Command Reference

All commands are run as root or using sudo. General format:

citeck <command> [options] [arguments]

Global flags:

Flag	Description
`--format json`	Output in JSON format (for automation)
`--yes`	Skip confirmation prompts

install 

Interactive installation and configuration of the platform.

citeck install [flags]

Flags:

Flag	Description
`--workspace <path>`	Path to the workspace ZIP archive (offline bundle import)
`--offline`	Offline mode: skip network checks
`--rollback`	Roll back the binary to the previous version

Examples:

# Стандартная установка
citeck install

# Оффлайн-установка с архивом workspace
citeck install --workspace /tmp/workspace.zip --offline

# Откат к предыдущей версии после неудачного обновления
citeck install --rollback

When called on an already installed system, the command will check the version and suggest an upgrade if the new binary version differs from the installed one.

Note

The “Auto” mode (the default option in the installation wizard) is not a separate mode in namespace.yml, but a selection logic: the launcher checks whether Let’s Encrypt is available; on success the configuration is saved as letsEncrypt: true, otherwise as self-signed. After installation, citeck setup will show the specific option that was chosen.

start 

Start the platform (daemon + all applications).

citeck start [app] [flags]

Flags:

Flag	Description
`-d`, `--detach`	Start in the background without waiting (analogous to `docker-compose up -d`)
`-f`, `--foreground`	Run in foreground mode (do not fork the daemon)
`--follow`	Do not exit after all applications reach `RUNNING` — continue refreshing the status table every 2 seconds until Ctrl+C. Useful for manual monitoring of the platform startup. By default `citeck start` exits as soon as all applications have reached `RUNNING` or a terminal status.
`--offline`	Skip git operations, use only local data

Examples:

# Запуск с интерактивной таблицей статусов
citeck start

# Запуск в фоне
citeck start -d

# Запуск конкретного приложения (если было отключено — включает обратно)
citeck start eapps

# Запуск с непрерывным мониторингом
citeck start --follow

When started without specifying an application, the daemon starts in the background and displays an interactive table with the startup progress of all applications.

If an application was previously detached via citeck stop <app>, the command citeck start <app> re-attaches it to the namespace — the application will again be started on platform start/restart and monitored by the reconciler.

Note

If the systemd service is installed, citeck start (without arguments, daemon not running) delegates the startup to systemctl start citeck — the daemon starts as a systemd unit with journald logging and auto-restart. If systemd is unavailable, the daemon is forked directly. The -d/--detach flag forcibly bypasses systemd and forks the daemon directly (for containers or manual debugging).

Note

citeck start <app> waits for the application to reach RUNNING by default. To return control immediately after sending the request (without waiting), use the -d/--detach flag: citeck start <app> -d. To poll the state separately, use citeck status (e.g. watch -n 5 'citeck status | grep <app>').

stop 

Stop the platform or individual applications. Multiple application names can be passed in a single command: citeck stop onlyoffice attorneys ecom service-desk.

citeck stop [app...] [flags]

Flags:

Flag	Description
`-s`, `--shutdown`	Also stop the daemon
`-d`, `--detach`	Send the command and do not wait for completion

Examples:

# Остановка всех приложений (демон продолжает работать)
citeck stop

# Остановка с выключением демона
citeck stop --shutdown

# Остановка конкретного приложения (detach)
citeck stop eapps

# Остановка нескольких приложений сразу (все будут detach)
citeck stop onlyoffice attorneys ecom service-desk

Note

When specific applications are stopped (citeck stop <app> [<app>...]), each one transitions to the detached state — it will not be automatically started on citeck start, citeck reload, or daemon restart. The reconciler will also not attempt to recover detached applications.

To re-enable them, use citeck start <app>.

