Applications, ingress and backups

Application commands compile a catalog entry or flui.yaml into services on a known host. Ingress and backup commands remain separate so public exposure and data retention are explicit choices.

Specification and catalog

vops spec templates
vops spec generate --template node --name my-api --output-file flui.yaml
vops spec validate flui.yaml
vops spec schema

vops catalog products
vops catalog blocks
vops catalog describe <id>
vops app catalog

Spec validation changes nothing and exits non-zero with structured errors when the manifest is invalid.

Build and immutable deployment

vops build setup
vops build run --wait
vops build status

vops deploy plan --spec flui.yaml --host web-1 --image <image>
vops deploy apply --plan <plan-id> --yes
vops deploy verify --app my-api

vops writes and triggers a GitHub Actions workflow; it never builds the application image locally or on the VPS. The plan is re-derived before apply and is refused when stale.

Direct application workflow

vops app preflight web-1
vops app setup web-1 --yes
vops app deploy -f ./flui.yaml --host web-1 --image <image>
vops app deploy -f ./flui.yaml --host web-1 --image <image> --yes

vops app install uptime-kuma --host web-1
vops app install uptime-kuma --host web-1 --yes

Without --yes, deploy and install render their plan. Use --set KEY=value for values declared by the selected manifest.

Day-two application commands

vops app list
vops app show my-api
vops app status my-api
vops app logs my-api --lines 200
vops app restart my-api
vops app shell my-api
vops app credentials my-api
vops app remove my-api --yes

app credentials --show reveals values read back from the host and should be used deliberately. app remove --purge --yes also destroys volumes and secrets; the default removal path keeps persistent data separate.

Ingress and TLS

vops ingress up web-1 --email you@example.com
vops ingress status web-1
vops app expose my-api --domain api.example.com --yes
vops app unexpose my-api --yes
vops ingress down web-1

Ingress owns ports 80 and 443 and refuses to start when another service already owns them. app expose routes an application through the host ingress and can request TLS or a basic-auth gate. Removing ingress while routes remain requires the command-specific force path.

Backups

vops backup setup web-1 \
  --paths /etc,/var/lib/my-api \
  --to s3:https://s3.example.com/bucket \
  --dry-run

vops backup setup web-1 \
  --paths /etc,/var/lib/my-api \
  --to s3:https://s3.example.com/bucket

vops backup run web-1
vops backup status web-1
vops backup snapshots web-1
vops backup restore web-1 --snapshot latest --target /srv/restore --yes

Restore writes into an explicit target directory and never overwrites the live path in place. Removing backup configuration keeps the repository unless --purge-repo is explicitly selected.