Cipi 5.8.5 · Now available

Your server just got
a serious promotion.

Laravel Octane on FrankenPHP — the framework stays in memory, next to classic FPM apps. Reverb for WebSockets. PostgreSQL beside MariaDB, chosen per app. 5.8.4 says whether a deploy is running right now, whoever started it — cipi deploy <app> --status — and the panel shows it live; 5.8.5 writes the panel API's IP whitelist atomically and names the cause when /etc/cipi is read-only. 5.8 gives every app an environment label — a staging app reads cipi-staging.yml before cipi.yml, and deploy.branch in each file picks the branch. 5.8.2 makes the installer wait until you have saved the credentials, has cipi api and cipi gui check the DNS and issue the certificate themselves, prints the credentials again with cipi credentials, and signs you into the panel through Entra ID or Google. 5.8.1 fixes cipi deploy exiting 1 after a successful deploy. 5.7.0 moves the panel API or the GUI to a new domain with one command — tokens, admins and history stay, the certificate follows — and keeps a panel off the domain of an app. 5.6.3 brings in the PHP security release of 2026-10-21: cipi php upgrade runs every night, says which PHP — and which Octane binary — is still vulnerable, and every FPM pool closes the two known attack paths. 5.6.2 keeps PostgreSQL intact when a restore fails — wipe and import in one transaction, empty dumps refused. 5.2 adds opt-in CrowdSec: engine and a registered firewall bouncer, no WAF. 5.3 puts Cloudflare Zero Trust one opt-in command away — tunnel, Access, a dark origin — watches the server itself every five minutes, and sends every alert to Slack, Discord, Telegram or ntfy as well as email. 5.3.1 hands your auditor a read-only evidence bundle, and moves sites or hands a path to another service without touching a vhost. 5.4 deploys Next.js, Nuxt, SvelteKit, Astro and Vite apps next to Laravel — blue/green for SSR — and writes every deploy, however it started, into a hash-chained ledger. 5.5 tells you which app is filling the disk and alerts before it does, keeps app users out of SSH, and gives every client's Cloudflare account its own token. 5.5.1 makes wildcard certificates install and renew end to end — Cipi writes the HTTPS vhost itself — and cipi/sdk brings the panel API to PHP and Laravel. 5.5.2 lets that API, cipi-cli disk and the control panel answer which app is filling the disk, and makes cipi.yml name the asset build, the pre-deploy snapshot and the backup profiles the same way the server does. 5.6 walks you through cipi app create with menus, checks the deploy key can read your repository before you leave the wizard, and ships one backup to as many S3 buckets as you like. Same one-command server. Everything Cipi 5, tagged by release.

See everything new Upgrade in one line
root@vps — cipi
cipi self-update
✓ release 5 fetched
✓ migrations applied
✓ vhosts, pools & templates regenerated
cipi app create myapp --domain=myapp.com --octane
✓ FrankenPHP · Octane port 8100
✓ PostgreSQL · Reverb
# cipi git check · backup destination add
The headlines
01 — The headlines

Fifty reasons to
update tonight.

Everything Cipi 5 adds, at a glance. Tiles tagged since 5.0 shipped with Cipi 5; since 5.2, since 5.3, since 5.4, since 5.5, since 5.5.1 and since 5.6 are new in this line; cipi/sdk is the PHP client of the panel API, installed with Composer. Tap any tile to jump into the docs.

Headline feature
01 since 5.0

Laravel Octane
on FrankenPHP.

Boot the framework once and keep it in memory. Octane apps and classic PHP-FPM apps run side by side on the same server — Nginx proxies to the Octane process, Supervisor keeps it alive, every deploy reloads it cleanly.

cipi app create myapp --domain=myapp.com --octane
02 since 5.0

PostgreSQL, alongside MariaDB.

Two engines on one box. Pick per app or set a server-wide default — env, backups and restores follow.

cipi db install pgsql
03 since 5.0

Laravel Horizon

Supervised, and restarted on every release.

cipi worker horizon enable
04 since 5.0

Laravel Reverb

WebSockets done properly since 5.1.2: generated credentials, wss:// from the certificate, a proxy that no longer swallows /appointments.

cipi app reverb enable
05 since 5.0

Your frontend builds on the server

Run the build inside the release, right after dependencies. Fail-closed, so broken assets never reach production — and compiled files never reach your repository.

cipi app edit myapp --node-build='npm ci && npm run build'
06 since 5.0

Scheduler switch

Cron on or off per app, from the CLI.

cipi schedule on myapp
07 since 5.0

Convert FPM ⇄ Octane

Switch runtime on a live app, both ways.

