Other Commands

Run every panix command besides deploy: scaffold config, validate it, run single phases, and roll back.

inspect, build, secrets, and rollback accept the same flags as panix deploy (see Deploy Flags); rollback additionally accepts --gen.

init

Initialize a new panix.yml configuration file:

panix init

Flags:

• -o/--output: output path (default: panix.yml)
• -f/--force: overwrite an existing file; without it a second panix init fails with a hint to use --force

schema

Generate YAML schema for configuration files:

panix schema

Writes panix-schema.yaml to the current directory. See IDE Support for usage with editors.

template

Previews the processed YAML configuration with templates evaluated and anchors resolved, without performing validation:

panix template                    # Output to stdout (colorized)
panix template -o processed.yaml  # Output to file (plain YAML)

What it does:

• Resolves all {{...}} template expressions
• Merges YAML anchors
• Outputs the flags, fleet, and output_types (when defined) top level keys

Use it to debug template expressions, verify anchor merging, or feed plain YAML to other tools. For full validation, use eval instead.

eval

Fully evaluates and validates the configuration, preparing it for execution:

panix eval                    # Output to stdout (colorized)
panix eval -o processed.yaml  # Output to file (plain YAML)
panix eval -t <tag>           # Evaluate only machines matching the tag

Everything template does, plus:

• Loads and validates the full configuration
• Validates flake URLs and configuration keys
• Validates bootstrap disk encryption key local paths
• Resolves inherited attributes, tags, and secrets
• Filters out disabled and untagged parts of the configuration
• Outputs the fully resolved configuration

The --validate.flakes and --validate.bootstrap-secrets flags are opt-in on workflow commands (see Deploy Flags); panix eval forces both on unconditionally.

Use it to validate configuration before deploying, see the resolved configuration after inheritance and tag filtering, debug inheritance issues (which secrets, tags, and settings each machine receives), or as a CI/CD validation step.

inspect

Inspect machines (reachability, OS, architecture, generations):

panix inspect

Runs only the Inspect phase. Useful for verifying SSH connectivity and machine states before a full deploy.

build

Build closures:

panix build

Runs only the Build phase. Useful for pre-building without deploying.

Pass --out-links (or set flags.out_links in panix.yml) to also leave GC-rooted outlinks for the built installables, so they survive garbage collection and are easy to inspect on disk. See Build Outlinks for details.

secrets

Deploy secrets to machines:

panix secrets

Runs Inspect, then the Secrets phase. Useful for updating secrets without a full deploy.

rollback

Rollback to a previous generation:

panix rollback               # Default: previous generation (--gen=-1)
panix rollback --gen=0       # Current generation
panix rollback --gen=-2      # Two generations before current
panix rollback --gen=5       # Specific generation number

--gen semantics: 0 is the current generation, -N is the Nth generation before current, and a positive N is a specific generation number.

For rolling back automatically after a failed deploy, see Auto Rollback.

snapshot

View a snapshot in TUI:

panix snapshot --path <snapshot-file.json>

--path (-p) is required and points at a snapshot JSON file. See Snapshots for taking snapshots and the file format.

completion

Prints shell code for initializing tab completion (bash, zsh, fish). See Shell Completion for setup.