CLI (oneend)

oneend login

Log in with a personal access token

Usage

oneend login [--token <token>] [--api-url <url>]

Make a token in the console under Account, API and MCP tokens (/account/tokens).
Without --token it asks in a terminal, and reads standard input otherwise:
echo "$TOKEN" | oneend login
The token is saved to ~/.config/oneend/config.json, readable only by you (0600).

Flags

No flags of its own.

oneend logout

Remove the saved token

Usage

oneend logout

It does not revoke the token itself. Revoke it in the console at /account/tokens.

Flags

No flags of its own.

oneend whoami

Show the current account

Usage

oneend whoami

Flags

No flags of its own.

oneend projects list

List projects

Usage

oneend projects list

Flags

No flags of its own.

oneend projects create

Create a project

Usage

oneend projects create <name> [--region <code>] [--org <org>] [--tier <size>] [--repo <owner/name>] [--root <folder>] [--branch <branch>] [--link] [--no-wait]

The same as the console's new-project screen (MCP create_project). Region, the size of a server of its own and a GitHub repository are chosen in one go.
--tier is a size code oneend server-sizes shows (for example 4gb), or default (the plan's own size). Left out, the project starts on the shared server, and the project is made even when the server request is refused.
--repo is a repository the GitHub App can see. It is connected and its first deployment started right after the project is made, and unless you pass --no-wait the build log is shown until it ends.
For a monorepo pass the app folder with --root and the environment variables with --env-file.

Arguments 1

Flags

oneend projects transfer

Transfer a project to another organization (without --to, lists where it can go)

Usage

oneend projects transfer [<ref>] [--to <org id or name>] [--yes]

You must be an owner of the current organization and an owner or admin of the receiving one, and the receiving plan must have room for another project. From the move on, usage is billed to the receiving organization, so this month's bill splits at that moment. Access given to members of the old organization is removed. Addresses, keys, data and deployments stay as they are (the same as Transfer project in the console and MCP transfer_project).

Arguments 0 to 1

Flags

oneend projects pause

Pause a project (its data is kept)

Usage

oneend projects pause [--project <ref>]

The site, API and functions answer 503, and scheduled jobs and new deployments stop. oneend projects resume turns it straight back on.

Flags

No flags of its own.

oneend projects resume

Resume a paused project

Usage

oneend projects resume [--project <ref>]

A project the Free plan paused after 3 unused days is turned back on with this command too (or with a new deployment).

Flags

No flags of its own.

oneend link

Link this folder to a project

Usage

oneend link [--project <ref>] [--app <repo>]

Creates .oneend/project.json. It holds no secrets, so it can be committed.

Flags

oneend unlink

Unlink this folder

Usage

oneend unlink

Flags

No flags of its own.

oneend status

Show login, linked project, latest deployment and migrations

Usage

oneend status

Flags

No flags of its own.

oneend billing

A month's bill: each line's amount, the list price and what is charged

Usage

oneend billing [--period <YYYY-MM>]

Flags

oneend server-sizes

List server sizes and their monthly price per region

Usage

oneend server-sizes [--region <code>] [--currency KRW|USD]

With no currency, the organisation's billing currency. Won include VAT; tax is added to dollars at checkout.
Regions marked coming soon cannot be chosen yet.

Flags

oneend projects archive

Where the project's database stands on the way to archive storage

Usage

oneend projects archive [--project <ref>]

A database unusable for 90 days is moved to archive storage and can be restored for a year. oneend projects archive restore restores it.

Flags

No flags of its own.

oneend projects archive restore

Restore an archived database

Usage

oneend projects archive restore [--project <ref>]

Makes it again exactly as it was archived. Usually a few minutes; a paused project starts again with the restore. Refused while a payment is outstanding or on the Free plan.

Flags

No flags of its own.

oneend projects archive download

Create an address to download the archive from (for an hour)

Usage

oneend projects archive download --reason <reason> [--project <ref>]

In pg_dump format: pg_restore puts it into any PostgreSQL. The reason is kept in the access records.

Flags

oneend env ls

List environment variables

Usage

oneend env ls [--target <production|preview>] [--app <app name>]

Sensitive values cannot be read back; only their last four characters are shown.
The automatic variables (SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY and so on) are shown too, with where each is available. SUPABASE_SERVICE_ROLE_KEY goes only to running servers, middleware and functions, never to builds. DATABASE_URL, POSTGRES_URL and DIRECT_URL go to production at runtime only while the database password is kept for deploys. MYSQL_* and WORDPRESS_DB_* go to running servers when the project has a MySQL database. Save a variable under the same name and your value is used instead.
With --json the automatic variables come last, with "automatic": true.

Flags

oneend env pull

Download environment variables to a .env file

Usage

oneend env pull [file] [--target <production|preview>]

The default file is .env.local and the default environment is preview. The file is written readable only by you (0600).
Sensitive values cannot be downloaded, so only their names are left as comments.
The automatic variables (SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY and so on) are written too; the service role key only by name.

Arguments 0 to 1

Flags

oneend env push

Upload variables from a .env file

Usage

oneend env push [file] [--target <production|preview>] [--app <app name>] [--branch <git branch>] [--sensitive]

The default file is .env and the default environment is preview. Existing names are overwritten. Lines with a name the platform sets (PORT, HOST, HOSTNAME, HOME, BLACKWALL_…) are skipped and listed. Otherwise either every variable is saved or none is.