cipi app convert myapp --to=octane
08 since 5.0

A snapshot before every risky migration

Opt in per app or per deploy and Cipi dumps the database before the release goes out. A bad migration becomes recoverable instead of fatal.

cipi deploy myapp --snapshot-required
09 since 5.0

Instant staging

Clone a production app onto a new domain.

cipi app clone myapp --domain=stage.myapp.com
10 since 5.0

Resource limits

No app can starve the box any more.

cipi app limits myapp --memory-limit=256M
11 since 5.0

Wildcard certificates, without the HTTP dance

Issue and renew through a Cloudflare DNS-01 challenge when a public HTTP endpoint isn't an option. HTTP-01 stays the default.

cipi ssl install myapp --dns=cloudflare --wildcard
12 since 5.0

Health checks

Every 5 minutes. Email after 3 failures.

cipi health set myapp --url=…
13 since 5.0

One canonical host

www or apex, aliased and 301'd for you.

cipi www force-to-root myapp
14 since 5.0

Re-force HTTPS

Restore the redirect without reissuing.

cipi ssl force myapp
15 since 5.1

Backup profiles, not one hardcoded job

Scope, schedule, destination and retention per profile. A 30-minute local database copy next to an encrypted nightly full copy on S3. Files and databases stored separately; tenant databases discovered from the engine. Retention is mandatory.

cipi backup profile add
16 since 5.1

Guided php.ini

See every tunable and which layer set it. Writes FPM and CLI together, server-wide or --app=. Whitelist only.

cipi ini set upload_max_filesize=50M
17 since 5.1

cipi.yml travels with the code

Aliases, PHP, extra databases, workers, healthcheck and backups — in the repo. plan, apply, auto after every deploy. Fail-closed: it never creates an app and never runs a shell command.

cipi yml generate myapp
18 since 5.1

Unknown Host → 444

A request matching no app used to land on a random vhost. Now :80 and :443 close it with an empty reply.

cipi nginx default-server on
19 since 5.1

Post-deploy health, optional rollback

The release that just went live is probed immediately — not after three five-minute failures. Opt in to roll it back automatically. Migrations are not undone; the email says so.

cipi health set myapp --rollback-on-unhealthy
20 since 5.1

Wildcard aliases

Multi-tenant apps need *.example.com. Nginx already could; Cipi now accepts it.

cipi alias add myapp '*.example.com'
Security release
21 since 5.2

CrowdSec, engine
and bouncer.

Opt-in IP reputation that reads the logs your vhosts actually write. The engine ships with a registered firewall bouncer, because decisions without one ban nothing at all. It refuses to start behind an unconfigured reverse proxy, and it allowlists the SSH session you enable it from. There is no WAF.

cipi crowdsec enable
22 since 5.2

A way back in

A high-port TLS listener and a one-shot token. One GET allowlists your IP and unbans it in CrowdSec and fail2ban. Not a login, not an SSH key.

cipi crowdsec rescue rotate
23 since 5.2

Nightly integrity check

sha256 of the live release against the manifest written at deploy, then ClamAV over the upload directories only. 04:40, every night.

cipi scan enable
24 since 5.2

Tab-completion, installed for you

bash and zsh, written by setup.sh and every self-update. Verbs, sub-commands, flags and your app names. No dotfile to edit.

cipi app <TAB>
Scout, on the box
25 since 5.2.2

Meilisearch for
Laravel Scout.

A single Rust binary next to Nginx — not a container. Listens on 127.0.0.1. Cipi writes the index prefix so two apps cannot share a key. Opt-in: nothing installs until you ask.

cipi search enable myapp
26 since 5.2.2

An allowlisted apt

Image optimisers, ffmpeg, convert, pdftotext — from Ubuntu's repos, and only those. The allowlist is the feature. Chromium is refused on purpose.

cipi package install imagemagick
Six forges
27 since 5.2.3

Git beyond GitHub
and GitLab.

Cursor Origin, AWS CodeCommit, Bitbucket Cloud and Azure DevOps — recognised from the clone URL, the same way GitHub always was. Save the credentials, create the app, and Cipi registers the deploy key and the webhook where the forge has one.

cipi git bitbucket-token <token>
cipi.yml
28 since 5.2.3

Post-deploy steps
that live in the repo.

