Enum DeployCommand 

pub enum DeployCommand {
    Render {
        env: String,
        repo: PathBuf,
        targets: Option<PathBuf>,
        out: Option<PathBuf>,
    },
    Plan {
        env: String,
        repo: PathBuf,
        targets: Option<PathBuf>,
        base: Option<PathBuf>,
        diff: bool,
    },
    Pull {
        env: String,
        repo: PathBuf,
        targets: Option<PathBuf>,
    },
    Verify {
        env: String,
        repo: PathBuf,
        targets: Option<PathBuf>,
        project: String,
        node: VerifyNodeArg,
    },
    Apply {

        env: String,
        repo: PathBuf,
        targets: Option<PathBuf>,
        base: Option<PathBuf>,
        project: String,
        plan_sha256: Option<String>,
        allow_destructive: bool,
        allow_drift: Option<String>,
        allow_provider_wipe: Vec<String>,
        designers: DesignersArg,
        designers_timeout: u64,
        skip_gwbk: bool,
        backup_timeout: u64,
    
},
    Rollback {
        env: String,
        repo: PathBuf,
        targets: Option<PathBuf>,
        run: String,
        discard_live_changes: bool,
        designers: DesignersArg,
        designers_timeout: u64,
        backup_timeout: u64,
    },
    Projects {

        env: String,
        release: Option<String>,
        rollback_run: Option<String>,
        repo: PathBuf,
        targets: Option<PathBuf>,
        check: bool,
        artifact_sha256: Option<String>,
        tags_sha256: Option<String>,
        allow_downgrade: bool,
        allow_first_change: Option<String>,
        allow_destructive: bool,
        designers: DesignersArg,
        designers_timeout: u64,
        backup_timeout: u64,
    
},
}

Variants

Render

Render gateways/<name>/ for one environment into the bytes the gateway holds on disk — offline (no profile, no network, no credentials). Reports file and byte counts and the render_sha256 digest; refuses an invalid tree with deploy_tree_invalid

Fields

env: String

Environment name; selects targets/<ENV>.yaml

repo: PathBuf

Declared repo root (default: the current directory)

targets: Option<PathBuf>

Directory holding targets/<ENV>.yaml and the target’s known_hosts files (default: –repo)

out: Option<PathBuf>

Also write the rendered tree and a render.json marker to this directory: absent, empty, or a previous render of the same gateway and environment. Never deletes; anything else is refused (invalid_input) before any write

Plan

Plan one environment: compare the rendered tree with the master node’s live config/resources/ files and report each unit as added, changed, removed, same or unmanaged. Read-only; exits 0 whether or not anything changed. Reads the host through the master’s ssh or local block; resolves no gateway session

Fields

env: String

Environment name; selects targets/<ENV>.yaml

repo: PathBuf

Declared repo root (default: the current directory)

targets: Option<PathBuf>

Directory holding targets/<ENV>.yaml and the target’s known_hosts files (default: –repo)

base: Option<PathBuf>

A directory written by deploy render --out: a previous render of this gateway, environment and mode. It is re-hashed, never trusted; a base that is modified, incomplete or of another gateway is refused (invalid_input). Each entry then carries drift: true when a live file differs from both the base and the desired tree

diff: bool

Add a unified text diff (live against desired, 3 lines of context, at most 65536 bytes per unit) to added, changed and removed entries. Members that hold, or may hold, a secret are withheld and print only their sha256 values; non-JSON members print only that they differ

Pull

Bootstrap gateways/<name>/ from the master node’s live tree. Read-only against the gateway: it reads the host through the master’s ssh or local block and writes only the local repo. core files go to resources/ and tags/, the target mode collection’s files to modes/<ENV>/. Units that hold a secret or that render would not reproduce byte for byte are skipped and listed with a reason; the next plan reports them as unmanaged. Replacing a non-empty resources/, tags/ or modes/<ENV>/ needs the global --yes; manifest.yaml and other environments are never touched

Fields

env: String

Environment name; selects targets/<ENV>.yaml

repo: PathBuf

Declared repo root (default: the current directory)

targets: Option<PathBuf>

Directory holding targets/<ENV>.yaml and the target’s known_hosts files (default: –repo)

Verify

Verify that the master gateway runs what the target declares: no scan running, the target’s deployment mode, every declared resource read back equal over REST, tag-unit files byte-equal on the host, no will not be loaded WARN for a declared resource, and the manifest’s tag probes reading Good. Read-only: no scan is triggered, no lock is taken, nothing is written. Resolves the master’s profile through the normal secret chain. Prints a verdict: exit 0 when green, exit 6 with data.slug deploy_verify_failed when red

