Commands and scripts

`celestian` subcommands

The same binary is used to run the server and for administration commands (in the api image).

Command	Purpose
`celestian --role=all`	Runs every role (the default in the image).
`celestian --role=api,brokerauth,...`	Runs specific roles, comma-separated: `api`, `brokerauth`, `presence`, `rules`, `reports`.
`celestian migrate`	Only runs the migrations and exits.
`celestian healthcheck`	Checks the local `/readyz` (used by the Docker `HEALTHCHECK`).
`celestian smtp-test <address>`	Sends one test e-mail with `SMTP_*` from the environment; prints the actual error if it fails.
`celestian hash-password`	Reads a password from stdin and prints the line `ADMIN_PASSWORD_HASH='…'` (at least 12 characters).

On the server, run from the deploy/ folder through Compose. --no-deps stops other services from starting, and -T is required when stdin is piped:

docker compose run --rm --no-deps api smtp-test recipient@example.com

read -rsp 'Admin password (min. 12 characters): ' PW; echo
printf '%s' "$PW" | docker compose run --rm --no-deps -T api hash-password
unset PW

The hash-password output is one line. Copy it as is, with single quotes, into deploy/.env.

Scripts in `deploy/scripts`

Script	Purpose
`gen-secrets.sh`	Creates `deploy/.env` from the sample with random secrets. Does not overwrite an existing `.env`. Run it once.
`backup.sh`	Backs up PostgreSQL and TimescaleDB; keeps `BACKUP_KEEP_DAYS` days.
`make-tls-cert.sh`	Creates your own CA and a server certificate for MQTTS.
`pull-tls-cert.sh`	Pulls a certificate from another server over SSH.

Docker Compose (from `deploy/`)

Command	Purpose
`docker compose config --quiet`	Validates compose and `.env`.
`docker compose pull`	Fetches images according to `API_IMAGE` and `WEB_IMAGE`.
`docker compose up -d`	Starts or applies changes to `.env` and images. `restart` alone does not read a new `.env`.
`docker compose ps`	Container status.
`docker compose logs -f api`	Logs (`web`, `fluxmq`, and others work too).
`docker compose down`	Stops the stack; the data in `DATA_DIR` stays.

Version

The application version appears in the About dialog (the user menu), with a warning when the API and web versions differ.