Declare deploy.post and the steps run from the live release after every deploy — cipi deploy and the webhook alike. Allowlisted runners only: artisan, npm, composer, one php or node script. No free shell, and no yml auto required.

cipi yml post-deploy myapp
29 since 5.2.3

The upgrade switch for the rest of the stack

Nginx, MariaDB, PostgreSQL and Valkey stay off unattended-upgrades on purpose — a database restart is not a 4am surprise. Now you have the switch: patch-level, scoped, and never on a cron.

cipi db upgrade mariadb
30 since 5.2.3

Your cipi.yml is not a public URL

A custom app serves htdocs/, so a committed cipi.yml answered over HTTP. Every vhost now denies it at any path, Laravel included — applied on update, without touching certbot's block.

cipi self-update
Cloudflare
31 since 5.3

Zero Trust,
one step at a time.

A locally-managed Cloudflare Tunnel, Nginx that logs the real visitor, fail2ban taught the edge ranges — and not a single port closed. Route an app, put Access in front of staging or the GUI, carry SSH over the tunnel. Opt-in, like CrowdSec.

cipi zt enable
Origin dark
32 since 5.3

Close the ports
only when it is safe.

lock http refuses while an app still renews over HTTP-01, then closes 80/443 — or lets only Cloudflare in. lock ssh refuses unless the tunnel already carries SSH. The way back is one command.

cipi zt lock ssh --yes
33 since 5.3

A monitor that only speaks when it matters

Disk, certificate expiry, services, queue workers, 5xx spikes, read-only filesystems, load — every five minutes. One alert when it breaks, one when it recovers, a reminder while it stays broken. No dashboards.

cipi monitor list
34 since 5.3

Every alert, in the chat you already read

Slack, Discord, Telegram, ntfy or a JSON webhook, for every trigger Cipi already had — deploys, backups, scans, logins, the monitor. A five-second timeout, so a dead webhook never stalls a deploy.

cipi notifications channel add slack ops
Audit
35 since 5.3.1

Evidence your auditor
will actually accept.

Seventeen read-only controls mapped to ISO/IEC 27001:2022 and SOC 2 — SSH, firewall, patching, TLS, accounts, API tokens, deploys, backups, logging. A root-only bundle with the raw output behind every finding, checksummed. No secrets inside, and the gaps stated up front.

cipi compliance report
36 since 5.3.1

Move a site in one hop

Every name of the app, www included, to the new home — path and query kept, certificate still renewing. Or redirect single paths and prefixes. Stored in apps.json, so no vhost rebuild ever drops them.

cipi redirect set old --to=https://new.com
Nginx
37 since 5.3.1

Hand a path
to another service.

/api/ to a Node service, /events/ unbuffered for SSE — WebSocket and forwarded headers included. Ports Cipi already uses are refused, and if nginx -t fails, everything is put back.

cipi proxy add myapp /api/ http://127.0.0.1:3000
Headline feature
38 since 5.4

Next.js, Nuxt, SvelteKit
and Astro — deployed.

Node apps are a real app type now. A Vite SPA with client routes that survive reload, a pre-rendered site with real 404s, or an SSR server that switches blue/green only after the new release answers its health path. Releases, rollback, webhook and SSL, same as Laravel.

cipi app create --node=ssr --framework=next
39 since 5.4

Node runtimes, verified.

Official builds checked against SHASUMS256.txt, one server-wide default for Laravel asset builds, and per-app pins. Node 20 is end of life — servers move to 22.

cipi node default 22
Audit
40 since 5.4

Every deploy on the record.

CLI, panel, webhook, dep over SSH or an MCP client inside the app — root reads the origin, operator and commit from /proc, keeps the app's claims apart, and chains each line to the one before it. Mirrored to syslog.

cipi deploy myapp --audit
cipi.yml
41 since 5.4

The whole app,
in one committed file.

www redirect, basic auth by hash, redirects and proxies, Meilisearch, recipe options, limits, forced HTTPS, required .env names, crons and a Node app's build — and the panel API 1.31 plus the GUI drive the same features from the browser.

cipi yml plan myapp
Headline feature
42 since 5.5

Which app is
eating the disk?

The monitor says the disk is filling up; cipi disk says who. Every filesystem, then every app, largest first — files, database, total and share of the disk. cipi disk db adds every MariaDB, PostgreSQL, Valkey and Meilisearch database in MB, including the ones no app owns. Since 5.5.2 the panel API (1.33), cipi-cli disk and Server → Disk in the GUI read the same figures.

cipi disk
43 since 5.5

A disk limit that warns,
never blocks.