Fields

env: String

Environment name; selects targets/<ENV>.yaml

repo: PathBuf

Declared repo root (default: the current directory)

targets: Option<PathBuf>

Directory holding targets/<ENV>.yaml and the target’s known_hosts files (default: –repo)

project: String

The project hosting the WebDev tags route used for the tag probes

node: VerifyNodeArg

Which node to verify: master (the default) runs the six master checks; backup runs only the backup node’s checks (redundancy linked, mode, REST read-back, files against the master’s live copy, and the secret names the render references); both runs the master’s checks, then the backup’s. Needs nodes.backup for backup and both. Verify never waits, never resyncs and never writes

Apply

Apply one environment: write the declared tree into the master node’s mode collection under the gateway scan-lock, scan, then verify it; a red verify restores the pre-apply snapshot automatically (data.outcome rolled_back, data.slug deploy_rolled_back, exit 6). When the target has nodes.backup, the apply then waits for the backup node to converge (--backup-timeout), sends at most one resync to the master, and reports data.backup; a backup that cannot be proven ends data.outcome applied_backup_unsynced, data.slug deploy_backup_unsynced, exit 6, with the master left applied. Guarded: without the global --yes it exits 2 confirmation_required and the message IS the plan (the changing entries, the delete-set count and plan_sha256). --plan-sha256 binds the apply to the plan that was reviewed: a changed plan exits 6 plan_stale, and with --json or without a terminal the flag is required. Takes a .gwbk backup first (--skip-gwbk records that it did not). One fixed lock hold serves every target; a change of 1,528 or more files (writes plus deletes) is refused by the hold_budget preflight. There is no flag that skips the plan hash, the verify or the rollback. Staging a large tree is silent on the wire and can take minutes; in human mode progress lines go to stderr

Fields

env: String

Environment name; selects targets/<ENV>.yaml

repo: PathBuf

Declared repo root (default: the current directory)

targets: Option<PathBuf>

Directory holding targets/<ENV>.yaml and the target’s known_hosts files (default: –repo)

base: Option<PathBuf>

A directory written by deploy render --out: a previous render of this gateway, environment and mode. Enables the drift gate: a live file that differs from both the base and the desired tree refuses the apply (destructive_change_refused, exit 2) unless --allow-drift gives a reason. An entry that a core copy shadows is refused whatever the flags (deploy_blocked, exit 6)

project: String

The project hosting the WebDev tags route the post-apply verify uses for the tag probes, as in deploy verify

plan_sha256: Option<String>

The plan_sha256 of the plan that was reviewed. A different current plan refuses the apply (plan_stale, exit 6). Required with --json or when stdin or stdout is not a terminal

allow_destructive: bool

Allow a plan that deletes or replaces something destructive; the plan lists each such entry. Without it the apply is refused (destructive_change_refused, exit 2)

allow_drift: Option<String>

Go ahead over drifted entries (live changed since the --base render) and record this reason in the run record (at most 500 characters)

allow_provider_wipe: Vec<String>

Allow a plan that wipes tag provider PROVIDER: it deletes every tag-definition or tag-type-definition file the ledger lists for a provider the manifest still lists in tag_providers, while the render holds none of that type (data.provider_wipes of deploy plan). Repeatable, one provider each, and --allow-destructive is needed too; without it the apply is refused (destructive_change_refused gate provider_wipe, exit 2), with or without --allow-destructive. To hand a provider to a project repo, drop it from tag_providers in the commit that deletes its tree instead: nothing is deleted then

designers: DesignersArg

What to do about open Designer sessions: fail refuses while any is open, wait polls until none is or --designers-timeout passes, proceed goes ahead and records the sessions

designers_timeout: u64

Seconds --designers wait polls before it refuses

skip_gwbk: bool

Take no .gwbk backup; the run record states that none was taken

backup_timeout: u64

Seconds to wait for the backup node to converge after the master is verified; then one resync is sent to the master and the wait repeats once. Only used when the target has nodes.backup

Rollback

Roll back one past run by id, from a fresh process: restore the on-box snapshot the run took into the master node’s mode collection, delete the files the run created, scan, and record the rollback (a run directory of its own, kind: rollback). The run id is data.run_id of the deploy apply that made it, or its run directory’s name. Also recovers an interrupted run: a refusal that prints ign deploy rollback --run <id> --env <env> names the id to pass. Guarded: without the global --yes it exits 2 confirmation_required and the message names the run, the gateway, the mode and how many files it would restore and delete. A file changed since the run refuses (deploy_live_changed, exit 6) unless --discard-live-changes. One fixed lock hold (176 s) serves the rollback. Not in the MCP catalog. In human mode progress lines go to stderr