Arguments 0 to 1

Flags

oneend env set

Set one variable

Usage

oneend env set <name> [value] [--target <production|preview>] [--app <app name>] [--branch <git branch>] [--sensitive]

With no value it asks in a terminal or reads standard input: printf %s "$SECRET" | oneend env set API_KEY --sensitive

Arguments 1 to 2

Flags

oneend env rm

Remove a variable

Usage

oneend env rm <name> [--target <production|preview>] [--app <app name>] [--branch <git branch>] [--yes]

Without --target it removes the name from every environment that has it. With --app it removes the variable saved for that app only, and with --branch the one saved for that branch only.

Arguments 1

Flags

oneend deploy

Deploy a commit or this folder and stream the build

Usage

oneend deploy [--branch <branch>] [--commit <sha>] [--app <repo>] [--dir <folder>] [--upload] [--prebuilt] [--prod] [--block-on-advisors] [--no-wait]

Builds a commit that has been pushed to the repository. Without --branch and --commit it uses the current branch and HEAD of the git repository in this folder.
The production branch deploys to production, any other branch to a preview. A failed build exits with code 1.
For a project with no repository connected, or with --dir, --upload or --prebuilt, the folder is archived, uploaded and built the same way.
The upload follows .gitignore and .oneendignore and leaves out node_modules and .git. Without --prod an upload is a preview (named by --branch).
--prebuilt serves a folder that is already built (for example --dir dist) as it is, without building.

Flags

oneend deployments ls

List deployments

Usage

oneend deployments ls [--limit <n>] [--before <dpl-id>]

Flags

oneend deployments inspect

Show one deployment and its build log

Usage

oneend deployments inspect <id> [--wait] [--tail <lines>]

Arguments 1

Flags

oneend deployments redeploy

Rebuild the same commit

Usage

oneend deployments redeploy <id> [--no-wait]

Arguments 1

Flags

oneend deployments promote

Promote a preview to production

Usage

oneend deployments promote <id> [--no-wait]

Given a finished production deployment, it goes out at once without a rebuild and lifts the production hold a rollback left. Given the one serving now, it only lifts the hold.

Arguments 1

Flags

oneend rollback

Point production back at an earlier deployment

Usage

oneend rollback <id> [--yes]

Only a completed production deployment can be rolled back to. Only owners and admins can do this. Production is then held: new production builds do not go out until you promote one with oneend deployments promote <id>.

Arguments 1

Flags

oneend logs

Show project logs

Usage

oneend logs [--source <source>] [--level <level>] [--search <text>] [--follow]

Sources: site, server, api, auth, functions, build. Levels: info, warn, error. Older lines come first.

Flags

oneend deployments retention

Show or change how long deployments are kept

Usage

oneend deployments retention [--canceled <days>|plan] [--error <days>|plan] [--preview <days>|plan] [--production <days>|plan]

A deployment past its period is deleted and can be restored with oneend deployments restore for 30 days. The 10 newest deployments, the 20 newest ready production ones, the 20 newest ready ones that are not production, and anything being served are kept whatever the period.
Only project admins can change it.

Flags

oneend deployments deleted

List recently deleted deployments

Usage

oneend deployments deleted

Flags

No flags of its own.

oneend deployments rm

Delete a deployment

Usage

oneend deployments rm <id> [--yes]

A deployment being served or still building cannot be deleted. A deleted deployment's address answers 410, and after 30 days its files and build log are removed.

Arguments 1

Flags

oneend deployments restore

Restore a deleted deployment

Usage

oneend deployments restore <id>

Only a deployment deleted less than 30 days ago can be restored.

Arguments 1

Flags

No flags of its own.

oneend deployments branch-previews

Show or turn branch previews on or off

Usage

oneend deployments branch-previews [on|off]

off builds only what reaches the production branch (usually main); a branch push stays in the deployment history as skipped. Redeploys, uploads and deploy hooks still build.
It applies to the whole organization, and only owners and admins can change it.

Arguments 0 to 1

Flags

No flags of its own.

oneend server-memory

Show or change the memory the project's servers run with (512, 1024, 2048 or 4096 MB)

Usage

oneend server-memory [512|1024|2048|4096]

Above 1024 MB a server gets two CPUs. Servers at production and branch addresses always run, requests or not, so the month shown is what one server costs a month.
After a change, servers restart with the new size within a minute. Only owners and admins can change it.

Arguments 0 to 1

Flags

No flags of its own.

oneend concurrent-builds

Show or change how many of the project's builds run at once (1 to 20, none for no limit)

Usage

oneend concurrent-builds [<n>|none]

Builds over the limit wait in the queue and start when one ahead of them finishes. A waiting build is not billed for build minutes. Only owners and admins can change it.

Arguments 0 to 1

Flags

No flags of its own.

oneend dev

Run the development command with the development variables

Usage

oneend dev [--app <name>] [--dry-run]

The command is the development command set in the console's Build & Development settings, or npm run dev when there is none.
It runs in the repository's root directory when one is set. Sensitive values cannot be downloaded, so they are left out.

Flags

oneend domains ls

List connected domains

Usage

oneend domains ls

Flags

No flags of its own.

oneend domains redirect

Redirect a domain to another domain of the project

Usage

oneend domains redirect <domain> <address> [--status <code>] | oneend domains redirect <domain> --off

The address is a domain, or a domain and a path. With a path, the visited path is appended and the query string goes along: oneend domains redirect vision.example.com example.com/vision sends vision.example.com/x?y=1 → example.com/vision/x?y=1, and the home page to example.com/vision. The domain must be connected to this project and not itself a redirect.

