CLI Reference

glidesh (no subcommand)

Running glidesh with no subcommand opens the interactive console against ./inventory.kdl if one exists in the current directory. Equivalent to glidesh console.

cd my-fleet/
glidesh                       # opens the console TUI

If no inventory is present in the working directory, glidesh exits with an error suggesting --inventory <path>.

glidesh console

Connection console: opens the interactive TUI when invoked with no --target and no --command; otherwise behaves like a shell — interactive PTY for a single host, broadcast TUI for multiple hosts, or one-shot exec when --command is set. See the dedicated Console page for full details on the TUI.

glidesh console [OPTIONS]

Flag	Short	Description	Default
--inventory <PATH>	-i	Path to the inventory file	./inventory.kdl
--target <NAME>	-t	Target filter: group name, host name, or group:hostname	—
--command <CMD>	-c	Command to run (skips the TUI; runs on resolved targets)	—
--key <PATH>	-k	SSH private key path	~/.ssh/id_ed25519
--concurrency <N>	—	Max concurrent hosts when running a command (minimum 1)	10
--no-host-key-check	—	Skip SSH host key verification	false
--accept-new-host-key	—	Accept and save unknown host keys	false

Mode selection

--target	--command	Behavior
—	—	Console TUI (requires a TTY)
single host resolved	—	Interactive PTY shell
multiple hosts resolved	—	Broadcast group shell TUI
any	set	Run command, stream [hostname]-prefixed output

Examples

Interactive PTY on a single host:

glidesh console -i inventory.kdl -t web-1

Run a command across a group, stream prefixed output:

glidesh console -i inventory.kdl -t web -c "df -h /"

[web-1] /dev/sda1  50G  40G  10G  80% /
[web-2] /dev/sda1  50G  25G  25G  50% /
[web-3] /dev/sda1  50G  45G   5G  90% /

Broadcast TUI across a group (no -c):

glidesh console -i inventory.kdl -t web

The console resolves SSH keys using the same resolution order as run.

glidesh run

Execute a plan against target hosts.

glidesh run [OPTIONS]

Flag	Short	Description	Default
--plan <PATH>	-p	Path to the plan file	—
--inventory <PATH>	-i	Path to the inventory file	—
--target <NAME>	-t	Target filter: group name, host name, group:hostname, or a comma-separated list of any of these	—
--host <ADDR>	—	Single host for ad-hoc mode	—
--user <USER>	-u	SSH user (ad-hoc mode only)	root
--port <PORT>	-P	SSH port	22
--key <PATH>	-k	SSH private key path	~/.ssh/id_ed25519
--command <CMD>	-c	Ad-hoc command to run	—
--mode <MODE>	-m	Execution mode: sync or async	sync
--concurrency <N>	—	Max concurrent hosts	10
--dry-run	—	Check only, no changes applied	false
--no-tui	-T	Disable TUI, use plain text output	false
--no-host-key-check	—	Skip SSH host key verification	false
--accept-new-host-key	—	Accept and save unknown host keys to known_hosts	false
--secrets <PATH>	—	Path to the secrets file	secrets.kdl next to the inventory
--ask-secret-pass	—	Prompt for the secrets passphrase (else GLIDESH_SECRET_PASS)	false
--secret-pass-file <PATH>	—	Read the secrets passphrase from the first line of a file	—
--secret-identity <PATH>	—	SSH private key that unlocks an age-wrapped secrets file	--key, else ~/.ssh/id_ed25519

SSH Key Resolution

The SSH private key is resolved in this order (first match wins):

1. --key CLI flag
2. ssh-key variable from the inventory (global, group, or host vars)
3. ~/.ssh/id_ed25519 (default)

Ad-hoc mode

Run a single command on a host without a plan or inventory:

glidesh run --host 192.168.1.10 -u deploy -c "uptime"

Plan mode

Run a plan against an inventory:

glidesh run -i inventory.kdl -p plan.kdl

Filter to a specific group or host:

glidesh run -i inventory.kdl -p plan.kdl -t web
glidesh run -i inventory.kdl -p plan.kdl -t web-1

Run on an arbitrary subset by passing a comma-separated list of targets — each token can be a group name, a host name, or group:host:

glidesh run -i inventory.kdl -p plan.kdl -t web-1,web-3,db-1

When --plan is omitted, each resolved target uses its own plan= (host-level wins over group-level); targets without an associated plan are skipped.