Give an app a number of GB for files and database together. At 90% you get a warning, over it a critical alert, back under a recovery — by email and every chat channel. The app keeps writing; its repository can't raise the limit.

cipi app limits shop --disk=10
44 since 5.5

App users, out of SSH

Turn off SSH and SFTP from other machines for one app user, or for all of them and every app created later. Deploys keep running over ssh localhost; the rule is validated with sshd -t before it goes live.

cipi ssh apps disable --all
45 since 5.5

Your ban threshold

How many failed SSH logins before fail2ban bans — 3 by default, now 1 to 100. Checked before reload, kept across updates.

cipi firewall attempts 5
46 since 5.5

One server, many Cloudflare accounts

Named DNS-01 tokens; each wildcard renews with its own.

cipi ssl dns set --name=client-a
47 since 5.5

Laravel logs that actually expire

Dated Laravel logs were rotated a second time, never compressed, never deleted — and cipi app logs read the empty file. Now one laravel.log, compressed from day two, gone after a year. The migration folds the history in.

LOG_CHANNEL=single
48 since 5.5

<Tab> where you
actually type it.

After sudo cipi, with or without bash-completion; in sudo -s, su, tmux and screen; and with app names for the cipi user. Arrives with cipi self-update.

sudo cipi deploy sh<Tab>
49 since 5.5.1

Wildcard HTTPS,
for every tenant.

Certbot only issues and renews now; Cipi writes the HTTPS vhost itself. A wildcard certificate is installed instead of stopping at certbot's question, every tenant is redirected to HTTPS, and no alias, redirect or Octane change drops it again. cipi ssl status shows the names a certificate does not cover.

cipi ssl status
50 new · cipi/sdk

The panel API,
from PHP.

Apps, deploys, domains, databases and the server from Laravel, Symfony or a plain script, with one Sanctum token. wait() polls queued jobs, Laravel gets a facade, and the token stays out of logs and exceptions.

composer require cipi/sdk
51 new · cipi/agent 2.0

The agent
grows up.

The in-app MCP speaks every current revision up to 2026-07-28, with annotated tools, structured results and secret redaction — eleven tools plus rollback, audit ledger and backups through cipi/sdk. php artisan cipi:yml validate gives the server's verdict locally, and the anonymizer finally handles PostgreSQL, with consistent fake values and a schema scan that writes the config for you.

composer require cipi/agent:^2.0
52 since 5.6

A wizard that
asks the right things.

cipi app create opens with menus: Laravel, custom or a Node SPA, static or SSR app; then PHP-FPM or Octane; then MariaDB or PostgreSQL. Enter takes the default. It also asks for your asset build, so the first deploy ships compiled assets. cipi db create asks for the engine the same way.

cipi app create
53 since 5.6

Your repo,
checked on the spot.

The deploy key is tested against the repository and its branch before the summary. If it cannot read it, Cipi offers to save or replace the GitHub, GitLab, Bitbucket, Azure DevOps or Origin token, adds the key and checks again.

cipi git check myapp
54 since 5.6

One backup,
several buckets.

Named S3 destinations with their own keys, on any provider or region. A profile ships to all of them; retention, verify and fetch follow. Your existing bucket stays the default.

cipi backup destination add offsite
55 since 5.6

Restores that tell the truth

A PostgreSQL restore that fails says so, and why — and since 5.6.2 the database stays as it was. Dumps from a newer PostgreSQL still go in.

cipi db restore shop dump.sql.gz
56 since 5.7

A new domain, one command.

The panel API or the GUI moves to another domain with its tokens, admins and history, and its certificate follows. A domain that belongs to an app is refused.

cipi api move api.example.com
57 since 5.8

One repository,
two environments.

Every app carries an environment label. A staging app reads cipi-staging.yml before cipi.yml, and deploy.branch in each file picks the branch it deploys. The server chooses the file, never the commit.

cipi app clone shop --domain=staging.shop.com --env=staging
58 since 5.8.2

An install that waits
until you saved the passwords.

Several SSH keys, a plan before the first package, the credentials in one layout — and nothing else on screen until you confirm they are in your password manager. Then the panel API and the GUI as two questions: cipi api and cipi gui check the DNS, install and issue the certificate themselves. Lost the summary? cipi credentials prints it again, export gives a CSV. And the panel signs you in through Entra ID or Google.

sudo cipi credentials export > cipi.csv
02 — The shift

What used to be work,
is now a flag.

The honest before-and-after. Left is what running these things used to cost you. Right is Cipi 5, tagged by release.

