Commands Reference

Every command available in the Granite console client. Generated from the CLI source at granite-so/cli — if something here disagrees with novps <command> --help, the CLI is right and this page is stale.

The binary is novps. Install it with curl https://cli.granite.so | sh, then authenticate with a Personal Access Token from the dashboard.

Global options

Every command accepts these.

Destructive commands (apps delete, resources delete, databases delete, storage delete, storage keys regenerate and the sub-command deletes) prompt you to type DELETE and exit with a non-zero code if you do not. --force skips the prompt — that is what makes them usable from CI and from an AI agent.

novps apps apply --wait exits non-zero when the deployment does not reach success, so a deploy step fails a pipeline instead of passing quietly.

Configuration

Authorization

Commands related to authentication. The token is validated with a test API call before it is saved.

novps auth login

Authenticate with a Personal Access Token.

Tokens start with nvps_. Reading the token from the environment keeps it out of shell history, which is what you want in CI.

novps auth logout

Remove the saved authentication token.

novps auth status

Show current authentication status: whether you are authenticated, and a truncated token prefix for identification.

Applications

An application is the scope that holds your resources. apply is the command most workflows are built on: it creates or updates the whole application from a YAML manifest and is idempotent, matching resources by name.

novps apps list

List all applications in the project. Output columns: ID, Name, Resources, Created At.

novps apps resources

List resources belonging to an application. Output columns: ID, Name, Type, Public Domain, Replicas, Schedule.

novps apps apply

Create or update an application from a YAML manifest. The application name is the CLI argument, not a field in the file, so the same manifest can create my-api-staging and my-api-prod.

${VAR} references are substituted locally before the manifest is sent — from --env-file first, then the shell environment, which wins on conflict. An undefined variable is an error, not an empty string. A $VAR reference without braces is left alone and resolved by Granite from the application's own environment variables at deploy time.

A manifest with source_type: github requires the Granite GitHub App on the repository; the CLI checks this before applying and stops with an explanation if the integration is missing.

novps apps export

Export an existing application as a YAML manifest compatible with apply. This is how you adopt an application created in the dashboard.

Registry credentials are never returned: the export always writes credentials: ''.

novps apps deploy

Trigger a manual deployment for every resource in the application.

novps apps update

Update an application's name or description. At least one of the two is required.

novps apps delete

Delete an application and all of its resources (soft delete).

Resources

A resource is one deployable unit inside an application: a web-app, a worker or a cron-job. update is the general form; scale, set-image and set-env are shortcuts for the fields you change most often.

novps resources get

Show detailed information for a resource.

novps resources logs

View resource logs.

novps resources connect

Open an interactive shell in a running container — the terminal equivalent of the Console tab in the dashboard.

novps resources deploy

Trigger a manual deployment for a single resource.

novps resources update

Update a resource's configuration. At least one flag is required. A deployment is triggered unless you pass --no-deploy.

novps resources scale

Change replica size and count. Shortcut for update --replicas.

novps resources set-image

Update the image, tag and/or registry credentials. Shortcut for update.

The credentials field in a manifest is read only when the resource is created — on later applies it is ignored. That is deliberate, so a committed file never has to carry a secret. Set and rotate credentials here instead, reading the value from the environment to keep it out of shell history.

novps resources set-env

Set resource environment variables.

novps resources delete

Delete a resource (soft delete).

Secrets

novps secrets list

List secret keys for an application or a single resource. Values are masked unless you ask for them.

novps secrets get

Get a single secret value by key name.

Databases

Managed PostgreSQL, MySQL and Redis. Databases are not declared in the application manifest — create them here, then pass the connection string into the application through envs and --env-file, and grant access with databases allow-apps.

Databases are never exposed publicly. Use novps port-forward database to reach one from your machine.

novps databases list

List databases in the project.

novps databases get

Show detailed information for a database.

--format env prints DB_ENGINE, DB_HOST, DB_PORT, DB_USER, DB_NAME and DB_PASSWORD, adding DATABASE_URL when --show-password is given — which makes it a one-liner to seed a local .env.

novps databases create

Create a new database.

novps databases resize

Resize a database. Only scaling up is allowed.

novps databases allow-apps

Set the list of applications allowed to reach this database. Passing no --app clears the allowlist.

novps databases delete

Delete a database.

Read-only replicas — novps databases replica

PostgreSQL only. One replica per database.

Backups — novps databases backups

PostgreSQL and MySQL.

Connection pools — novps databases pool

PostgreSQL only.

Logical databases — novps databases db

The individual databases inside one instance. PostgreSQL and MySQL.

novps databases pg-db is kept as a hidden alias for db. Use db in new scripts.

Users — novps databases user

Users inside one instance. PostgreSQL and MySQL. The generated password is printed once, on creation.

novps databases pg-user is kept as a hidden alias for user. Use user in new scripts.

Registry

novps registry list

List the namespaces in the Granite Docker registry.

Storage

S3-compatible buckets. Buckets and keys are addressed by their unique identifier — internal_domain for a bucket, internal_name for a key — not by display name, because display names are not guaranteed unique within a project. Run the matching list command to see the identifier in the first column.

novps storage list

List buckets, with their origin and CDN endpoints.

novps storage create

Create a bucket. A unique identifier suffix is appended to the display name automatically; the identifier to use afterwards is internal_domain in the output.

novps storage set-access

Change a bucket's access policy.

novps storage delete

Delete a bucket. Every object in it is permanently removed.

Files — novps storage files

Upload a local file through a pre-signed URL.

Rename, that is move, a file within a bucket.

Access keys — novps storage keys

The secret is shown once, on success. There is no way to read it again — regenerate the key instead.