This is convenient for temporarily disabling optional services (OnlyOffice, AI, etc.) to save memory.

restart 

Restart all applications or a specific application. The command waits for the application to return to RUNNING status by default.

citeck restart [app] [flags]

Flags:

Flag	Description
`-d`, `--detach`	Do not wait for startup after restart (return control immediately after sending the request).
`--timeout <sec>`	Wait timeout in seconds (default: 300)

Examples:

# Перезапуск всех приложений (stop + start, ждёт RUNNING)
citeck restart

# Перезапуск одного приложения (ждёт RUNNING)
citeck restart eapps

# Перезапуск без ожидания (вернуть управление сразу)
citeck restart eapps --detach

status 

Display the state of the platform and applications.

citeck status [flags]

Flags:

Flag	Description
`-w`, `--watch`	Continuous monitoring (updates on SSE events)

Examples:

# Статус платформы с таблицей приложений
citeck status

# Непрерывный мониторинг (Ctrl+C для выхода)
citeck status --watch

# JSON-вывод для скриптов
citeck status --format json

Output example (abbreviated fragment for the Community bundle):

Name:    Citeck
Status:  RUNNING
Bundle:  community:2026.1
URL:     https://203.0.113.45

APP                STATUS   IMAGE                                       CPU   MEMORY
Citeck Core
  eapps            RUNNING  nexus.citeck.ru/ecos-apps:2.25.1            0.0%  803M / 1.0G
  emodel           RUNNING  nexus.citeck.ru/ecos-model:2.37.3           0.0%  1005M / 1.3G
  gateway          RUNNING  nexus.citeck.ru/ecos-gateway:3.6.0          0.0%  638M / 1.0G
  proxy            RUNNING  nexus.citeck.ru/ecos-proxy-oidc:2.26.9      0.0%  45M / 128M
  uiserv           RUNNING  nexus.citeck.ru/ecos-uiserv:2.34.3          0.0%  751M / 1.0G
Citeck Core Extensions
  integrations     RUNNING  nexus.citeck.ru/ecos-integrations:2.32.4    0.0%  874M / 1.0G
Citeck Additional
  ecom             RUNNING  nexus.citeck.ru/ecos-ecom:1.14.0            0.0%  644M / 1.0G
Third Party
  keycloak         RUNNING  keycloak/keycloak:26.4.5                    0.0%  581M / 1.0G
  postgres         RUNNING  postgres:17.5                               0.0%  253M / 1.0G
  rabbitmq         RUNNING  rabbitmq:4.1.2-management                   0.0%  130M / 256M

Applications are grouped by categories from the bundle workspace definition (Citeck Core, Citeck Core Extensions, Citeck Additional, Third Party). The Enterprise bundle includes additional applications (attorneys, service-desk, ecos-project-tracker, ai, edi, ecos-content, etc.) — the grouping is the same.

logs 

View application or daemon logs.

citeck logs [app] [flags]

Flags:

Flag	Description
`--tail <N>`	Number of last lines to show (default: 1000)
`-f`, `--follow`	Stream output (follow new entries)
`--since <time>`	Show logs from the specified time (RFC3339 or `1h`, `30m`)
`--until <time>`	Show logs up to the specified time
`-t`, `--timestamps`	Show timestamps

Examples:

# Логи демона (последние 1000 строк)
citeck logs

# Логи конкретного приложения
citeck logs eapps

# Последние 100 строк
citeck logs eapps --tail 100

# Потоковый вывод
citeck logs -f eapps

# Логи за последний час
citeck logs eapps --since 1h

describe 

Detailed information about an application: image, ports, volumes, environment variables.

citeck describe <app>

Example:

citeck describe eapps

# Пример вывода:
# Name           eapps
# Container ID   a1b2c3d4e5f6
# Image          registry.citeck.ru/community/ecos-apps:2024.11
# Status         RUNNING
# State          running
# Network        citeck-net
# Started at     2026-04-10T08:30:00Z
# Uptime         2d 5h 30m
# Restarts       0
#
# Ports:
#   8080/tcp -> 0.0.0.0:8080
#
# Volumes:
#   eapps-data:/data
#
# Environment:
#   JAVA_OPTS=-Xmx1024m
#   SPRING_PROFILES_ACTIVE=server
#   RABBITMQ_PASSWORD=***

reload 

Hot configuration reload: recalculates the deployment hash and recreates only the changed containers.

citeck reload [flags]

Flags:

Flag	Description
`--dry-run`	Show changes without applying them
`-d`, `--detach`	Apply and do not wait for services to stabilize

Examples:

# Предварительный просмотр изменений
citeck reload --dry-run

# Пример вывода dry-run:
# Config valid: /opt/citeck/conf/namespace.yml
# Changes:
#   ~ webapps.eapps.heapSize = 2048m (was 1024m)
#   + webapps.uiserv.env.CUSTOM_VAR = value

# Применить изменения
citeck reload

Note

Detached applications (previously stopped via citeck stop <app>) are excluded from reload — they remain stopped. To re-enable them, use citeck start <app>.

update 

Update workspace and bundle definitions from git repositories.

citeck update [flags]

Flags:

Flag	Description
`-f`, `--file <path>`	Path to the workspace ZIP archive (offline import)

Examples:

# Обновление из git (pull latest)
citeck update

# Импорт из файла (оффлайн)
citeck update -f /tmp/workspace.zip

upgrade 

Switch to a different version of the platform.

citeck upgrade [bundle:version] [flags]

Flags:

Flag	Description
`-y`, `--yes`	Skip confirmation. Apply the selected version immediately.

Argument: when bundle:version is specified (e.g. enterprise:2026.1), the command skips interactive selection and immediately prompts for confirmation (or applies without confirmation when --yes is used).

The command performs three steps:

Updates bundle definitions from git (if available).
Opens a tabular selection with a list of available versions — one tab per repository (Community / Enterprise). The current version is marked as (current), the latest as (latest).
After selection, prompts for confirmation and, upon agreement, applies the new version (namespace.yml is updated and reload is performed).

Example:

citeck upgrade --help

# Пример вывода:
# Update workspace repos and upgrade to a different bundle version.
#
# Usage:
#   citeck upgrade                        # interactive picker (TTY required)
#   citeck upgrade <bundle>:<version>     # non-interactive (e.g., citeck upgrade community:2026.1)
#
# Steps:
#   1. Pull latest workspace/bundle definitions from git (skipped for offline installs)
#   2. Show available releases with the current version marked (interactive only)
#   3. Confirm the upgrade (interactive only; skip with --yes/-y)
#   4. Apply selected version and reload

Interactive run:

$ citeck upgrade

# 1. Обновление workspace из git
# 2. Табличный выбор версии:
#    Community Bundles │ Enterprise Bundles
#    ──────────────────────────────────────
#    > 2026.1   (latest)  (current)
#      2025.12
#      2025.5
#
#    ←/→ переключить вкладку   ↑/↓ выбор   Enter подтвердить   Esc отмена
#
# 3. Если выбран другой бандл (Enterprise), может быть запрошен
#    логин/пароль для реестра Docker-образов.
# 4. Подтверждение: Upgrade community:2026.1 → enterprise:2026.1? [y/N]
# 5. Применение: namespace.yml обновляется, выполняется reload,
#    отображается интерактивная таблица статусов.

Non-interactive variant (for scripts and CI):

citeck upgrade enterprise:2026.1 --yes

Warning

Memory requirements differ between bundles: Community — ~14–16 GB RAM, Enterprise — ~24–32 GB RAM. Switching from Community to Enterprise on a server with 16 GB RAM will almost certainly result in an OOM. Before such an upgrade, disable optional applications via citeck stop <app> (see Troubleshooting, section “Out of Memory”) or increase RAM to the recommended amount.

setup 

Interactive settings editor.

citeck setup [setting]

Without arguments, opens the menu of all available settings. With an argument — goes directly to the specific setting.

Note

Full reference for YAML fields, default values, and data format for each setting: Configuration, section “Configuration via citeck setup”.

Available settings:

Setting	Description
`hostname`	Platform hostname or IP address
`tls`	TLS mode. The menu shows one of the following values: “Let’s Encrypt”, “Self-signed”, “Custom certificate”, or “HTTP only”.
`port`	Proxy server port
`email`	SMTP settings for sending emails
`s3`	S3-compatible storage settings
`auth`	Authentication type (Keycloak / Basic)
`resources`	Application resources (heapSize, memoryLimit)
`language`	CLI interface language
`admin-password`	Change the administrator password

Subcommands:

# История изменений конфигурации
citeck setup history

Examples:

# Открыть меню настроек
citeck setup

# Сменить пароль администратора
citeck setup admin-password

# Изменить hostname
citeck setup hostname

# Посмотреть историю изменений
citeck setup history

# Пример вывода history:
# DATE                 SETTING    FILE            DESCRIPTION
# 2026-04-10 08:30:00  hostname   namespace.yml   replace proxy.host = 203.0.113.45
# 2026-04-10 08:35:00  tls        namespace.yml   replace proxy.tls.enabled = true

When a setting is changed, the command:

Shows a diff before and after the change
Offers a choice: apply with reload, apply without reload, or cancel
Saves the changes and creates a history entry

setup hostname

Change the platform hostname or IP address.

citeck setup hostname

Note

If the entered value matches the already configured hostname, the command determines that there are no changes: it prints Nothing changed, does not add a history entry, and does not reissue the TLS certificate.

setup auth

Switch authentication mode between Keycloak and Basic.

citeck setup auth

Warning

Switching the authentication mode causes a restart of all web applications and Keycloak. On a server with 16 GB RAM, expect 5–10 minutes of platform downtime.

Do not switch the authentication mode while users are actively working — schedule the operation during a maintenance window.

setup history

View the namespace configuration change log.

citeck setup history

Entry types ( SETTING column):

Value	Meaning
`hostname`, `tls`, `port`, `email`, `s3`, `auth`, `resources`, `language`, `admin-password`	Changes applied via the corresponding `citeck setup <name>` subcommand.
`external_change`	The setting was changed outside the `setup` flow (e.g., by directly editing `namespace.yml` or by automatic normalization on the daemon side). The entry is added at the next configuration save.

setup admin-password

Change the unified administrator password for all platform services.

citeck setup admin-password

The command prompts for the new password (input hidden) and applies it to:

Keycloak (realm ecos-app) — platform administrator password, via kcadm.sh under the citeck service account
Keycloak (realm master) — password of the Keycloak administration console administrator, via kcadm.sh under the same service account
RabbitMQ — via rabbitmqctl change_password
PgAdmin — via setup.py

The citeck service account (used by the launcher for internal authorization in Keycloak and RabbitMQ) is NOT rotated by this command — its password remains stable so that the launcher does not lose access to the platform.

Warning

Expect 2–5 minutes of platform downtime. Although passwords are updated at runtime (without recreating infrastructure containers), web applications restart to pick up the new RABBITMQ_PASSWORD, causing HTTP endpoints to be unavailable (the platform returns connection errors) while they restart. On servers with many Java applications (Enterprise, 24+ apps) the actual downtime can reach 5–7 minutes.

Schedule command execution during a maintenance window.

Important

The citeck setup admin-password command changes the administrator password across all platform administrative UIs at once: Keycloak (realms ecos-app and master), RabbitMQ, and PgAdmin.

The citeck service account (a separate Keycloak / RabbitMQ user used by the launcher for internal API calls) is not affected — its password is generated once and remains stable. Therefore, changing the user administrator password never causes the launcher to lose access to Keycloak or RabbitMQ.

The master realm rotation is performed on a best-effort basis: if this step fails, the other components will already have the new password, and the error message will be written to the daemon log. The launcher will continue operating via the service account in any case.

setup email

Configure the SMTP server for sending platform notifications.

citeck setup email

Interactive flow:

Provider selection. First, the command asks you to choose an SMTP provider — e.g. Generic SMTP, Gmail, Outlook, and others. Appropriate default values (host, port, TLS) are pre-filled for each provider and can be overridden in the next step.
Parameter entry. Host, port, sender address, username, and password. The password is stored in the encrypted secrets store.
Application mode selection. Apply immediately (with reload), schedule for the next reload, or save without applying.

Note

Without authentication. If the SMTP relay accepts emails without a login/password, leave the “username” field empty — in this case SMTP authentication is disabled.

Note

Automatic mailhog removal. When a real SMTP server is configured, the built-in mailhog container (used as a dev stub) will be automatically removed on the next reload. The reverse is also true: if email settings are cleared, mailhog will reappear when the namespace is regenerated.

Note

For more details on the tls field (true / false) and port mapping, see Configuration, section “email”.

setup s3

Configure an S3-compatible object storage (Enterprise only, requires the ecos-content application).

citeck setup s3

The interactive flow prompts for endpoint, region, bucket, accessKey, and secretKey. The secret key is stored in the encrypted secrets store.

After entering the parameters, the CLI offers three application options:

Apply now — reload is performed immediately, the ecos-content application restarts with the new settings.
Apply on next reload — changes are written to namespace.yml but not applied immediately; they will take effect on the next citeck reload.
Save only — write the configuration without scheduling application.

Note

After configuring the S3 connection, log into the system and change the default-content-storage setting to “Content storage for S3”. Open the system settings section:

/v2/journals?journalId=ecos-configs&search=default-content-storage&viewMode=table&ws=admin$workspace

Find the default-content-storage entry and set its value to content/storage@content-storage-s3.

health 

Check system health.

citeck health

Return codes:

Code	Value
`0`	System is healthy
`1`	Daemon connection error
`8`	System is unhealthy (there are problematic components)

Example:

citeck health

# Пример вывода:
# Status: HEALTHY
#
#   [OK]     docker        — Docker Engine reachable
#   [OK]     disk_space    — 45 GB available
#   [OK]     postgres      — accepting connections
#   [OK]     keycloak      — realm accessible
#   [OK]     rabbitmq      — management API responding

# Использование в скриптах:
citeck health && echo "OK" || echo "FAILED"

diagnose 

Diagnose problems with the option to auto-fix them.

citeck diagnose [flags]

Flags:

Flag	Description
`--fix`	Automatically fix detected problems
`--dry-run`	Show what would be fixed without making any changes

Checks:

Presence of the socket file and daemon response (removal of stale socket)
Docker Engine availability
Sufficient disk space
namespace.yml configuration validity
Container state

Note

If at least one application is in the FAILED or START_FAILED state, diagnose escalates the corresponding check level to ERROR and prints a link to Troubleshooting. For each check that ended with a warning or error, a recommendation line is shown in the output (→ see docs: …).

Example:

citeck diagnose --fix

dump-system-info 

Collects full diagnostics (status, logs, system information, docker inspect) into a ZIP archive ./citeck-dump-<timestamp>.zip in the current directory. Intended for sending to support.

citeck dump-system-info [flags]

Flags:

Flag	Description
`--full`	Include full container logs without truncation (default: head 1000 + tail 2000 lines).

A detailed description of the archive contents and submission instructions — see Contacting support (section “Contacting Support” in Troubleshooting).

clean 

Clean up orphaned Docker resources.

citeck clean [flags]

Flags:

Flag	Description
`--force`	Perform the deletion (default — show only)
`--volumes`	Also scan and delete orphaned volume directories
`--images`	Remove unused (dangling) Docker images

Examples:

# Сухой запуск: показать, что будет удалено
citeck clean

# Выполнить очистку
citeck clean --force

# Полная очистка с удалением образов и томов
citeck clean --force --volumes --images

snapshot 

Manage namespace data snapshots (backup/restore).

citeck snapshot <subcommand>

Subcommands:

Subcommand	Description
`list`	Show available snapshots
`export`	Export data to a ZIP archive
`import`	Import data from an archive
`delete`	Delete a snapshot by name

Flags of snapshot import :

Flag	Description
`-d`, `--detach`	Do not wait for the namespace to reach `RUNNING` after import. By default the command waits for the platform to be ready.