Runtime since 5.0 PHP-FPM for everything → FPM or Octane on FrankenPHP, chosen per app
Queues since 5.0 Bare queue workers, restarted by hand → Horizon under Supervisor, deploy-aware
Websockets since 5.0 Roll your own port, proxy and service → Reverb enabled in one command, SSL included
Databases since 5.0 MariaDB, take it or leave it → MariaDB and PostgreSQL, per app
Frontend since 5.0 Commit compiled assets, or build in CI → Node build runs inside the release, fail-closed
Migrations since 5.0 Deploy and hope → Automatic snapshot before the release goes out
Staging since 5.0 Rebuild a second app by hand → One clone command, database optional
Wildcards since 5.0 Manual DNS challenge every renewal → DNS-01 with Cloudflare, automated
Monitoring since 5.0 A third-party service and its invoice → Health checks every five minutes, built in
Noisy apps since 5.0 One app could take the server down → Hard caps on workers, children and memory
Backups since 5.1 One hardcoded nightly job → Profiles, client-side AES-256, verify, managed cron
php.ini since 5.1 Hand-edit FPM files; CLI ignored → cipi ini for both SAPIs, server-wide or per app
App config since 5.1 Recreate by SSH on every server → cipi.yml in git, applied on deploy
Unknown Host since 5.1 Landed on a random vhost → Empty 444 default server
Broken deploy since 5.1 Wait fifteen minutes for a health email → Immediate post-deploy probe, optional rollback
Aliases since 5.1 Exact names only → *.example.com wildcards
Attackers since 5.2 fail2ban, and only after the fact → CrowdSec decisions dropped by a registered bouncer
Locked out since 5.2 The provider's rescue console → One-shot token on a rescue TLS port
Tampering since 5.2 Notice it when something looks odd → Nightly sha256 against the deploy manifest
The CLI since 5.2 Remember every verb → TAB completes verbs, flags and app names
Search since 5.2.2 An Algolia account, or Scout's database driver → Meilisearch on 127.0.0.1, prefix written by Cipi
Host binaries since 5.2.2 apt as root, and hope php-imagick pulled convert → An allowlisted cipi package — Chromium refused
Git forges since 5.2.3 Auto-setup on GitHub and GitLab, manual everywhere else → Origin, CodeCommit, Bitbucket and Azure DevOps too
After the deploy since 5.2.3 Patch the deploy script on every server → deploy.post in the repo, allowlisted runners only
Stack patches since 5.2.3 apt upgrade and hope MariaDB comes back → Scoped, patch-level, one service at a time
Committed cipi.yml since 5.2.3 Downloadable from a custom app's own domain → Denied at any path, on every vhost
Origin IP since 5.3 Anyone who finds it can skip the CDN → Tunnel-only — 80/443 closed, or Cloudflare IPs only
Port 22 since 5.3 Open to the internet, guarded by fail2ban → Behind Cloudflare Access, closed once the tunnel works
Server health since 5.3 A customer tells you the disk is full → One alert on the change, one on recovery
Alerts since 5.3 Email, or a CI step you wrote yourself → Slack, Discord, Telegram, ntfy or a webhook
Muted triggers since 5.3 notifications disable kept sending → An explicit false stays false
Audits since 5.3.1 Screenshots and shell history pasted into a spreadsheet → One command, a checksummed evidence bundle
Redirects since 5.3.1 Hand-edited vhosts, lost on the next rebuild → In apps.json, rolled back if nginx -t fails
React / Vue SPA since 5.4 A committed build, 404 on every reload → Built on deploy, /index.html fallback
Next.js / Nuxt since 5.4 No way to run an SSR server → Blue/green, health-checked before the switch
Who deployed? since 5.4 Only CLI and webhook deploys left a banner → Every deploy in a hash-chained, root-only ledger
Old backups since 5.4 Pre-5.1 archives kept forever, S3 errors swallowed → Orphans pruned, retention failures alert
Disk full? since 5.5 One line for / in cipi status → Every app: files, database, % of the disk
App over quota since 5.5 Found out when the disk was full → Soft limit, alert at 90% — nothing blocked
Laravel logs since 5.5 Rotated twice, kept forever, read as empty → One laravel.log, compressed, 365 days
SSH threshold since 5.5 Edit jail.local by hand, lost on update → cipi firewall attempts 5, kept
App user SSH since 5.5 Password login for every app user, always → Off per app or for all; deploys keep working
Client zones since 5.5 One Cloudflare token; a second broke renewals → Named accounts, each cert renews with its own
Tab after sudo since 5.5 File names, and no app names → Commands, flags and your apps
Installer in Docker since 5.5 “requires Ubuntu 24.04+ (found: 24.04)” → Names the container, says what to use
New app since 5.6 A username first, the app type hidden in flags → Type, runtime and engine from a menu
First deploy since 5.6 “Could not read from remote repository” → Repo and branch checked at creation
Off-site copies since 5.6 One bucket for every profile → Any number of buckets, each with its own keys
Long names since 5.6 Columns pushed out of line → Every list sized to its longest value
03 — The new vocabulary

Every new command
you didn't have before.