Fields

env: String

Environment name; selects targets/<ENV>.yaml

repo: PathBuf

Declared repo root (default: the current directory). Only the target file is read; the tree is not rendered

targets: Option<PathBuf>

Directory holding targets/<ENV>.yaml and the target’s known_hosts files (default: –repo)

run: String

The run to roll back: the run_id that deploy apply printed (or its directory below .ign/deploy/<gateway>/)

discard_live_changes: bool

Overwrite files changed after that run and record which. Without it a changed file refuses the rollback (deploy_live_changed, exit 6)

designers: DesignersArg

What to do about open Designer sessions: fail refuses while any is open, wait polls until none is or --designers-timeout passes, proceed goes ahead and records the sessions

designers_timeout: u64

Seconds --designers wait polls before it refuses

backup_timeout: u64

Seconds to wait for the backup node to converge after the master is restored; then one resync is sent to the master and the wait repeats once. Only used when the target has nodes.backup

Projects

Deploy one Ignition project from its own repo to a gateway. Reads deploy/project.yaml (the gateway project name and the environments it deploys to) and the root project.json, reads targets/<ENV>.yaml, builds the artifact from the checkout and compares it with the live project. --check reports artifact_sha256, live_sha256, the action (create for a project absent from the gateway, skip when the live project equals the artifact and this release is recorded, record when it equals the artifact but no record names this release, import otherwise), the member counts and the live members an overwrite would delete, over GET requests only; it writes nothing and creates no .ign/ directory. Without --check the deploy asks for confirmation (--yes), requires --artifact-sha256 (the hash the check reported) for an unattended run, and --tags-sha256 too when the project owns tag providers, saves the live project under .ign/deploy/, imports the artifact, reads the project back to compare it by canonical hash and records the release on the gateway host. Other projects on the gateway are listed by name and never read or changed. Not in the MCP catalog

Fields

env: String

Environment name; must be listed in deploy/project.yaml and selects targets/<ENV>.yaml

release: Option<String>

The release tag being deployed: semver after one optional leading v (for example v1.4.0). A pre-release is older than its release. Required unless --rollback-run is given

rollback_run: Option<String>

Undo the latest tag-owning run of this project on this gateway from the copy the gateway host keeps (the run_id a deploy printed, or the one a deploy_journal_present refusal names): the owned tags, their groups, provider settings and tag records and the project go back to that run’s pre-image. With --check it lists what it would restore and writes nothing; without it it asks for confirmation (--yes). Tags the run deleted are re-created; tags it created in an existing provider are removed through the master’s tag-delete route when it is configured and ready, and otherwise end it rollback_failed

repo: PathBuf

The project repo root (default: the current directory)

targets: Option<PathBuf>

A root holding targets/<ENV>.yaml (default: --repo). Gateway targets may live in another repository than the project

check: bool

Report what would change and write nothing; no confirmation and no --artifact-sha256 needed

artifact_sha256: Option<String>

The artifact_sha256 that --check --json reported for this checkout (64 lowercase hex characters). Required without --check with --json, --compact or a stdin or stdout that is not a terminal; a different artifact is refused before anything is uploaded

tags_sha256: Option<String>

The data.tags.tags_sha256 that --check --json reported for this checkout’s owned tags (64 lowercase hex characters). Required without --check, under the same rule as --artifact-sha256, when deploy/project.yaml lists tag_providers; different repo tag content is refused before anything is contacted

allow_downgrade: bool

Let a release older than the one the gateway last received from this tool replace it. Without it that is refused as a downgrade

allow_first_change: Option<String>

Let the first deploy of a project by this tool change what the gateway runs, with a reason of 1 to 500 characters. Without it the release must equal the live project

allow_destructive: bool

Let the deploy delete the tags the previous deploy of this project placed and the repo no longer holds; --check lists them (data.tags.removed). The gateway needs the tag-delete route (ign webdev deploy --with-tag-delete). Without it such a removal is refused (destructive_change_refused, exit 2); tags only on the gateway are never deleted

designers: DesignersArg

What to do about open Designer sessions before an import: fail refuses while any is open, wait polls until none is or --designers-timeout passes, proceed goes ahead and records the sessions. A release-record-only run skips the check

designers_timeout: u64

Seconds --designers wait polls before it refuses

backup_timeout: u64

Seconds to wait for the backup node to hold the owned tags after a green run or a rollback; then one resync is sent to the master and the wait repeats once. Only used for a project that lists tag_providers on a target with nodes.backup, whose session is only read. A backup that does not converge ends a green run applied_backup_unsynced (exit 6) with the master left applied

Trait Implementations

impl Debug for DeployCommand

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromArgMatches for DeployCommand

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for DeployCommand

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand