jabali CLI reference: every command with flags

The jabali binary is one cobra root with subcommands. Run jabali --help or jabali <cmd> --help for live flags.

This page lists every shipped subcommand grouped by area, with the one-line Short description from the binary and the exact verbs/flags. (Generated from panel-api/cmd/server/*.go.)

Global

jabali --help
jabali --version
jabali version                       # commit + runtime info
jabali serve                         # start the panel-api HTTP(S) server
jabali update                        # pull latest, rebuild, migrate, restart
jabali repair [--diagnose | --auto | --all --yes]
jabali diagnostic                    # encrypted diagnostic bundle
jabali release list                  # show current release + channel
jabali release promote [commit-ish]  # promote a build to the stable channel

Users & auth

jabali user list                                      # all panel users (direct DB, M20-safe)
jabali user create --username --email --package --primary-domain [--password]
jabali user delete <email|username|user-id>
jabali user password <email|username|user-id>         # rotate (auto-generated if omitted)
jabali user 2fa-reset <email|username|user-id>        # strip TOTP + recovery codes
jabali user --link <email>                            # emit Kratos recovery URL
jabali user suspend <id>                              # suspend user (cascade)
jabali user unsuspend <id>                            # reverse cascade
jabali user reprovision <email|username|id>           # re-sync Linux account with DB state

jabali user-token list <user-email|id>
jabali user-token mint <user-email|id> --name <name>  # mint API token, secret shown once
jabali user-token revoke <token-id>

jabali automation-token list                          # no secrets exposed
jabali automation-token mint <name>
jabali automation-token revoke <id>

jabali ssh-key list [--user <user>]
jabali ssh-key add
jabali ssh-key delete <key-id>

jabali package list
jabali package create
jabali package edit <package-id>
jabali package delete <package-id>
jabali package apply <package-id>                     # re-apply limits to all users

jabali account-restore                                # bypass-UI account restore

jabali session list [--user <user>]
jabali session revoke <session-id>
jabali session revoke-user <email-id>                 # sign out everywhere

Domains

jabali domain list                                    # direct DB, M20-safe
jabali domain create --user <id> --name <fqdn> [--php <ver>]
jabali domain enable  <name|id>
jabali domain disable <name|id>
jabali domain delete  <name|id>                       # reconciler tears down nginx
jabali domain browse  <name> [path]

jabali domain email-enable      <domain-id>           # generate DKIM
jabali domain email-disable     <domain-id>           # keep DKIM key
jabali domain email-dkim-rotate <domain-id>           # ADR-0043 rotate

jabali domain php-version set   <domain>
jabali domain php-settings get  <domain>
jabali domain php-settings set  <domain>

jabali domain dir-privacy add       <domain> --path /dir
jabali domain dir-privacy remove    <domain> <rule-id>
jabali domain dir-privacy cred-add  <domain> <rule-id> --user <name>
jabali domain dir-privacy cred-list <domain> <rule-id>

jabali domain ip-acl list   <domain>
jabali domain ip-acl add    <domain>
jabali domain ip-acl delete <acl-id>

jabali domain catchall show|set|clear <domain>
jabali domain disclaimer show|set|clear <domain>

PHP applications

jabali app registry                     # available app types + schema
jabali app list [--user <id>]
jabali app get <install-id|domain-name>
jabali app install --user <id> --domain <name> --app wordpress
jabali app delete <install-id|domain-name>
jabali app clone <src-install-id>       # WordPress only today
jabali app cache <install-id>           # enable/disable WordPress cache
jabali app cache-doctor [--repair]      # detect + optionally repair cache drift
jabali app refresh-cache-plugin         # update jabali-cache plugin on all sites
jabali app scan                         # find unregistered apps under a homedir
jabali app magic-link <install-id>      # 60 s one-time login link

Docker apps

jabali docker-app catalog               # list catalog entries
jabali docker-app install <slug>        # install a docker app
jabali docker-app list
jabali docker-app status <id>           # full state (DB row + agent)
jabali docker-app delete <id>           # uninstall + row removal
jabali docker-app logs <id>             # tail container logs
jabali docker-app update <id>           # pull image + recreate stack
jabali docker-app edit <id>             # edit domain/ports (container stops)
jabali docker-app patch <id>            # update settings (update mode, CPU/mem/PID)
jabali docker-app env                   # view / edit / regenerate env vars
jabali docker-app regenerate <id> <KEY> # mint a fresh generated secret
jabali docker-app exec <id> -- <cmd>    # one-off command in container
jabali docker-app backup-create <id>
jabali docker-app backups <id>          # list restic snapshots
jabali docker-app restore <id> <snapshot-id>
jabali docker-app parity                # audit DB rows vs docker reality
jabali docker-app engine status         # daemon health + userns-remap + storage
jabali docker-app tenant <sub>          # tenant-scoped mirror commands

Python apps

jabali python-app list
jabali python-app create                # same validation as UI
jabali python-app start|stop|restart|reload <app-id>
jabali python-app logs <app-id>
jabali python-app delete <app-id>       # stop + remove unit; files kept
jabali python-app env get <app-id>
jabali python-app env set <app-id> KEY=VAL [KEY=VAL ...]