The complete Cipi 5 addition to the CLI. Same syntax you already know, same one binary. Tagged since 5.0, since 5.1, since 5.2, since 5.3, since 5.4, since 5.5 or since 5.6 — down to the 5.6.0 release.

cipi credentials [export]The install credentials again — root, databases, Valkey, Meilisearch, backup key, with connection URLs — or a CSV for your password manager since 5.8.2
cipi api <domain>DNS check, install, certificate and a token in one command; cipi gui <domain> the same, admin account included since 5.8.2
cipi gui sso set --issuer=… --client-id=…Single sign-on for the panel over OpenID Connect — Entra ID, Google, Okta, Keycloak; only on|off, disable since 5.8.2
cipi app create --env=stagingGive an app an environment label; it reads cipi-staging.yml before cipi.yml. Also on app edit and app clone since 5.8
cipi app create --octaneCreate a Laravel app served by Octane on FrankenPHP since 5.0
cipi app convert <app> --to=octane|fpmMove an existing app between runtimes since 5.0
cipi app reverb enable|disable|statusRealtime websockets for an app since 5.0
cipi worker horizon enable|disable|statusHorizon instead of plain queue workers since 5.0
cipi schedule on|off|status <app>Toggle the Laravel scheduler per app since 5.0
cipi app edit --node-build='…'Run a frontend build on every deploy since 5.0
cipi app edit --no-node-buildRemove the build step again since 5.0
cipi app clone <app> --domain=…Instant staging copy of a production app since 5.0
cipi deploy --snapshotDump the database before the release goes out since 5.0
cipi app limits <app>Cap FPM children, memory, Octane and queue workers since 5.0
cipi db install|uninstall pgsqlAdd or remove PostgreSQL next to MariaDB since 5.0
cipi db default mariadb|pgsqlChoose the engine used when you omit the flag since 5.0
cipi db enginesInstalled engines, ports and current default since 5.0
cipi ssl dns set --provider=cloudflareStore the credentials for DNS-01 challenges since 5.0
cipi ssl install --dns=cloudflare --wildcardIssue wildcard certificates via DNS since 5.0
cipi ssl force <app>Re-apply the HTTP to HTTPS redirect since 5.0
cipi www add|force-to-root|force-from-rootCanonical host and permanent redirects since 5.0
cipi health set|unset|check|list [--json]Built-in HTTP monitoring and alerts since 5.0
cipi api ip-whitelist show|add|set|allow-allRestrict panel API / MCP by IP since 5.0
cipi app webhook recreate [--rotate-secret]Recreate GitHub/GitLab deploy webhook since 5.0
cipi smtp configure --host=… --port=…Non-interactive SMTP for API/scripts since 5.0
cipi app env|run|deploy-configNon-interactive app tooling for API/GUI since 5.0
cipi backup profile add|edit|listBackup strategies: what, how often, where, how long since 5.1
cipi backup verify|status|fetch --encryptIntegrity check, overdue watchdog, client-side AES-256 since 5.1
cipi ini list|set|unsetphp.ini for FPM and CLI, server-wide or per app since 5.1
cipi yml generate|plan|apply|autoPer-project cipi.yml that travels with the code since 5.1
cipi yml generate --saveWrite /home/<app>/cipi.yml. deploy.node_build builds assets before go-live; a dropped backup profile leaves the schedule since 5.5.2
cipi nginx default-server on|offClose unmatched Host requests with 444 since 5.1
cipi health set --rollback-on-unhealthyUndo a release that fails its post-deploy check since 5.1
cipi health postdeploy <app>Run the post-deploy probe on demand since 5.1
cipi deploy --log[=N]Show the timestamped deploy log since 5.1
cipi alias add <app> '*.example.com'Wildcard domain aliases since 5.1
cipi crowdsec enable|disable|statusOpt-in IP reputation: engine plus a registered firewall bouncer since 5.2
cipi crowdsec allow|unallow <ip|cidr>Never ban an address, or drop an extra allow since 5.2
cipi crowdsec rescue token|rotateBreak-glass TLS listener and its one-shot token since 5.2
cipi scan enable|disable|statusNightly integrity check plus ClamAV on upload dirs since 5.2
cipi scan [<app>] | report | manifestRun now, read the last report, re-baseline a manifest since 5.2
cipi completion bash|zsh [--print]Shell tab-completion — already installed for you since 5.2
cipi git refresh [app]Re-sync GitHub/GitLab deploy keys and webhooks since 5.2.1
cipi app fix-permissions [app]Restore an app home to the permission model Cipi created it with since 5.2.1
cipi search install|enable|disable|statusMeilisearch for Laravel Scout — native binary, 127.0.0.1 only since 5.2.2
cipi search key show|rotateApp key or master key; rotating the master rewrites every .env since 5.2.2
cipi search upgrade|removeIn-place store upgrade, or put the old binary back since 5.2.2
cipi package list|install|removeAllowlisted host binaries from Ubuntu's repos since 5.2.2
cipi git origin-token|bitbucket-token|azure-tokenCredentials for Cursor Origin, Bitbucket Cloud and Azure DevOps since 5.2.3
cipi git codecommit-token <key> <secret> <iam-user>AWS IAM credentials — the deploy key goes up via UploadSSHPublicKey since 5.2.3
cipi yml post-deploy <app>Run the repo's declared deploy.post steps now, against current/ since 5.2.3
