Server reference
Every pandod command and option, as printed by --help. Options listed under pandod itself apply to every command and go before it (pandod --metrics 0.0.0.0:9420 server ...). Each option’s environment variable is shown in brackets. The most used settings are summarised in Configuration.
pandod
Grovedock: source control server, regional cache and node daemon
Usage: pandod [OPTIONS] <COMMAND>
Commands:
server Authoritative server: all features, durable storage
license Support licences: `pandod license verify FILE`
repo Operator actions on one hosted repository, straight on the registry (site administration; works while the server runs, which notices within seconds)
token Create an access token directly in a platform registry, without a running server: how the first administrator gets in. Prints the token once
backup Back up a platform server while it runs: a consistent snapshot of the registry and of every hosted repository's metadata database, with a manifest of where each belongs and where objects live. Restore by copying back while stopped (docs/backup.md)
compact Delta-compress stored blob versions (single writer; safe to run while serving)
copy Copy a repository to another store: a backup, a restore, or a move to another backend (e.g. SQLite to Postgres). Safe while the source serves; repeat it to copy only what is new
cache Regional cache: stateless, memory-bounded, read-through to an upstream tier
daemon Per-node daemon: memory + local disk cache shared by every job on the machine
help Print this message or the help of the given subcommand(s)
Options:
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
-V, --version
Print version
pandod server
Authoritative server: all features, durable storage
Usage: pandod server [OPTIONS]
Options:
--listen <LISTEN>
[default: 127.0.0.1:7420]
--metadata <METADATA>
memory | sqlite://PATH | postgres://... Default: sqlite://./pando-data/meta.db, or memory with --platform (whose clients can't reach this repository)
[env: PANDO_METADATA]
--objects <OBJECTS>
metadata | file:///PATH | s3://BUCKET/PREFIX | gs://BUCKET | az://CONTAINER | memory:///
[env: PANDO_OBJECTS]
[default: metadata]
--acl <ACL>
JSON access rules (per-directory write and per-ref permissions). Unset = allow all
[env: PANDO_ACL=]
--land-hook <LAND_HOOK>
Pre-land check: every land is POSTed here and proceeds only on a 2xx answer
[env: PANDO_LAND_HOOK]
--land-hook-token <LAND_HOOK_TOKEN>
Bearer token sent to the land hook
[env: PANDO_LAND_HOOK_TOKEN]
--land-hook-timeout <LAND_HOOK_TIMEOUT>
Seconds to wait for the land hook before refusing the land
[default: 10]
--platform <PLATFORM>
Host many repositories: the registry of which exist (sqlite://PATH or memory). Without it the server hosts one repository, `--metadata` / `--objects`
[env: PANDO_PLATFORM]
--repos-metadata <REPOS_METADATA>
Storage for each hosted repository; `{repo}` becomes OWNER/NAME and `{repo_id}` OWNER--NAME, e.g. sqlite:///var/lib/pando/repos/{repo}.db
[env: PANDO_REPOS_METADATA]
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420
[env: PANDO_METRICS=]
--repos-objects <REPOS_OBJECTS>
Objects for each hosted repository (same placeholders), or `metadata`
[env: PANDO_REPOS_OBJECTS]
[default: metadata]
--log-json
Emit JSON logs
[env: PANDO_LOG_JSON=]
--platform-admins <PLATFORM_ADMINS>
Logins that administer the whole server: create organisations, and act as an administrator of every organisation and repository
[env: PANDO_PLATFORM_ADMINS=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request
[env: PANDO_AUDIT_LOG=]
--multi-tenant
Strangers share this server (a hosted service): internal repositories are for the owning organisation only, organisations add existing accounts only, and any person may create a few organisations
[env: PANDO_MULTI_TENANT=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md)
[env: PANDO_AUDIT_RETENTION_DAYS=]
[default: 365]
--max-orgs-per-account <MAX_ORGS_PER_ACCOUNT>
With --multi-tenant: how many organisations a person may administer
[env: PANDO_MAX_ORGS_PER_ACCOUNT=]
[default: 3]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only)
[env: PANDO_WEB_ORIGINS=]
[alias: --web-origins]
--webhook-allow-private
Let webhooks call loopback and private networks (self-hosted CI on an internal network). Cloud metadata addresses stay refused
[env: PANDO_WEBHOOK_ALLOW_PRIVATE=]
--login-listen <LOGIN_LISTEN>
