Declare
Describe services, ports, domains, volumes, and backup policy in YAML.
operational safety / evidence first
Every server change starts with evidence—not execution.
opsctl brings registry, backup, recovery, approval, and audit into one verifiable workflow. It is read-only by default, rejects vague authority, and leaves high-risk actions to explicit human decisions.
Control plane status
$ opsctl preflight plan.yml --json
READ Read-only first
PLAN Plan before change
PROVE Close the evidence loop
HUMAN Human approval
decisionNEEDS_APPROVAL
01 / PRINCIPLE
Not a bag of scripts. An operations contract.
Every command is designed around one question: before production changes, can we prove the target, blast radius, recovery path, and authority boundary?
02 / WORKFLOW
A four-stage safety workflow
Inspect
Observe reality, explain drift, and produce non-executing plans and risk decisions.
Prove
Create snapshots, verify backups, restore in isolation, and sign the evidence chain.
Handoff
Only specific, unexpired human approval can advance controlled execution.
03 / SURFACE
One CLI for the critical breakpoints in production change
Registry
Turn server intent into a reviewable, validated source of truth.
Preflight
Block port conflicts, volume risk, and missing backup evidence.
Recovery
Restore in isolation and verify files, hashes, and database signatures.
Evidence
Ed25519 signatures, audit checkpoints, and restorable archives.
Scheduler
Global serialization, bounded waiting, and deterministic spreading.
MCP / TUI
Read-only tools for AI and an operator-focused terminal view.
04 / BOUNDARY
Dangerous operations do not become safe by calling them automation.
opsctl does not auto-approve and does not delete Docker volumes. Planning, evidence, and human execution are deliberately separate boundaries.
05 / BEGIN
Start with a read-only check.
Validate the registry and runtime before entering backup and recovery workflows.