cipi nginx upgrade [--yes]Patch installed nginx packages, nginx -t, then reload since 5.2.3
cipi db upgrade [mariadb|pgsql] [--yes]Patch one database engine, or every installed one since 5.2.3
cipi service upgrade [name] [--yes]The generic entry, and the home for Valkey — all is refused since 5.2.3
cipi zt token set --token= --account=Cloudflare API token, root-only — not the DNS-01 file since 5.3
cipi zt enable|disable|status|refreshTunnel and Nginx real_ip, ports left open; disable restores UFW since 5.3
cipi zt hostname add|remove <app|--gui>Route an app or the panel through the tunnel since 5.3
cipi zt access enable|disable <app|--gui>Cloudflare Access in front, Git webhook path bypassed since 5.3
cipi zt ssh enable --hostname=SSH over the tunnel — port 22 stays open since 5.3
cipi zt lock http|ssh [--yes]Close the origin, with refusals that keep you in since 5.3
cipi zt unlock http | cipi zt ssh unlockReopen 80/443 or port 22 since 5.3
cipi zt origin-cert <app>Optional 15-year Cloudflare Origin CA certificate since 5.3
cipi monitor [--json] | list | testRun the server checks now, see their state, send a sample alert since 5.3
cipi monitor enable|disable|set <check>Toggle a check or change its thresholds since 5.3
cipi notifications channel add <type> <id>Slack, Discord, Telegram, ntfy or webhook since 5.3
cipi notifications channel list|test|enable|disable|removeMasked secrets; test one channel or all since 5.3
cipi compliance [check] [--days=90] [--json]17 read-only controls; exits 1 on any fail since 5.3.1
cipi compliance report [--out=] [--no-archive]Evidence bundle, SHA256SUMS and a checksummed archive since 5.3.1
cipi compliance list|controlsPast reports, and the ISO 27001 / SOC 2 mapping since 5.3.1
cipi redirect set <app> --to=<url>Every name of the app in one hop; enable|disable|unset since 5.3.1
cipi redirect add|remove|list <app>Exact or prefix path redirects, 301/302/307/308 since 5.3.1
cipi proxy add|remove|list <app>A URL prefix to another upstream, WebSocket included since 5.3.1
cipi app create --node=spa|static|ssrNode frontends; --framework=next|nuxt|sveltekit|astro|remix|vite since 5.4
cipi app edit <app> --node-version=24|defaultPin one app's Node major, or follow the server since 5.4
cipi node install|list|upgrade|removeChecksum-verified official Node builds, LTS majors since 5.4
cipi node default <major>|systemServer-wide Node for Laravel builds, app run, deploy.post since 5.4
cipi node status|restart|logs <app>Slots, zero-downtime restart, serving-slot log since 5.4
cipi deploy <app> --audit [--days=90] [--json]The app's records from the deploy ledger since 5.4
cipi disk [--json]Every filesystem, then every app: files, database, total, % of disk since 5.5
cipi disk db [--json]MariaDB, PostgreSQL, Valkey and Meilisearch, in MB since 5.5
cipi app limits <app> --disk=<GB>|noneSoft disk limit: alerts at 90% and over, blocks nothing since 5.5
cipi monitor set app_disk --warn= --minutes=Tune the per-app disk check and its measurement cache since 5.5
cipi firewall attempts [<1-100>|default]Failed SSH logins before fail2ban bans — default 3 since 5.5
cipi ssh apps [--json]Every app user's SSH/SFTP access, and what new apps get since 5.5
cipi ssh apps enable|disable <app>|--allOne app user, or all and the apps created later since 5.5
cipi ssl dns set --name= --token=Another Cloudflare account for DNS-01 — any number since 5.5
cipi ssl install <app> --dns=cloudflare --account=Issue with that account; renewals follow it since 5.5
cipi ssl dns list|remove <name>Accounts and their certificates; remove refused while in use since 5.5
cipi ssl statusCertificates, then every app: what it is served with, which names are not covered since 5.5.1
cipi ssl install <app> --httpBack from DNS-01 to HTTP-01 on purpose — a plain install now keeps DNS-01 since 5.5.1
cipi ssl install <app> --dns=cloudflare --no-wildcardDrop the remembered *.<apex> on the next issue since 5.5.1
cipi app create --node-build=CMDThe Laravel asset build, set at creation (the wizard asks for it) since 5.6
cipi git check [app]Can the deploy key read the repository and its branch? since 5.6
cipi backup destination add|edit|list|show|test|removeNamed S3 buckets, each with its own keys since 5.6
cipi backup profile edit <name> --dest=local,s3,<name>Ship one profile to several destinations since 5.6
cipi php upgradeNightly; patch level of every PHP and Octane binary, exit 1 while one is vulnerable since 5.6.3
cipi php list --jsonpatch, security and security_floor per version since 5.6.3
cipi yml plan <app> --jsonThe whole plan as one object; also cipi yml auto <app> status --json since 5.6.4
cipi api move <domain> [--no-ssl]API, MCP and docs to a new domain; old certificate deleted, new one issued since 5.7
cipi gui move <domain>The control panel to a new domain; admins, 2FA and connections stay since 5.7
cipi api remove [--force]Everything cipi api <domain> set up; apps and the GUI untouched since 5.7
04 — Since 5.0.6, now with a PHP SDK