Serve the sign-in pages (`/login/*`: OpenID Connect providers such as Google, and email links) on this address, behind the same host name as the console
[env: PANDO_LOGIN_LISTEN=]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback)
[env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks
[env: PANDO_MAX_REQUEST_MB=]
--public-url <PUBLIC_URL>
Where people reach this server, e.g. https://pando.example.com: the base of sign-in redirect addresses and email links
[env: PANDO_PUBLIC_URL=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise
[env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--oidc <ID=ISSUER_URL>
A sign-in provider, ID=ISSUER_URL (repeatable), e.g. google=https://accounts.google.com. Its client comes from PANDO_OIDC_<ID>_CLIENT_ID and PANDO_OIDC_<ID>_CLIENT_SECRET (or _FILE variants)
--smtp-url <SMTP_URL>
Mail server for sign-in links: smtps://HOST:465 or smtp://HOST:587?tls=required. Credentials from PANDO_SMTP_USERNAME and PANDO_SMTP_PASSWORD (or _FILE variants)
[env: PANDO_SMTP_URL]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk
[env: PANDO_SQLITE_SYNCHRONOUS=]
[default: full]
[possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident
[env: PANDO_ALLOW_ANONYMOUS=]
--mail-from <MAIL_FROM>
Sender of sign-in links, e.g. "Grovedock <login@example.com>"
[env: PANDO_MAIL_FROM=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds
[env: PANDO_REQUEST_TIMEOUT=]
[default: 600]
--turnstile-site-key <TURNSTILE_SITE_KEY>
Cloudflare Turnstile site key for the email form; its secret comes from PANDO_TURNSTILE_SECRET (or _FILE). Unset: no challenge
[env: PANDO_TURNSTILE_SITE_KEY=]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing
[env: PANDO_MAX_IN_FLIGHT=]
[default: 4096]
--signup <SIGNUP>
Who may create an account by signing in: waitlist (`pando admin signup allow`), open, or closed. Existing accounts can always sign in
Possible values:
- waitlist: Only addresses and `@domains` on the list (`pando admin signup allow`)
- open
- closed: No new accounts
[env: PANDO_SIGNUP=]
[default: waitlist]
--terms-url <TERMS_URL>
Your terms of service, linked from the box people tick (18 or older, accept the terms) before an account is made
[env: PANDO_TERMS_URL=]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only)
[env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens
[env: PANDO_OIDC_ISSUER=]
--privacy-url <PRIVACY_URL>
Your privacy policy, linked next to the terms
[env: PANDO_PRIVACY_URL=]
--max-open-repos <MAX_OPEN_REPOS>
Most hosted repositories open at once; the least recently used idle ones close
[env: PANDO_MAX_OPEN_REPOS=]
[default: 256]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens
[env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...)
[env: PANDO_OIDC_CLAIM=]
[default: sub]
--repo-idle-minutes <REPO_IDLE_MINUTES>
Minutes an unused hosted repository stays open
[env: PANDO_REPO_IDLE_MINUTES=]
[default: 10]
--default-org-limits <DEFAULT_ORG_LIMITS>
With --multi-tenant: limits of organisations that have none of their own, e.g. `seats=5,agents=20,storage=1GiB,private_repos=unlimited,plan=Free` (ADR-035). Without it, organisations are unlimited until given limits (`pando admin limits set`)
[env: PANDO_DEFAULT_ORG_LIMITS=]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google)
[env: PANDO_OIDC_REQUIRE=]
--billing-url <BILLING_URL>
Where organisation administrators change their plan; the console's Upgrade button and limit messages link here
[env: PANDO_BILLING_URL=]
[default: ""]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator
[env: PANDO_OIDC_ADMINS=]
--support-url <SUPPORT_URL>
Where people reach support, e.g. a suspended organisation (mailto: or https:); the console links to it
[env: PANDO_SUPPORT_URL=]
[default: ""]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS
[env: PANDO_TLS_CERT=]
--license <LICENSE>
A support licence file to check at startup. Nothing is turned off without one
[env: PANDO_LICENSE=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
--console-dir <CONSOLE_DIR>
Serve the web console from this directory (the release's `pando-console-VERSION` archive, unpacked) at `/` on the server's own address. Needs the `web` flag
[env: PANDO_CONSOLE_DIR=]
-h, --help
Print help (see a summary with '-h')
pandod license
Support licences: `pandod license verify FILE`
Usage: pandod license [OPTIONS] <COMMAND>
Commands:
verify Check a licence file's signature and dates