Examples:

# Список снимков
citeck snapshot list

# Экспорт текущих данных
citeck snapshot export

# Экспорт в указанную директорию
citeck snapshot export --dir /backup/

# Импорт из снимка (имя из списка, с или без .zip)
citeck snapshot import citeck_2026-04-10_08-30-00

# Импорт без ожидания готовности платформы
citeck snapshot import citeck_2026-04-10_08-30-00 --detach

Note

When importing a snapshot, the command first verifies that the file exists, and only then stops the namespace. If the snapshot is not found, the namespace will not be stopped.

After import, the namespace restarts automatically.

Snapshot location

By default snapshots are stored in the namespace data directory: /opt/citeck/data/runtime/<namespace-id>/snapshots/. In the citeck snapshot import command you can specify either a filename from that directory (with or without the .zip suffix) or an absolute path to a ZIP archive in another location. The directory can be overridden for the duration of the export via the --dir flag.

Warning

Importing a snapshot triggers the sequence: stop namespace → restore volumes → restart. On a server with 16 GB RAM the full cycle takes approximately 10 minutes of downtime (up to 15 minutes on Enterprise). Plan the import during a maintenance window.

Note

Import can be run on a running platform — the launcher will stop the namespace before restoring data and restart it again after the import completes. There is no need to manually stop the namespace beforehand.

uninstall 

Fully uninstall Citeck Launcher.

citeck uninstall [flags]

Flags:

Flag	Description
`--delete-data`	Delete all data without prompting (for automation). Implies consent to data deletion and skips the standard confirmation phrase.
`--yes`	Skip the confirmation prompt (suitable for automation).

The command performs:

Stopping all applications and the daemon
Removing the systemd service
(Optionally) removing all data from /opt/citeck
Removing the binary /usr/local/bin/citeck

Examples:

# Интерактивное удаление
citeck uninstall

# Полное удаление для автоматизации (без запросов)
citeck uninstall --delete-data --yes

Warning

When the phrase drop all data is entered at the confirmation step, all platform data will be irreversibly deleted, including databases and configuration files.

Note

Interaction between --delete-data and confirmation. The --delete-data flag implicitly includes consent to data deletion and skips the standard drop all data confirmation phrase — i.e., it acts as --yes for that step. To keep a safe interactive scenario with manual confirmation, run citeck uninstall without --delete-data and make the data deletion decision in the dialog.

version 

Version information.

citeck version [flags]

Flags:

Flag	Description
`--short`	Print only the version number

Example:

citeck version

# Пример вывода:
# Citeck CLI 2.1.0
# Commit: 38ee6d0
# Built:  2026-04-10T12:00:00Z
# OS:     linux/amd64
# Go:     go1.24.2

exec 

Execute a command inside an application container.

citeck exec <app> -- <command>

Example:

citeck exec postgres -- psql -U postgres -c "SELECT version();"

config 

Manage namespace configuration.

citeck config [command]

Available subcommands:

Subcommand	Description
`view`	Prints the contents of `namespace.yml` from the running daemon
`validate`	Validates the namespace configuration

Note

Calling citeck config without a subcommand prints command help, not the contents of namespace.yml. To view the YAML, use citeck config view.

Examples:

# Показать текущий namespace.yml
citeck config view

# Проверить корректность конфигурации
citeck config validate

completion 

Generate a shell auto-completion script.

citeck completion <shell>

Supported shells: bash, zsh, fish, powershell

Example:

# Активация автодополнения для bash
source <(citeck completion bash)

# Постоянная установка
citeck completion bash > /etc/bash_completion.d/citeck