Arguments 1 to 2

Flags

oneend git import

Import a repository and start its first deployment

Usage

oneend git import <owner/name> [--root <folder>] [--app <app name>] [--branch <branch>] [--no-wait]

Connects a repository the GitHub App can see to this project and builds the newest commit of its production branch (the same as [Connect and deploy] in the console and MCP import_repository).
Import a monorepo once per app folder: oneend git import acme/mono --root apps/web, then --root apps/admin.
Another folder of a repository already connected is added as a new app with its own address (oneend apps ls). The database, keys and project environment variables are shared.
The install runs at the top of the repository (where the lockfile is) and the build in the app folder. Owners and admins only.

Arguments 1

Flags

oneend git checks

Run checks on One Server (on/off)

Usage

oneend git checks [<owner/name> on|off]

Runs a connected GitHub repository's GitHub Actions checks on One Server's machines (the same as Git connection → Run checks on One Server in the console and MCP set_checks_on_server).
With no arguments it shows each repository's state. On saves the repository variable POOL_RUNNER, and a job with this line runs on One Server:
runs-on: ${{ vars.POOL_RUNNER || 'ubuntu-latest' }}
Off deletes the variable, and the next jobs run on GitHub's machines. Owners and admins only.

Arguments 0 to 2

Flags

No flags of its own.

oneend apps ls

List the apps of this project and their addresses

Usage

oneend apps ls

Shows each app's repository, folder (root directory), production branch and production address. The project's site is at <ref>--site, other apps at <ref>--<app>.

Flags

No flags of its own.

oneend apps set

Change one app's settings (--run-as)

Usage

oneend apps set <app name> --run-as <platform|image>

--run-as image: runs as the user the image names (root included) inside a gVisor sandbox. Use it only for Dockerfile apps that must start as root, like the official WordPress image. Even as root it cannot reach other projects. --run-as platform (the default): runs as an ordinary user (10001).
After a change the server restarts the new way within a minute, without a rebuild (the same as the console's build settings and run_as on MCP update_app). Only owners and admins can change it.

Arguments 1

Flags

oneend apps delete

Delete one app, with its addresses and deployments

Usage

oneend apps delete <app name> [--yes]

Its addresses go at once, builds in progress are cancelled, and its deployments are deleted with no restore. A push no longer builds it, even if the folder is still in the repository. The project's own site, an app with domains and an app with disks are not deleted; it says what to do first (the same as the console's app settings and MCP delete_app). Only owners and admins can delete one.

Arguments 1

Flags

oneend apps settings

An app's settings: the port its server listens on

Usage

oneend apps settings <app> --port <port|auto>

auto uses the image's EXPOSE, or 3000 without one. A change restarts the server within a minute. Only owners and admins can change it.

Arguments 1

Flags

oneend volumes ls

List the apps' volumes and their backups, and the port each app's server listens on

Usage

oneend volumes ls

A volume is disk space that stays when a server restarts or a new deployment goes out. Only production servers mount it.

Flags

No flags of its own.

oneend volumes create

Add a volume to an app's production servers

Usage

oneend volumes create <app> <path> [--size <GB>]

For WordPress the path is /var/www/html. It is ready within a minute and the server restarts. Only owners and admins can do this.

Arguments 2

Flags

oneend volumes resize

Grow a volume (it cannot shrink)

Usage

oneend volumes resize <id> <GB>

Arguments 2

Flags

No flags of its own.

oneend volumes rm

Delete a volume, its files and its backups (cannot be undone)

Usage

oneend volumes rm <id> --confirm <path>

It cannot be undone, so --confirm must carry the volume's path exactly (the path in oneend volumes ls).

Arguments 1

Flags

oneend volumes backup

Back up a volume's files now (kept 30 days)

Usage

oneend volumes backup <id>

Arguments 1

Flags

No flags of its own.

oneend volumes restore

Restore a volume from a backup (the current files are backed up for 7 days first)

Usage

oneend volumes restore <id> <backup id>

Arguments 2

Flags

No flags of its own.

oneend storage ls

List the buckets, or the files in a bucket

Usage

oneend storage ls [<bucket>[/<folder>]]

Without a bucket it lists the buckets. Folders are shown one level at a time: oneend storage ls photos/2026

Arguments 0 to 1

Flags

No flags of its own.

oneend storage upload

Upload a local file to a bucket

Usage

oneend storage upload <file> <bucket>/<name> [--replace]

It stops if a file with the same name is there; add --replace to replace it. Files over 2MB upload too (up to the plan's file limit).

Arguments 2

Flags

oneend storage download

Download a file from a bucket

Usage

oneend storage download <bucket>/<name> [<file>]

Without a file to save to, it saves in the current folder under the last part of the name. It stops if a file with that name is there; add --replace to replace it.

Arguments 1 to 2

Flags

oneend storage rm

Delete a file from a bucket (cannot be undone)

Usage

oneend storage rm <bucket>/<name> --yes

Arguments 1

Flags

oneend server

Show the project's dedicated server: size, location, standby and jobs

Usage

oneend server [--project <ref>]

Sizes and monthly prices per location: oneend server-sizes (MCP list_server_sizes).

Flags

No flags of its own.

oneend server request

Rent a dedicated server for the project

Usage

oneend server request <size> [<region>]

Usually ready within 10 minutes; the database and app move onto it, then the address switches. From the Pro plan; only owners and admins can do this.

Arguments 1 to 2

Flags

No flags of its own.

oneend server resize

Change the dedicated server's size, now or tonight

Usage

oneend server resize <size> [now|tonight]

tonight is 03:00 to 05:00 in the server location's time. Without a standby the server does not answer for 3 to 5 minutes. Only owners and admins can do this.

