                                                        # List installed PHP versions
+forge php config --server <id> --version 8.3 --type fpm                             # Print the FPM php.ini
+forge php config --server <id> --version 8.3 --type pool --user forge               # Print the FPM pool config
+forge php update-config --server <id> --version 8.3 --type cli --file php.ini       # Replace the CLI php.ini from a file
+forge php update-config --server <id> --version 8.3 --type fpm --file -             # Replace the FPM php.ini from stdin
+forge php update-config --server <id> --version 8.3 --type fpm --file php.ini --check  # Compare only, do not write
+forge php max-upload-size --server <id>                                             # Print the max upload size (MB)
+forge php set-max-upload-size 128 --server <id>                                     # Set the max upload size (MB)
+forge php max-execution-time --server <id>                                          # Print the max execution time (seconds)
+forge php set-max-execution-time 120 --server <id>                                  # Set the max execution time (seconds)
+forge php opcache --server <id>                                                     # Print the OPcache status
+forge php enable-opcache --server <id>                                              # Enable OPcache
+forge php disable-opcache --server <id>                                             # Disable OPcache
 ```
 
+`--version` takes a PHP version ID from `forge php list`, or a version such as `8.3`, `php83` or `php8.3`. `--type` is `cli` (CLI php.ini), `fpm` (FPM php.ini) or `pool` (FPM pool); `--user` applies to `pool` only. `update-config` replaces the whole file, takes exactly one of `--file` or `--content`, rejects empty content and supports `--check` (see [Detect drift in CI with `--check`](#detect-drift-in-ci-with---check)).
+
 ### `certificates` (`certs`) — Manage SSL certificates
 
 ```bash
@@ -200,8 +256,14 @@ Requires your local SSH key to be authorized on the server; this command launche
 ```bash
 forge ssh-keys list --server <id>               # List SSH keys
 forge ssh-keys get <key_id> --server <id>       # Get SSH key details
+forge ssh-keys sync --file keys --server <id> --dry-run     # Show what sync would change
+forge ssh-keys sync --file keys --server 1,2 --server web-3 # Add the missing keys
+forge ssh-keys sync --file keys --all-servers --prune       # Also remove keys not in the file
+forge ssh-keys sync --file - --server <id> --user deploy    # Read the keys from stdin, for user deploy
 ```
 
+`sync` makes the SSH keys of a server user (`--user`, default `forge`) match a file in `authorized_keys` format: one `<type> <base64> [comment]` per line, blank lines and `#` comments ignored. A malformed line stops the command with its line number. Each key gets the name `<comment slug>-<first 8 hex chars of the SHA-256 of the key>`. The Forge API does not return public keys, so keys are matched by name, and a changed key gets a new name. The command prints the plan per server (`+` add, `-` remove, `=` unchanged), applies it, then prints the result. It only adds keys, unless you give `--prune`; `--dry-run` changes nothing. Servers run one after the other. When an operation fails, the other operations still run and the command exits non-zero. When an add fails on a server, the removals on that server are skipped, so nobody loses access. `--format json` prints one document, `{ dry_run, servers: [{ id, name, added, removed, unchanged, errors }] }`. With `--dry-run`, `dry_run` is `true` and `added` and `removed` hold the planned changes.
+
 ### `recipes` — Manage recipes
 
 ```bash