Panel API, GUI
and automation.

Server management from the REST API and optional web GUI — plus non-interactive flags for scripts. The newest rows need cipi self-update to 5.5.2 (disk over the API, and the cipi.yml names below) and panel API 1.33; wildcard HTTPS needs 5.5.1. cipi/sdk installs with Composer wherever your PHP runs.

PHP SSH-only version management → GET /api/php and install; remove and default stay on the CLI
SSH keys Terminal-only key admin → REST + GUI for cipi user keys
Services Manual systemctl → GET /api/services and restart from the panel
SMTP Interactive wizard only → REST + cipi smtp configure --host=…
Health CLI-only checks → REST per app + --json on CLI
API access Any IP with a token → Optional IP whitelist on api/* and /mcp
Webhooks Recreate by re-editing the repo → cipi app webhook recreate [--rotate-secret]
Self-update Could hang on API/GUI Composer step → 5.0.14–5.0.17 — timed Packagist/tarball panel updates
Panel GUI HTTP 500 after upgrade/soft update → 5.0.18 — no Composer symlink outside open_basedir
Routing since 5.4.1 cipi redirect / cipi proxy as root only → REST, MCP and GUI — same validation, never --force
Node apps since 5.4.1 CLI-only create and restart → Create, edit, blue/green restart from the panel
Deploy audit API 1.31 SSH in and read the ledger → GET /api/apps/{name}/deploy/audit + a GUI view
Host insight API 1.31 Search, packages, monitor, Zero Trust: SSH only → Read-only in the panel; installs stay CLI-root
SSL install since 5.5.1 Reissue fell back to HTTP-01 and dropped the wildcard → Reissued over DNS-01, same Cloudflare account and wildcard
PHP SDK cipi/sdk curl, a token and your own job polling → composer require cipi/sdk — every endpoint, wait(), Laravel facade
MCP 46 tools → 73 tools, one tools/list page

One line stands between
you and all of it.

Run the updater and Cipi rebuilds vhosts, pools, Deployer templates and app metadata in place — without touching your code or your data.

  • Everything new is opt-in — Octane, Horizon, Reverb, PostgreSQL, snapshots, health checks, backup profiles, cipi.yml auto and post-deploy rollback, CrowdSec, the nightly scan, Meilisearch, cipi package, Cloudflare Zero Trust, chat channels, Node apps, disk limits, cipi ssh apps and extra backup buckets stay off until you ask. cipi compliance and cipi disk only read. The server monitor is on, and quiet until something breaks.
  • Your PHP-FPM apps keep running exactly as they are, next to any new Octane neighbours.
  • One heads-up for 5.5.0: its migration moves Laravel apps to LOG_CHANNEL=single and gracefully restarts running workers, Horizon, Octane and Reverb — a few seconds of reconnects, as on a deploy. What it does.
  • 5.5.1 rewrites, one app at a time with nginx -t, the vhost of apps with a wildcard name, a Cloudflare Origin CA certificate or a certificate that never reached the vhost — the previous file is put back if nginx refuses the new one. No certificate is requested, nothing is deployed. What it does.
  • Fresh servers get all of it out of the box with the usual installer.
Read the docs Take the full tour
upgrade
cipi self-update # On a fresh Ubuntu 24.04 or 26.04 VPS:
wget -O - https://cipi.sh/setup.sh | bash