Arguments 1 to 2

Flags

No flags of its own.

oneend server standby

Turn the standby server on or off (auto for automatic failover)

Usage

oneend server standby on|off [auto]

The standby is the same size in the same location and replicates the database continuously. With auto the project switches to it once the primary has not answered for 60 seconds. Only owners and admins can do this.

Arguments 1 to 2

Flags

No flags of its own.

oneend server move

Move the dedicated server to another location (once a month, free)

Usage

oneend server move <region>

Writes pause for a few seconds when the address switches. The old server is kept for 7 days. Only owners and admins can do this.

Arguments 1

Flags

No flags of its own.

oneend server release

Give the dedicated server back

Usage

oneend server release <ref>

Takes a last backup, moves the database and app to the shared server, then deletes the server. Writes pause during the move. Give the project ID (ref) exactly, as the confirmation.

Arguments 1

Flags

No flags of its own.

oneend server restore-days

Set the restore days to 7 or 28

Usage

oneend server restore-days 7|28

28 days are only on a dedicated server and add a monthly charge. Only owners and admins can do this.

Arguments 1

Flags

No flags of its own.

oneend import sources

List connected source accounts, their projects and imports so far

Usage

oneend import sources [--org <name>]

Import from another server (the same as the organisation menu in the console and MCP import_sources). Source accounts (Supabase, Vercel, PostgreSQL) are connected once in the console.

Flags

oneend import start

Start an import

Usage

oneend import start (<import id> | --connection <id> --project <id>) [--org <name>]

Starts an import split in the console, or a source account's project split one new project per group (the same as [Start import] in the console and MCP start_import).
A Supabase source's session pooler connection string is passed in the environment variable ONEEND_SOURCE_DB_URL. It is used for this run only and then deleted.
Starting a stopped import again passes over finished destinations and moves only what changed. Progress: oneend import get <id>.

Arguments 0 to 1

Flags

oneend import get

Show an import's progress

Usage

oneend import get <import id> [--org <name>]

Shows each destination's state by step (the same as MCP get_import).

Arguments 1

Flags

oneend import auth

Copy a Supabase project's sign-in settings into this project

Usage

oneend import auth --connection <id> --from <ref> [--providers <name>] [--dry-run] [--org <name>]

Copies the social providers switched on, the redirect address list, and the site address when this project's is empty, into the linked project, read with a connected Supabase account (the same as MCP copy_auth_from_import).
Secrets are read from Supabase and stored directly, never shown. Check with --dry-run first.
Afterwards register the callback address in each provider's console. Sign-in fails until it is registered.

Flags

oneend import storage

Copy a Supabase project's buckets and files into this project

Usage

oneend import storage --connection <id> --from <ref> [--buckets <name>] [--rename <from=to>] [--dry-run] [--org <name>]

Copies buckets and files into the linked project, read with a connected Supabase account (the same as MCP copy_storage_from_import).
A missing bucket is made with Supabase's public flag and limits, and a file already here with the same size is passed over. It keeps calling until everything is copied.
The Supabase key is used inside the server only. Bucket access rules are not copied. Check with --dry-run first.

Flags

oneend functions ls

List functions

Usage

oneend functions ls

Flags

No flags of its own.

oneend functions deploy

Deploy a function from a file or a folder

Usage

oneend functions deploy <name> [file or folder] [--public | --private]

Without a file it looks for the folder oneend/functions/<name>/, then supabase/functions/<name>/, then oneend/functions/<name>.ts.
A folder starts at index.ts (or index.js) and sends every other module, package.json and deno.json with it (following .gitignore and leaving out node_modules). A folder beside it that it imports, such as ../_shared/, is sent too.
npm:, jsr: and URL imports and the imports of deno.json are installed, or fetched once, at deploy time and bundled with it.
A function can read production secrets, so only owners and admins can deploy one.

Arguments 1 to 2

Flags

oneend functions rm

Remove a function

Usage

oneend functions rm <name> [--yes]

Arguments 1

Flags

oneend functions download

Download a function’s source

Usage

oneend functions download <name> [file]

Without a file it writes to standard output.

Arguments 1 to 2

Flags

No flags of its own.

oneend functions invoke

Invoke a function with the project’s secret key

Usage

oneend functions invoke <name> [--data <JSON>] [--method <POST>] [--header <name: value>]

Arguments 1

Flags

oneend functions limits

Show or change a function’s time limits (one call, one SQL statement)

Usage

oneend functions limits <name> [--timeout <seconds>] [--sql-timeout <seconds>]

By default one call may take 150 seconds (as on Supabase's edge functions) and one SQL statement 8 seconds. This server's maximum is timeout_cap_seconds.
default puts a limit back to its default. With no flag it shows the current limits. Takes effect from the next call; a call past its limit is cut off with 504.

Arguments 1

Flags

oneend functions egress

Turn functions’ outbound requests on or off

Usage

oneend functions egress [on | off]

Off by default. While off, functions reach nothing but this project's database and API.
Once on, the server sends requests on the function's behalf and records every one in the function logs; internal addresses are blocked. Function code can then send data out, so turn it on only when you need it.
With no argument it shows the current state. Applies within 30 seconds. Only owners and admins can change it.

