stackkit advanced change-set, stackkit advanced origin-certificate, stackkit advanced restore-drill, stackkit advanced rollback, stackkit advanced trust
stackkit advanced change-set
Manage offline-authorized Terramate change sets.stackkit advanced change-set apply, stackkit advanced change-set create
stackkit advanced change-set apply
Apply an exact Owner-approved Terramate change set.stackkit advanced change-set create
Create an Owner-signed Terramate change set.stackkit advanced origin-certificate
Manage the Cloudflare Origin CA certificate of managed kombify.me origins.stackkit advanced origin-certificate install, stackkit advanced origin-certificate request
stackkit advanced origin-certificate install
Verify and install the delivered origin certificate.stackkit advanced origin-certificate request
Generate the node-local origin key pair and print its CSR.stackkit advanced restore-drill
Run capability-gated native restore drills.stackkit advanced restore-drill run
stackkit advanced restore-drill run
Stage and verify a restore of a backup anchor without activation. Run a native v2 restore drill as an Advanced operation. The drill is admitted only with an offline-verified capability that allows restore.drill, the local Owner-approved issuer trust, and explicit--owner-approve. It verifies the current runtime, creates a new snapshot anchor (or validates --anchor in local custody), stages a restore of that anchor, verifies the staged tree, removes the staging area, and verifies that the live runtime is unchanged. Staged data is never activated.
Examples
stackkit advanced rollback
Run capability-gated coordinated rollbacks across Terramate stacks.stackkit advanced rollback run
stackkit advanced rollback run
Roll every local Terramate stack back to one verified checkpoint. Roll the local host back to one verified executor-state checkpoint as the Advanced operation rollback.coordinated. The rollback is admitted only with an offline-verified capability that allows rollback.coordinated, the local Owner-approved issuer trust, and explicit--owner-approve. --to names the checkpoint directly or the change set whose pre-apply checkpoint is the target. Stacks run in reverse run order: stacks added after the checkpoint are destroyed through OpenTofu (docker compose down without volumes) and removed, changed stacks get the checkpoint’s state, configuration and payload back and are forced to converge, and stacks removed after the checkpoint are recreated. The checkpoint’s StackSpec and Inventory are restored and regenerated before the stacks run; afterwards joined apply and verify children record and verify the checkpoint’s Apply evidence. An interrupted rollback resumes on the next run with the same --to and skips stacks that already converged.
Examples
stackkit advanced trust
Manage the local Owner-approved Advanced issuer trust.stackkit advanced trust import, stackkit advanced trust inspect