Mail

jabali mailbox list [domain]
jabali mailbox create --email <e> [--quota-mib N] [--send-only]
jabali mailbox delete <email>
jabali mailbox set-quota <email> <mib>
jabali mailbox passwd <email>                        # auto-generated if --password omitted

jabali mailbox forwarder list <email>
jabali mailbox forwarder add <email>
jabali mailbox forwarder remove <forwarder-id>

jabali mailbox autoresponder set|show|clear <email>

jabali mailbox shares list <owner-email>
jabali mailbox shares add
jabali mailbox shares remove <share-id>

jabali mail-group list [domain]
jabali mail-group create <domain> <local-part>
jabali mail-group delete <group-id>
jabali mail-group add-member <group-id> <member-email>
jabali mail-group remove-member <group-id> <member-email>
jabali mail-group set-members <group-id> [members]
jabali mail-group set-resources <group-id>           # toggle shared collections

jabali mail deliverability                           # per-domain score

DNS

jabali dns list                                      # all zones
jabali dns record list   <domain>
jabali dns record add    <domain> --name <n> --type <T> --content <v>
jabali dns record update <domain> <record-id>
jabali dns record delete <domain> <record-id>

jabali dnssec enable  <domain>                       # generate KSK + ZSK
jabali dnssec disable <domain>
jabali dnssec status  <domain>
jabali dnssec ds      <domain>                       # DS records for the registrar

jabali pdns backfill                                 # sync recursor.forwards with DB

SSL

jabali ssl list
jabali ssl enable  <domain>                          # cert within ≤60 s
jabali ssl disable <domain>                          # cert will be revoked
jabali ssl renew   <domain>
jabali ssl issue [hostname|mail]
jabali ssl toggle [hostname|mail]

jabali cert set-custom                               # install custom cert + key

jabali mail-cert enable|disable|show <domain>
jabali mail-cert reissue <domain>                    # clear backoff, re-issue
jabali mail-cert mta-sts <domain>                    # ADR-0109 toggle

jabali panel-cert status
jabali panel-cert issue  [hostname|mail]
jabali panel-cert toggle [hostname|mail]
jabali panel-cert skip-auto-san <domain>             # opt in/out of auto-SAN

Databases

jabali db list
jabali db create
jabali db delete
jabali db backup  <db-id|db-name>                    # returns .sql path
jabali db restore <db-id|db-name>
jabali db processes
jabali db kill <process-id>

jabali db config get
jabali db config set param=value [param=value ...]
jabali db root-password rotate

jabali db user list
jabali db user create
jabali db user delete
jabali db user grant
jabali db user rotate-password <db-user-id>

Backups

jabali backup destination list
jabali backup destination create
jabali backup destination get    <id-or-name>
jabali backup destination update <id>
jabali backup destination delete <id>
jabali backup destination test   <id>                # connectivity
jabali backup destination rotate-password <id>       # rotate restic password

jabali backup retention apply                        # restic forget + prune

jabali backup schedule list
jabali backup schedule create
jabali backup schedule get    <id>
jabali backup schedule update <id>
jabali backup schedule delete <id>
jabali backup schedule run-now <id>                  # trigger immediately

jabali backup scheduler tick                         # one enqueue+dispatch pass (sync)

Cron

jabali cron list [--user <user>]
jabali cron add                                      # 5-field cron, allowlisted
jabali cron update <job-id>
jabali cron delete <job-id>
jabali cron run-now <job-id>                         # sync
jabali cron http-trigger <url>                       # internal self-domain fetcher

Migrations

jabali migrate up                                    # run pending DB migrations
jabali migrate import                                # run/resume 4-stage pipeline
jabali migrate pull-source                           # SSH + pull backup tarball
jabali migrate imap                                  # migrate remote IMAP into a mailbox
jabali migrate import-wp                             # import staged WP migration
jabali migrate refresh                               # force re-pull already-migrated account
jabali migrate restore                               # offline restore from cpmove
jabali migrate reap-secrets                          # wipe per-job env files

Security

# CrowdSec
jabali crowdsec decisions list|add|delete
jabali crowdsec allowlists list|add|remove
jabali crowdsec alerts                               # list / inspect
jabali crowdsec blocklists list                      # or refresh
jabali crowdsec geoblock set                         # mode + countries
jabali crowdsec captcha set                          # remediation config

# AppArmor / AIDE
jabali apparmor status                               # profiles + modes
jabali apparmor flip-mature                          # LEARNING -> ENFORCED
jabali aide status                                   # DB age + last check
jabali aide check                                    # on-demand integrity check
jabali aide rebuild                                  # re-baseline after deliberate change

# Malware
jabali malware scan <path|username>
jabali malware scan-status <session-id>
jabali malware events
jabali malware quarantine list
jabali malware quarantine restore <id>
jabali malware quarantine delete  <id>
jabali malware yara list
jabali malware yara upload <file.yar>
jabali malware yara delete <filename>
jabali malware yara toggle <filename>
jabali malware settings set
jabali malware-purge                                 # hard-delete old quarantine rows

# UFW + PHP defense
jabali ufw status
jabali ufw rule add    <ip|address>
jabali ufw rule delete <num>
jabali php-defense                                   # PHP defense operator commands

Notifications

jabali notification channels list
jabali notification channels create --name <n> --kind <email|slack|discord|ntfy|webhook|webpush|sms> --config <json>
jabali notification channels delete <id>
jabali notification channels test   <id>

jabali notification events list
jabali notification events set <event-kind> --enabled <true|false>

jabali notification broadcast --title <t> [--body <b>] [--severity ...]

jabali notification dlq list
jabali notification dlq replay      <id>
jabali notification dlq replay-all
jabali notification dlq drop        <id>
jabali notification dlq clear

Audit

jabali audit query [--user <u>] [--domain <d>]       # recent audit events
jabali audit verify                                  # recompute hash chain, report tamper
jabali audit prune --days <n>                        # delete rows older than N days

PHP versions & pools

jabali php version list
jabali php version install <version>
jabali php ext list <version>

jabali php pool list
jabali php pool get    <user>
jabali php pool set    <user>                        # set user's PHP version
jabali php pool create
jabali php pool delete <pool-id>
jabali php pool reapply-all                          # mark all pools pending (re-render)

jabali php pool ini list   <pool-id>
jabali php pool ini add    <pool-id>
jabali php pool ini update <override-id>
jabali php pool ini remove <override-id>

System & admin

jabali settings get
jabali settings set key=value [key=value ...]

jabali service start|stop|restart|reload|enable|disable

jabali admin diag bundle                             # encrypted support tarball
jabali admin sso rotate-key
jabali admin sso reap                                # sweep orphan jabali-sso-*.php files
jabali admin slice cutover                           # M9 per-user PHP pool slice cutover (one-time)
jabali admin panel primary                           # set / show panel primary user

jabali disk-usage show    <username|id>
jabali disk-usage refresh <user-email|id>

jabali nspawn list
jabali nspawn build                                  # debootstrap immutable rootfs
jabali nspawn prune                                  # remove sealed images not pinned

jabali per-user-egress get         <email-id>
jabali per-user-egress set-policy  <email-id>
jabali per-user-egress requests                      # pending admin queue

jabali impersonation create --admin <a> --target <u> # 60-min grant
jabali impersonation list [--admin <a>]
jabali impersonation end <grant-id>

jabali ip-manager list
jabali ip-manager add    <address>
jabali ip-manager delete <id>
jabali ip-manager update <id>

jabali shared-resource list    <domain>
jabali shared-resource create
jabali shared-resource remove  <id>
jabali shared-resource grants  <id>
jabali shared-resource grant   <id>
jabali shared-resource revoke  <id>

jabali backfill-usernames                            # assign username to users missing one

jabali log access                                    # mint / revoke log-stream grants
jabali log list
jabali log create --user <u> --type <t> [--domain <d>]  # 15-min grant

jabali limits apply <username>                       # re-apply effective limits
jabali limits check                                  # probe host for M18 prerequisites

jabali files list <path>
jabali files read <path>
jabali files download <path> --out <f>
jabali files write <path>
jabali files mkdir <path>
jabali files chmod <path> <mode>
jabali files move <path>
jabali files copy <path> --to <dest>
jabali files archive <path...> --out <f>             # tar.gz
jabali files extract <archive-path>

New since the last CLI reference

Docs before this rewrite pre-dated whole subsystems. New / substantially expanded areas:

• python-app — Python 3.8–3.14 apps managed as systemd units (see Python Apps).
• docker-app — 40+ compose stacks with catalog, install, backups, tenant mirror (see Docker Apps).
• backup destination / backup schedule — multi-destination restic (ADR-0080), replaces the older single-backup apply flow.
• crowdsec allowlists / geoblock / captcha / blocklists — beyond just decisions.
• malware YARA + quarantine + settings — full malware surface.
• notification DLQ + replay + broadcast + WebPush + ntfy channels — ADR-0094.
• audit — unified tamper-verified audit log (ADR-0106).
• domain dir-privacy / ip-acl / email-dkim-rotate / catchall / disclaimer — per-domain admin surface expanded.
• mailbox forwarder / autoresponder / shares / mail-group — full user mail surface.
• per-user-egress — M34 per-user firewall policies + admin request queue.
• shared-resource — M52 shared mail resources (calendars, contacts, files).
• impersonation / session revoke-user / log access — extended operator tooling.
• release list / release promote — release channel + promotion pipeline.