Arguments 0 to 1

Flags

No flags of its own.

oneend secrets list

List function secrets (names only)

Usage

oneend secrets list

Flags

No flags of its own.

oneend secrets set

Save function secrets (the same name is overwritten)

Usage

oneend secrets set <name=value>... [--env-file <file>]

Values only functions see. They never reach a site build, and functions read them from process.env from their next call. A saved value cannot be shown again.
Given one name and no value, it reads the value from standard input (so it stays out of shell history): printf %s "$KEY" | oneend secrets set RESEND_API_KEY
All are saved or none is. Only owners and admins can do this.

Arguments 0 to 100

Flags

oneend secrets copy

Copy function secrets by name from another project

Usage

oneend secrets copy --from <ref> <name>... [--overwrite]

The values move inside the server and only names are shown. A key already saved in another project need not be pasted again.
A name this project already has is skipped; add --overwrite to replace it. Names the source does not have are listed apart, and the rest are copied.
Up to 50 at a time. You must be an owner or admin of both projects.

Arguments 1 to 50

Flags

oneend secrets unset

Delete function secrets

Usage

oneend secrets unset <name>... [--yes]

Arguments 1 to 100

Flags

oneend gpu

Show GPU prices and this project's GPU jobs and servers

Usage

oneend gpu

GPUs are rented by the second, on the Pro plan and above.

Flags

No flags of its own.

oneend gpu jobs create

Rent a GPU and run a command to its end (paid)

Usage

oneend gpu jobs create <image> "<command>" [--gpu rtx4090] [--region auto] [--volume <name>] [--name <name>] [--env-file .env] [--max-minutes 60] [--yes]

The GPU is let go when the command ends or --max-minutes passes. Billed by the second from when the GPU is rented until it is let go, image download included.
Results last only in GPU storage or somewhere outside. The image needs curl, wget or python3 to report its start and end.

Arguments 2

Flags

oneend gpu jobs get

Show one GPU job's status and the end of its output

Usage

oneend gpu jobs get <job id>

Arguments 1

Flags

No flags of its own.

oneend gpu jobs cancel

Stop a GPU job

Usage

oneend gpu jobs cancel <job id>

One not started yet never starts; a running one lets its GPU go. The time until the GPU is let go is billed.

Arguments 1

Flags

No flags of its own.

oneend gpu servers create

Create a GPU server that hosts a model (paid)

Usage

oneend gpu servers create <name> <image> [--gpu l40s] [--region auto] [--volume <name>] [--command "<command>"] [--port 8000] [--idle-minutes 15] [--env-file .env] [--yes]

It starts on the first request (503 meanwhile) and stops after --idle-minutes without requests. 0 keeps it on.
Call the address with the secret key. Billed by the second from when it starts turning on until it is off, image download included.

Arguments 2

Flags

oneend gpu servers stop

Stop a GPU server now

Usage

oneend gpu servers stop <name>

It is off shortly. The time until it is off is billed. The next request starts it again.

Arguments 1

Flags

No flags of its own.

oneend gpu servers rm

Delete a GPU server

Usage

oneend gpu servers rm <name> [--yes]

A running server is turned off first, then deleted. This cannot be undone.

Arguments 1

Flags

oneend gpu volumes create

Create GPU storage that keeps models and data (paid)

Usage

oneend gpu volumes create <name> --datacenter <datacenter> [--size 50] [--yes]

Give it to a job or server with --volume and it is mounted at /workspace; that job or server rents its GPU in this data center only.
Billed by the GB-month for as long as it exists, used or not. The data center closest to Korea is AP-JP-1 (Japan).

Arguments 1

Flags

oneend gpu volumes rm

Delete GPU storage and every file on it

Usage

oneend gpu volumes rm <name> [--yes]

Not while a job or server uses it. This cannot be undone.

Arguments 1

Flags

oneend network

Show the project's inbound addresses and static outbound IP

Usage

oneend network

Point a custom domain’s A record at the inbound addresses.
The outbound address is fixed only for a project with the static outbound IP add-on (paid, Pro and above). Without it the address is shared and can change without notice.

Flags

No flags of its own.

oneend network static-ip

Turn the static outbound IP add-on on or off (paid)

Usage

oneend network static-ip <on|off> [--yes]

The monthly price is charged for the time it is on. On the Pro plan and above, only owners, admins and billing members can do this.

Arguments 1

Flags

oneend migration new

Create a new migration file

Usage

oneend migration new <name>

Creates oneend/migrations/<YYYYMMDDHHMMSS>_<name>.sql. The contents can also be piped in on standard input.

Arguments 1

Flags

No flags of its own.

oneend migration list

Compare local migrations with the remote history

Usage

oneend migration list

Flags

No flags of its own.

oneend migration repair

Mark migrations applied or reverted without running them

Usage

oneend migration repair <version...> --status <applied|reverted>

applied: records the local file as applied without running it.
reverted: only removes the record. What the migration created stays as it is.

Arguments 1 or more

Flags

oneend db push

Apply pending migrations

Usage

oneend db push [--dry-run] [--include-all] [--yes]

Each migration is one transaction. If one fails, only it is rolled back and the push stops (exit code 1). The history is kept in the project’s oneend_migrations table.
Files from supabase/migrations can be copied into oneend/migrations as they are. Supabase names such as public., auth.uid() and to authenticated are run in this project’s names (Supabase name translation).

Flags

oneend db pull

Dump the remote schema into a migration file

Usage

oneend db pull [name] [--no-record]

Dumps tables, constraints, indexes, functions, views, triggers and RLS rules as SQL into oneend/migrations/<version>_<name>.sql (remote_schema by default).
The file is recorded as applied on the remote, so db push does not run it again (turn this off with --no-record).

