ironflow cloud

Ironflow Cloud operator commands (meta-cluster). These commands read from the meta-cluster Postgres directly (IRONFLOW_DATABASE_URL) or mint local signing artifacts. They are intended for the founder running on the meta box — they are not exposed to tenant operators.

ironflow cloud <subcommand> [flags]

Subcommands:

Subcommand	Description
provision-status	Show current status of a provisioning saga
cap-token mint	Mint an Ed25519 capability token for deprovision saga events
break-glass	Decrypt a break-glass bearer blob for a cluster
snapshot decrypt	Decrypt a snapshot export blob for a cluster
rotation reset	Clear a stuck rotation_in_progress flag for one (cluster, token-kind) row

ironflow cloud provision-status

Read the clusters row and the most recent provisioning_audit rows for a cluster. Connects directly to the meta-cluster Postgres via IRONFLOW_DATABASE_URL.

ironflow cloud provision-status <cluster_id> [flags]

Arguments:

Argument	Required	Description
cluster_id	Yes	The cluster ID to query (e.g., clu_hooli)

Flags:

Flag	Short	Type	Default	Description
--json		bool	false	Output as JSON
--audit-limit		int	20	Max provisioning_audit rows to show (capped at 1000)

Requires IRONFLOW_DATABASE_URL to be set.

Examples:

ironflow cloud provision-status clu_hooli
ironflow cloud provision-status clu_hooli --json
ironflow cloud provision-status clu_hooli --audit-limit 50

ironflow cloud cap-token mint

Mint an Ed25519-signed capability token that gates the cloud.deprovision-cluster.requested NATS event. The Ed25519 private key is loaded from IRONFLOW_CAP_TOKEN_PRIVATE_KEY_B64 (base64-encoded PKCS8 DER).

ironflow cloud cap-token mint <cluster_id> <customer_id> [flags]

Arguments:

Argument	Required	Description
cluster_id	Yes	Cluster ID (e.g., clu_hooli)
customer_id	Yes	Customer ID (e.g., cust_01h2g3k4j5n6p7q8r9s0)

Flags:

Flag	Short	Type	Default	Description
--ttl		duration	10m	Token time-to-live (max 10m; longer TTLs silently re-open replay)

Requires IRONFLOW_CAP_TOKEN_PRIVATE_KEY_B64 to be set.

Examples:

ironflow cloud cap-token mint clu_hooli cust_01h2g3k4j5n6p7q8r9s0
ironflow cloud cap-token mint clu_hooli cust_01h2g3k4j5n6p7q8r9s0 --ttl 5m

ironflow cloud break-glass

Decrypt a break-glass bearer blob fetched from the meta-cluster S3 bucket. The 32-byte meta-cluster KEK is loaded from IRONFLOW_MASTER_KEY_B64 (base64-encoded). The blob bytes are read from --blob-file (path) or stdin (default). The decrypted plaintext bearer is written to stdout with no trailing newline.

ironflow cloud break-glass <cluster_id> [flags]

Arguments:

Argument	Required	Description
cluster_id	Yes	Cluster ID (e.g., clu_hooli)

Flags:

Flag	Short	Type	Default	Description
--blob-file		string		Path to encrypted blob (default: stdin)

Requires IRONFLOW_MASTER_KEY_B64 to be set.

Examples:

# Fetch + decrypt via stdin pipe (preferred — blob never touches disk)
aws s3 cp s3://ironflow-break-glass-fsn/clu_hooli.enc - \
  | ironflow cloud break-glass clu_hooli

# Decrypt a previously-saved blob file
ironflow cloud break-glass clu_hooli --blob-file /tmp/clu_hooli.enc

ironflow cloud snapshot decrypt

Decrypt a snapshot export blob produced by the deprovision saga’s snapshot_data step. The 32-byte meta-cluster KEK is loaded from IRONFLOW_MASTER_KEY_B64 (base64-encoded). The blob bytes are read from --blob-file (path) or stdin (default). The decrypted plaintext (typically a gzipped pg_dump) is written to stdout.

ironflow cloud snapshot decrypt <cluster_id> [flags]

Arguments:

Argument	Required	Description
cluster_id	Yes	Cluster ID (e.g., clu_hooli)

Flags:

Flag	Short	Type	Default	Description
--blob-file		string		Path to encrypted blob (default: stdin)
--max-bytes		int64	268435456 (256 MiB)	Maximum blob bytes to read (held in RAM during decrypt; peak memory ≈ 2× blob size)

Requires IRONFLOW_MASTER_KEY_B64 to be set.

Examples:

# Fetch + decrypt via stdin pipe
aws s3 cp s3://ironflow-snapshots-fsn/exports/clu_hooli/run_xyz.tar.gz.enc - \
  | ironflow cloud snapshot decrypt clu_hooli > dump.tar.gz

# Decrypt a previously-saved blob file with a 4 GiB cap
ironflow cloud snapshot decrypt clu_hooli \
  --blob-file /tmp/clu_hooli-export.enc \
  --max-bytes 4294967296 > dump.tar.gz

ironflow cloud rotation reset

Clear a stuck cloud.cluster_tokens.rotation_in_progress flag for one (cluster_id, kind) row. The boot sweep clears rows whose rotation_started_at exceeds the stale threshold automatically (#1074 PR2); this CLI is for the case where an operator has inspected a partial-rotation state and wants to drop the gate before the sweep window elapses. The action is audited via cloud.token_rotation_audit (result=success, step_up_method=operator_cli); the cluster’s token value_hash and meta_push_key are not touched — this is purely a flag clear. Connects directly to the meta-cluster Postgres via IRONFLOW_DATABASE_URL.

ironflow cloud rotation reset --cluster <cluster_id> --kind <kind> [flags]

Flags:

Flag	Short	Type	Default	Description
--cluster		string		Cluster ID (clu_*) (required)
--kind		string		Token kind: engine_api_key, founder_api_key, or dashboard_jwt_secret (required)
--reason		string		Operator note recorded in the audit row

Requires IRONFLOW_DATABASE_URL to be set.

Examples:

ironflow cloud rotation reset --cluster clu_hooli --kind engine_api_key --reason "manual recovery after PG failover"

---