Ad-hoc host with a plan

Combine --host with --plan to run a plan against a single host without an inventory file:

glidesh run --host 192.168.1.10 -u deploy -p plan.kdl

The host uses the --user (default root) and --port (default 22) flags. Plan vars are applied as usual.

Inventory-linked plans

When --plan is omitted but --inventory is provided, glidesh runs the plan= attributes defined in the inventory (per-group or per-host). See Inline Plans.

glidesh run -i inventory.kdl

glidesh logs

View logs from past runs. Logs are stored in ~/.glidesh/runs/.

glidesh logs [OPTIONS]

Flag	Description
--last	Show the last run
--node <NAME>	Filter by node name
--run <DIR>	Specific run directory

glidesh logs --last
glidesh logs --last --node web-1
glidesh logs --run 20250115_143022_setup

glidesh validate

Validate configuration files without executing anything.

glidesh validate [OPTIONS]

Flag	Short	Description
--plan <PATH>	-p	Validate a plan file
--inventory <PATH>	-i	Validate an inventory file

glidesh validate -p plan.kdl
glidesh validate -i inventory.kdl
glidesh validate -p plan.kdl -i inventory.kdl

A secrets.kdl discovered beside the inventory is parsed too, so a malformed provider block or an unknown provider is caught here rather than mid-run. Only the file is parsed — validation never asks for the passphrase and never decrypts a value.

glidesh secret

Manage encrypted secrets. See Secrets for the full workflow and how values are decrypted and redacted at run time.

glidesh secret <COMMAND>

Command	Description
init	Create a secrets file and generate + wrap a data key. --provider age --recipient <KEY_OR_PATH> wraps it to SSH public keys instead of a passphrase (repeatable)
list	List the names in the file and whether each is encrypted (no passphrase needed)
set <KEY> [VALUE]	Encrypt a value under a key (prompts for the value if omitted)
get <KEY>	Decrypt and print a stored value. Pass a secret:v1:… token instead of a key to decrypt it directly
decrypt <KEY>	Alias for get
rm <KEY>	Delete a value from the file (alias: remove)
encrypt	Read plaintext on stdin, print a secret:v1:… token
rekey	Re-wrap the data key under a new passphrase (value tokens unchanged)
rekey --rotate-data-key	Generate a new data key and re-encrypt every value in the file under it
recipients list	Show who can unlock an age-wrapped file (no key needed)
recipients add <KEY_OR_PATH>	Grant access to another SSH public key
recipients rm <NAME>	Revoke a recipient, rotating the data key unless --keep-data-key
edit	Open the secrets file in $VISUAL/$EDITOR with values transiently decrypted

Every subcommand accepts --file <PATH> (default secrets.kdl). The passphrase comes from GLIDESH_SECRET_PASS, then GLIDESH_SECRET_PASS_FILE, then an interactive prompt. list and rm need no passphrase at all. rekey takes the new passphrase from --new-pass-file <PATH> when given, since the ordinary sources already hold the current one. An age-wrapped file takes an SSH private key instead of a passphrase: --secret-identity <PATH> is accepted by every secret subcommand and may be given before or after it, falling back to GLIDESH_SECRET_IDENTITY and then ~/.ssh/id_ed25519.

glidesh secret get db-password --secret-identity ~/.ssh/work_ed25519

glidesh secret init
glidesh secret set db-password
GLIDESH_SECRET_PASS=… glidesh secret get db-password

Environment Variables

Variable	Description
RUST_LOG	Control log verbosity. Default is glidesh=info. Set to glidesh=debug or glidesh=trace for troubleshooting.
GLIDESH_SECRET_PASS	Secrets passphrase, for non-interactive run / secret commands (else --ask-secret-pass / prompt).
GLIDESH_SECRET_PASS_FILE	Path to a file whose first line is the secrets passphrase. Honoured by every subcommand; outranked by --secret-pass-file and GLIDESH_SECRET_PASS.
GLIDESH_SECRETS	Path to the secrets file, overriding auto-discovery.
GLIDESH_SECRET_IDENTITY	SSH private key that unlocks an age-wrapped secrets file. Honoured by every subcommand; outranked by --secret-identity.
GLIDESH_RUNAS_PASS	Privilege-escalation password for run-as (else --ask-pass).

RUST_LOG=glidesh=debug glidesh run -i inventory.kdl -p plan.kdl