Arguments 0 to 1

Flags

oneend gen types typescript

Generate TypeScript types for supabase-js

Usage

oneend gen types typescript [--schema public] [--output <file>]

Writes to standard output: oneend gen types typescript > src/database.types.ts

Flags

oneend db schemas

List the schemas the project made, and which are exposed

Usage

oneend db schemas

For an exposed schema the data API answers the Accept-Profile / Content-Profile headers (supabase-js db: { schema }). public is always exposed.

Flags

No flags of its own.

oneend db schemas expose

Expose schemas through the data API

Usage

oneend db schemas expose <name...>

Row level security and privileges apply as in public. Only owners and admins can do this.

Arguments 1 or more

Flags

No flags of its own.

oneend db schemas hide

Stop exposing schemas through the data API

Usage

oneend db schemas hide <name...>

The schema and its data stay as they are. The data API only answers PGRST106 (406) for it.

Arguments 1 or more

Flags

No flags of its own.

oneend db move

Show whether the project is on a dedicated database, and how its move stands

Usage

oneend db move

The Vault and large databases are only available on a dedicated database. To move, run oneend db move now.

Flags

No flags of its own.

oneend db move now

Request the move to a dedicated database now

Usage

oneend db move now [--yes]

The same as "Move now" in the console. The move happens when its turn comes; while it runs, writes to this project stop and reads continue. A backup of the moment before the move is kept, and if it fails the project stays where it was. Pro plan and up, owners and admins only.

Flags

oneend db disk

Show the project's dedicated disk, or the rule that would give it one

Usage

oneend db disk

A project whose database has grown moves to a disk and a Postgres of its own. Shows its size, what is used, the monthly cost and the suggestion to make it smaller.

Flags

No flags of its own.

oneend db disk request

Request the move of the project's database to a dedicated disk

Usage

oneend db disk request [--yes]

The same as "Move to a dedicated disk" in the console. The disk is billed on its provisioned size, and while it moves writes fail and reads work. Enterprise may ask at any time, other paid plans once past the threshold. Owners and admins only.

Flags

oneend db disk shrink

Make the dedicated disk smaller, when the last week suggests it

Usage

oneend db disk shrink [--yes]

The same as "Make the disk smaller" in the console. A smaller disk is made, the data moves onto it and the old disk is deleted. Only a disk under 25% used for 7 days can be made smaller. While it moves writes fail and reads work. Owners and admins only.

Flags

oneend branches list

List database branches

Usage

oneend branches list

Flags

No flags of its own.

oneend branches create

Create a database branch from the project's schema

Usage

oneend branches create [name] [--git-branch <branch>] [--no-seed] [--with-data]

Re-runs the project's migrations and loads the seed. With --with-data, the project's data is copied instead, up to 512MB (files excluded). With --git-branch, preview deployments of that branch use this database.

Arguments 0 to 1

Flags

oneend branches merge

Apply a branch's migrations to the project

Usage

oneend branches merge <name> [--yes]

Arguments 1

Flags

oneend branches reset

Rebuild a branch from the project's schema

Usage

oneend branches reset <name> [--yes]

Arguments 1

Flags

oneend branches delete

Delete a branch and its database

Usage

oneend branches delete <name> [--yes]

Arguments 1

Flags

oneend edge-config ls

List edge config values

Usage

oneend edge-config ls

Flags

No flags of its own.

oneend edge-config set

Set an edge config value

Usage

oneend edge-config set <key> <value>

A value that reads as JSON is stored as JSON (true, 3, {"enabled": true, "percent": 20}), otherwise as text. Every server has it within seconds.

Arguments 2

Flags

No flags of its own.

oneend edge-config rm

Delete edge config keys

Usage

oneend edge-config rm <key>...

Arguments 1 or more

Flags

No flags of its own.

oneend edge-config history

Show edge config history

Usage

oneend edge-config history

Flags

No flags of its own.

oneend kv ls

List KV keys

Usage

oneend kv ls [prefix]

Arguments 0 to 1

Flags

No flags of its own.

oneend kv get

Read a KV value

Usage

oneend kv get <key>

Arguments 1

Flags

No flags of its own.

oneend kv set

Save a KV value

Usage

oneend kv set <key> <value> [--ttl <seconds>]

Arguments 2

Flags

oneend kv rm

Delete a KV key

Usage

oneend kv rm <key>

Arguments 1

Flags

No flags of its own.

oneend rollout status

Show the rolling release

Usage

oneend rollout status

Flags

No flags of its own.

oneend rollout advance

Advance the rolling release

Usage

oneend rollout advance

Flags

No flags of its own.

oneend rollout promote

Release to everybody

Usage

oneend rollout promote

Flags

No flags of its own.

oneend rollout abort

Stop the rolling release and roll back

Usage

oneend rollout abort [--reason <reason>]

Flags

oneend analytics

Web analytics summary

Usage

oneend analytics [--days <1|7|30|90>]

Flags

oneend auth providers ls

List sign-in providers

Usage

oneend auth providers ls

Flags

No flags of its own.

oneend auth providers set

Configure and turn on a sign-in provider (a custom:<name> one with its endpoints)

Usage

oneend auth providers set <provider> --client-id <value> [--client-secret <value>] [--provider-type <value>] [--issuer <address>] [--authorize-url <address>] [--token-url <address>] [--userinfo-url <address>] [--jwks-uri <address>] [--scopes <value>] [--claim-map <value>]

A built-in provider (google, kakao and so on) needs only its client ID and secret.
custom:<name> is an OAuth 2.0 / OpenID Connect provider you register yourself (the same name as on Supabase). It needs its authorization and token addresses; for OpenID Connect, --issuer alone is enough.
With --provider-type oidc the id_token is read only after it is verified against the issuer's keys (--jwks-uri, or found from the issuer). With oauth2 (the default) it is read through --claim-map.
--claim-map (--claims) says, as JSON, which field of the answer is id, email, email_verified, name, avatar and phone. For example: {"id":"id","email":"kakao_account.email"}
Without a secret the stored one is kept. In the app, sign in with supabase.auth.signInWithOAuth({ provider: 'custom:<name>' }).