help Print this message or the help of the given subcommand(s)
Options:
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod license verify
Check a licence file's signature and dates
Usage: pandod license verify [OPTIONS] <FILE>
Arguments:
<FILE>
Options:
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod repo
Operator actions on one hosted repository, straight on the registry (site administration; works while the server runs, which notices within seconds)
Usage: pandod repo [OPTIONS] --platform <PLATFORM> <COMMAND>
Commands:
disable Take a repository down at once: every read and write is refused ("disabled by the operator"); nothing is deleted. Undo with `enable`
enable Serve a disabled repository again
delete Delete a repository: its registry rows (reviews, issues, webhooks, grants) and its storage files. Cannot be undone; take a backup first
help Print this message or the help of the given subcommand(s)
Options:
--platform <PLATFORM>
[env: PANDO_PLATFORM]
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod repo disable
Take a repository down at once: every read and write is refused ("disabled by the operator"); nothing is deleted. Undo with `enable`
Usage: pandod repo --platform <PLATFORM> disable [OPTIONS] --reason <REASON> <REPO>
Arguments:
<REPO>
Options:
--reason <REASON>
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod repo enable
Serve a disabled repository again
Usage: pandod repo --platform <PLATFORM> enable [OPTIONS] <REPO>
Arguments:
<REPO>
Options:
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod repo delete
Delete a repository: its registry rows (reviews, issues, webhooks, grants) and its storage files. Cannot be undone; take a backup first
Usage: pandod repo --platform <PLATFORM> delete [OPTIONS] --repos-metadata <REPOS_METADATA> --confirm <CONFIRM> <REPO>
Arguments:
<REPO>
Options:
--repos-metadata <REPOS_METADATA>
[env: PANDO_REPOS_METADATA]
--repos-objects <REPOS_OBJECTS>
[env: PANDO_REPOS_OBJECTS] [default: metadata]
--confirm <CONFIRM>
Confirm by repeating OWNER/NAME
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod token
Create an access token directly in a platform registry, without a running server: how the first administrator gets in. Prints the token once
Usage: pandod token [OPTIONS] --platform <PLATFORM> --account <ACCOUNT>
Options:
--platform <PLATFORM>
[env: PANDO_PLATFORM]
--account <ACCOUNT>
The account the token belongs to and acts as (list it in --platform-admins to make it an administrator)
--name <NAME>
[default: bootstrap]
--expires-days <EXPIRES_DAYS>
Days until it expires (1–366) [default: 30]
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod backup
Back up a platform server while it runs: a consistent snapshot of the registry and of every hosted repository's metadata database, with a manifest of where each belongs and where objects live. Restore by copying back while stopped (docs/backup.md)
Usage: pandod backup [OPTIONS] --platform <PLATFORM> --repos-metadata <REPOS_METADATA> --to <TO>
Options:
--platform <PLATFORM>
[env: PANDO_PLATFORM]
--repos-metadata <REPOS_METADATA>
[env: PANDO_REPOS_METADATA]
--repos-objects <REPOS_OBJECTS>
[env: PANDO_REPOS_OBJECTS] [default: metadata]
--metadata <METADATA>
The server's default repository, backed up too when it is SQLite [env: PANDO_METADATA]
--to <TO>
A new or empty directory, or an object store URL (s3://BUCKET/PREFIX, gs://, az://)
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod compact
Delta-compress stored blob versions (single writer; safe to run while serving)
Usage: pandod compact [OPTIONS]
Options:
--metadata <METADATA>
[env: PANDO_METADATA] [default: sqlite://./pando-data/meta.db]
--objects <OBJECTS>
[env: PANDO_OBJECTS] [default: metadata]
--force-unlock
Take over the lease of a compaction that crashed
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod copy
Copy a repository to another store: a backup, a restore, or a move to another backend (e.g. SQLite to Postgres). Safe while the source serves; repeat it to copy only what is new
Usage: pandod copy [OPTIONS] --from-metadata <FROM_METADATA> --to-metadata <TO_METADATA>
Options:
--from-metadata <FROM_METADATA>
--from-objects <FROM_OBJECTS>
[default: metadata]
--to-metadata <TO_METADATA>
--to-objects <TO_OBJECTS>
[default: metadata]
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod cache
Regional cache: stateless, memory-bounded, read-through to an upstream tier
Usage: pandod cache [OPTIONS] --upstream <UPSTREAM>
Options:
--listen <LISTEN>
[default: 127.0.0.1:7421]
--upstream <UPSTREAM>
[env: PANDO_UPSTREAM]
--capacity-mb <CAPACITY_MB>
[default: 4096]
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help
pandod daemon
Per-node daemon: memory + local disk cache shared by every job on the machine
Usage: pandod daemon [OPTIONS] --upstream <UPSTREAM>
Options:
--listen <LISTEN>
[default: 127.0.0.1:7422]
--upstream <UPSTREAM>
[env: PANDO_UPSTREAM]
--dir <DIR>
[default: ./pando-daemon]
--memory-mb <MEMORY_MB>
[default: 512]
--server <SERVER>
Authoritative server, used to resolve `--prefetch` revisions [env: PANDO_SERVER]
--prefetch <PREFETCH>
Warm the cache with this revision (e.g. `main`) at startup
--prefetch-path <PREFETCH_PATHS>
Limit prefetch to these paths (repeatable)
--prefetch-interval <PREFETCH_INTERVAL>
Re-prefetch periodically (seconds) to follow a moving branch
--metrics <METRICS>
Address for `/metrics` (Prometheus), `/healthz` and `/readyz` (no token needed), e.g. 0.0.0.0:9420 [env: PANDO_METRICS=]
--log-json
Emit JSON logs [env: PANDO_LOG_JSON=]
--audit-log <AUDIT_LOG>
Append an audit trail (JSON lines: who read or changed what, from where, with what result) to this file. Off by default; it grows with every request [env: PANDO_AUDIT_LOG=]
--audit-retention-days <AUDIT_RETENTION_DAYS>
Days of audit files to keep (one file per UTC day); 0 keeps all. 365 suits hosted services (docs/deploy.md) [env: PANDO_AUDIT_RETENTION_DAYS=] [default: 365]
--cors-origin <WEB_ORIGINS>
Origins allowed to call this server from a browser on another site (repeatable or comma-separated), e.g. your own console's address. Default: none (same origin only); `*` allows any (development only) [env: PANDO_WEB_ORIGINS=] [alias: --web-origins]
--trust-proxy
Take the client address (audit log, sign-in rate limits) from `X-Forwarded-For` when the connection comes from a reverse proxy on this host (loopback) [env: PANDO_TRUST_PROXY=]
--max-request-mb <MAX_REQUEST_MB>
Largest request message in MiB (an uploaded object batch, a changeset). Default: 64 with --platform, 260 otherwise. Files of 8 MiB and more are uploaded in chunks [env: PANDO_MAX_REQUEST_MB=]
--max-calls-per-principal <MAX_CALLS_PER_PRINCIPAL>
Calls one account may have in progress at once (0: no limit). Default: 128 with --platform, no limit otherwise [env: PANDO_MAX_CALLS_PER_PRINCIPAL=]
--sqlite-synchronous <SQLITE_SYNCHRONOUS>
SQLite durability: `full` (default) syncs every commit, so an acknowledged land survives power loss; `normal` survives process crashes only, for more throughput on a slow disk [env: PANDO_SQLITE_SYNCHRONOUS=] [default: full] [possible values: full, normal]
--allow-anonymous
Accept unauthenticated calls on a non-loopback address. Without tokens or OIDC, pandod otherwise listens only on localhost, so a server is never open to a network by accident [env: PANDO_ALLOW_ANONYMOUS=]
--request-timeout <REQUEST_TIMEOUT>
Longest any one call may run, in seconds [env: PANDO_REQUEST_TIMEOUT=] [default: 600]
--max-in-flight <MAX_IN_FLIGHT>
Calls in progress at once across all clients; beyond this, calls are refused with Unavailable (clients retry) instead of queueing [env: PANDO_MAX_IN_FLIGHT=] [default: 4096]
--tokens <TOKENS>
Comma-separated bearer tokens accepted by this process. Unset = no auth (dev only) [env: PANDO_TOKENS]
--oidc-issuer <OIDC_ISSUER>
OpenID Connect issuer URL; enables SSO bearer tokens (JWTs) alongside static tokens [env: PANDO_OIDC_ISSUER=]
--oidc-audience <OIDC_AUDIENCE>
Expected `aud` claim of OIDC tokens [env: PANDO_OIDC_AUDIENCE=]
--oidc-claim <OIDC_CLAIM>
Claim used as the principal for access rules (sub, email, preferred_username...) [env: PANDO_OIDC_CLAIM=] [default: sub]
--oidc-require <OIDC_REQUIRE>
CLAIM=VALUE every OIDC token must carry (repeatable; all must match), e.g. `repository_owner=acme`, `hd=corp.example`, `email_verified=true`. Required for issuers that serve anyone (GitHub Actions, Google) [env: PANDO_OIDC_REQUIRE=]
--oidc-admin <OIDC_ADMINS>
Platform administrators who may sign in through OIDC (repeatable). Any other `--platform-admins` login is refused from an OIDC token, so an identity provider that lets users pick their name can't make someone an administrator [env: PANDO_OIDC_ADMINS=]
--tls-cert <TLS_CERT>
PEM certificate and key for TLS [env: PANDO_TLS_CERT=]
--tls-key <TLS_KEY>
[env: PANDO_TLS_KEY=]
-h, --help
Print help