Arguments 1

Flags

oneend auth providers rm

Remove a sign-in provider’s settings

Usage

oneend auth providers rm <provider> [--yes]

Arguments 1

Flags

oneend channels

List the organisation's notification channels

Usage

oneend channels

Flags

No flags of its own.

oneend channels add

Add a notification channel (Slack, KakaoWork, webhook or email)

Usage

oneend channels add --kind <slack|kakaowork|webhook|email> --name <name> (--url <address> | --email <address>…) [--notices deployments,usage]

An email channel takes --email several times (or comma-separated), up to 10. Each address gets a confirmation email, and only addresses that open the link receive notifications.
usage covers limit warnings and traffic spike alerts. Only owners and admins can do this.

Flags

oneend channels test

Send a test message to one channel

Usage

oneend channels test <id>

For an email channel it goes to confirmed addresses only, and addresses still waiting are sent the confirmation again.

Arguments 1

Flags

No flags of its own.

oneend channels rm

Remove a notification channel

Usage

oneend channels rm <id> [--yes]

Arguments 1

Flags

oneend auth smtp

Show the SMTP settings this project's auth emails go out through

Usage

oneend auth smtp

Flags

No flags of its own.

oneend auth smtp set

Save the SMTP settings (Supabase "SMTP Settings")

Usage

oneend auth smtp set --sender-email <address> --host <host> --username <name> [--password <password>] [--port 587] [--sender-name <name>]

The password can come from the ONEEND_SMTP_PASSWORD environment variable instead of --password (it stays out of shell history). Left empty, the stored password is kept.
Check it with oneend auth smtp test after saving.

Flags

oneend auth smtp test

Send a test email through the SMTP server

Usage

oneend auth smtp test [--to <address>]

It does not fall back to the platform, so a failure gives the server's own reason. Without --to it goes to your own address.

Flags

oneend auth smtp rm

Remove the SMTP settings

Usage

oneend auth smtp rm [--yes]

Flags

oneend auth templates

List the email templates

Usage

oneend auth templates

Flags

No flags of its own.

oneend auth templates get

Show one email template

Usage

oneend auth templates get <type>

Arguments 1

Flags

No flags of its own.

oneend auth templates set

Save an email template

Usage

oneend auth templates set <type> --subject <subject> --body-file <file.html>

Templates from Supabase work as they are: {{ .ConfirmationURL }}, {{ .Token }}, {{ .TokenHash }}, {{ .SiteURL }}, {{ .Email }}, {{ .NewEmail }}, {{ .RedirectTo }}, {{ .Data.<key> }}.

Arguments 1

Flags

oneend auth templates preview

Preview an email template with sample values

Usage

oneend auth templates preview <type> [--subject <subject> --body-file <file.html>]

With --subject or --body it shows those without saving; without them, the saved template or the default wording.

Arguments 1

Flags

oneend auth templates reset

Restore the default wording of an email template

Usage

oneend auth templates reset <type> [--yes]

Arguments 1

Flags

oneend platform overview

Show the whole platform and what needs attention (operators)

Usage

oneend platform overview

Shows organisations and projects counted, rented servers and their jobs, dedicated disk and server requests, the last 24 hours of deployments and the CI machines at once. Changes nothing.

Flags

No flags of its own.

oneend platform find

Find a customer by address, id, ref, domain or name (operators)

Usage

oneend platform find <query>

Shows each organisation's owners, plan and status, and for each project its status, last deployment, domains, rented servers and open dedicated requests.

Arguments 1

Flags

No flags of its own.

oneend platform pricing

Show the customer server switches and each size's cost and price (operators)

Usage

oneend platform pricing

Flags

No flags of its own.

oneend platform pricing set

Change the customer server switches (operators)

Usage

oneend platform pricing set [--customer-hosts on|off] [--server-sizes-listed on|off] [--customer-host-regions <region,...>] [--krw-per-usd <n>] ...

Only the fields given change, at once. The audit log records each from what to what. For example: oneend platform pricing set --customer-hosts on --server-sizes-listed on

Flags

oneend platform sizes

Show the customer server sizes (operators)

Usage

oneend platform sizes

Flags

No flags of its own.

oneend platform sizes set

Make or change a customer server size (operators)

Usage

oneend platform sizes set <size> [--machine <machine>] [--listed on|off] [--plan <plan>|none] [--margin-floor <ratio>] [--allow-loss] [--region <region>:cost=<usd>:usd=<usd>:krw=<krw>] [--cost-source <source>]

A size is named by its memory (1gb is e2-micro). A new size stays hidden unless --listed on.
For example: oneend platform sizes set 1gb --machine e2-micro --region kr-seoul-1:cost=7.6:usd=35
Selling under cost needs --allow-loss. Without krw, it is usd × the rate rounded up to ₩1,000.

Arguments 1

Flags

oneend platform servers

Show our servers: size, use and monthly cost (operators)

Usage

oneend platform servers

Flags

No flags of its own.

oneend platform servers cpu

Show how often and how long the service host was busy (operators)

Usage

oneend platform servers cpu [--hours <hours>] [--step <minutes>] [--all]

Read from per-minute records. By default the last 24 hours in 5-minute intervals, only those at 80% or more. --all shows every interval. Records are kept for 48 hours only.

Flags

oneend platform servers change

Request a change to one of our servers (operators)

Usage

oneend platform servers change --server main|build|standby|backup|vm|runner|pool|network|build-image --action <action> [--to <size>] [--when now|tonight] [--instance <name>] [--zone <zone>] [--repo <owner/name>] [--location <region>] [--region <region>] [--reason <reason>]

Service host size: --server main --action resize --to e2-standard-4 (every site stops for 3 to 5 minutes, so it asks first; it runs tonight, 03:00 to 05:00, unless told otherwise).
Build host: --server build --action on|off|resize · standby: --server standby --action on|off · backup copy: --server backup --action replica [--location us-west1|none]
One machine: --server vm --action start|stop|resize --instance oneserver-runner · retire the always-on Actions machine: --server runner --action retire (RUNNER is deleted in the five repositories and checked before it is stopped)
Reset the Actions pool: --server pool --action reset (every machine that is on but running no check is stopped) · bake its image: --server pool --action bake · Cloud NAT: --server network --action nat [--region us-west1] (the router and NAT are made where missing)
Bake the build machines' image: --server build-image --action bake (installed on a temporary machine, imaged, the machine deleted; new build machines then boot from it quickly)

Flags

oneend platform servers show

Show one server change request (operators)

Usage

oneend platform servers show <request id>

Arguments 1

Flags

No flags of its own.

oneend platform servers cancel

Cancel a server change request that has not started (operators)

Usage

oneend platform servers cancel <request id>

Arguments 1

Flags

No flags of its own.

oneend platform variables

Show a GitHub repository's Actions variables (operators)

Usage

oneend platform variables <owner/name>

Arguments 1

Flags

No flags of its own.

oneend platform variables set

Save one of a GitHub repository's Actions variables (operators)

Usage

oneend platform variables set <owner/name> <name> <value>

Arguments 3

Flags

No flags of its own.

oneend platform variables rm

Delete one of a GitHub repository's Actions variables (operators)

Usage

oneend platform variables rm <owner/name> <name>

For example, with RUNNER deleted the repository's checks run on GitHub's machines (ubuntu-latest).

Arguments 2

Flags

oneend platform operators

Show the platform operators (operators)

Usage

oneend platform operators

Flags

No flags of its own.

oneend platform operators add

Add a platform operator (operators)

Usage

oneend platform operators add <address>

Arguments 1

Flags

No flags of its own.

oneend platform operators rm

Remove a platform operator (operators)

Usage

oneend platform operators rm <address>

An address in the server's environment (BLACKWALL_OPERATOR_EMAILS), and your own, cannot be removed.

Arguments 1

Flags

oneend platform runs

Show One Server's recent workflow runs (operators)

Usage

oneend platform runs [--workflow checks.yml|deploy.yml|ops.yml|static-egress.yml] [--limit <n>]

A run waiting for a machine for more than 15 minutes is marked as stuck.

Flags

oneend platform runs cancel

Cancel a workflow run that has not finished (operators)

Usage

oneend platform runs cancel <id>

Cancelling a deploy run midway can leave that deploy half done.

Arguments 1

Flags

oneend platform runs rerun

Re-run a finished workflow run (operators)

Usage

oneend platform runs rerun <id> [--failed-only]

Arguments 1

Flags

oneend platform checks

Show the repository checks One Server runs itself (operators)

Usage

oneend platform checks [--limit <n>]

These are checks that run on our own machines, without GitHub Actions (BLACKWALL_OWN_CI). The merge-when-green queue is shown too.

Flags

oneend platform merge-when-green

Merge a pull request when its checks pass, or stop (operators)

Usage

oneend platform merge-when-green <pr> on|off

Waiting pull requests are checked together on top of main and, when green, merged in the order they were added. One that conflicts with main is sent back with the conflicting file names.

Arguments 2

Flags

No flags of its own.

oneend platform ci-machines

Show the machines that run checks and deploys (operators)

Usage

oneend platform ci-machines

These are the always-on deploy machine (oneserver-runner), the Actions pool (oneserver-pool-N) and the Tokyo standby controller of our own checks (oneserver-ci-standby).

Flags

No flags of its own.

oneend platform ci-machines restart

Restart one CI machine (operators)

Usage

oneend platform ci-machines restart <name>

A job running on the machine is cut. Only oneserver-runner, oneserver-pool-<number> and oneserver-ci-standby.

Arguments 1

Flags

oneend platform ci-machines renew

Register a CI machine's GitHub runners again (operators)

Usage

oneend platform ci-machines renew <name>

It registers with the platform's GitHub App token (no personal token). The machine restarts, so a job running on it is cut.

Arguments 1

Flags

oneend platform support

Show the open support sessions (operators)

Usage

oneend platform support [--all]

Flags

oneend platform support start

Open a support session to act for a customer (operators)

Usage

oneend platform support start <ref ID|org id|customer email> --reason <reason> [--minutes <minutes>]

Joins the customer's organisation as an owner. While it is open, every other command works on its projects with the customer's own rights (--project <ref>).
The reason, the start and the end go to the customer's audit log. 60 minutes by default, at most 480, and it ends by itself.

Arguments 1

Flags

oneend platform support end

End a support session (operators)

Usage

oneend platform support end <session id|ref ID|org id|customer email>

Arguments 1

Flags

No flags of its own.