Daily Operations

Day-to-day stack management with the intelliask binary — start, stop, restart, status, logs, shell, db, updates, backup/restore, and systemd.

intelliask is a single self-contained binary that drives the whole stack. It finds the config/ folder sitting next to it (where the *.compose.yml files and .env live) and shells out to docker compose for you. It acts on the whole stack by default, or on one or more named services if you pass them.

Running the binary

On the VM the binary lives next to config/ (e.g. /opt/intelliask/intelliask). Run it as ./intelliask <command> from that folder, or put it on your PATH and call intelliask <command> from anywhere. A short iask alias is installed too. Run intelliask help for the full command + flag reference.

Commands

intelliask up                # start the whole stack (detached)
intelliask down              # stop + remove the whole stack
intelliask restart           # restart the whole stack
intelliask stop              # stop (keep containers)
intelliask start             # start previously-stopped containers
intelliask status            # service status + health (docker ps + app probe)
intelliask status --raw      # plain `docker compose ps` output
intelliask logs              # tail logs for the whole stack
intelliask shell <service>   # open a shell in a container
intelliask db mongo|psql     # open a database client
intelliask update            # pull latest images and recreate services
intelliask doctor            # run diagnostics: preflight + .env sync (subchecks: env | health)
intelliask backup            # back up databases + config
intelliask backup restore --from DIR # restore a backup
intelliask provision [flags] # full first-time setup
intelliask module <list|enable|disable> [name]   # optional features (incl. proxy)
intelliask banner <show|set|clear> [flags]   # in-app announcement banner
intelliask secrets <gen|rotate>   # manage secrets in .env
intelliask garage            # bootstrap the Garage S3 store
intelliask service           # install/uninstall the systemd unit
intelliask version           # print the binary version

Command	What it does
`up`	Create + start the stack detached. Add `--no-detach` to stream logs in the foreground.
`down`	Stop and remove containers (data volumes are kept unless you pass `--volumes`).
`restart`	Restart containers in place.
`stop` / `start`	Stop without removing / start stopped containers.
`status`	Per-service state + health-check column, plus a probe of the app's `/health` endpoint. Add `--raw` for plain `docker compose ps` (accepts service names), or `--no-probe` to skip the HTTP check. Also available as `health`.
`logs`	Follow logs (`-f --tail=200`). Filter with `--since`, `--grep`, `--errors`.
`shell`	Open `bash`/`sh` in a service, or run a one-off command with `-- <cmd>`.
`db`	Open a DB client — `mongo` (mongosh) or `psql` — with in-container credentials.
`update`	Pull the latest images and recreate services — see Updating images.
`doctor`	Run diagnostics in one pass: host/config preflight (Docker reachable, Compose version, cgroup v2, `/dev/kvm`, core secrets, free ports, disk space) and the `.env` ↔ compose sync check. Subchecks: `doctor env` (sync only) and `doctor health` (live probe only).
`backup` / `backup restore`	Snapshot and restore the databases + config — see Backup & restore.
`provision`	First-time setup — see Installation.
`module`	Enable/disable/list optional features — the reverse proxy, exporter, code interpreter, Garage, RAG API, and vector DB. See Optional modules and Reverse Proxy.
`banner`	Show, set, or clear the in-app announcement banner without shelling into the container — see Banner.
`secrets`	`gen` fills blank secrets; `rotate` regenerates all — see Configuration & Secrets.
`garage`	(Re-)create the Garage S3 layout, bucket, and access key.
`service`	Install/uninstall the systemd boot unit.
`version`	Print the binary version.

Working with a single service

Append one or more service names to act on just those. Valid services:

mongodb  meilisearch  vectordb  rag-api  intelliask  redis  garage  exporter
codeapi-api  codeapi-service-worker  codeapi-file-server
codeapi-tool-call-server  codeapi-egress-gateway  codeapi-sandbox-runner

(proxy is also valid when the reverse proxy is enabled.)

intelliask restart rag-api                # restart one service
intelliask restart intelliask codeapi-api # restart several
intelliask up mongodb                     # (re)create + start one service
intelliask logs intelliask                # tail one service's logs
intelliask status                         # full stack status

down acts on the whole stack

down always tears down the entire stack. To stop a single service without removing the rest, use stop (or restart) with the service name: intelliask stop rag-api.

Checking health & reading logs

intelliask status                         # per-service state/health + /health probe
intelliask status --no-probe              # table only, skip the HTTP probe
intelliask logs intelliask                # follow one service's logs
intelliask logs --errors                  # only error-like lines across the stack
intelliask logs --since 10m --grep timeout intelliask
intelliask logs --no-follow --tail 500 codeapi-api

Getting a shell or database client

intelliask shell intelliask               # bash/sh inside the app container
intelliask shell codeapi-api -- ls /app   # run a one-off command
intelliask db mongo                        # mongosh into MongoDB (IntelliAsk db)
intelliask db psql                         # psql into the pgvector database

Both db clients authenticate with the credentials already inside the container, so no secrets appear on your command line.

Updating to a new image

Images are referenced as ${REGISTRY:-}${<SERVICE>_IMAGE} in each compose file. Use update to pull the latest tag and recreate — the whole stack, or named services:

intelliask update                          # pull + recreate everything
intelliask update intelliask               # just the app
intelliask update intelliask codeapi-api   # several services

To pin a specific tag, --version rewrites the matching <SERVICE>_IMAGE in config/.env (after a safety backup of .env) before pulling:

intelliask update --version v0.9.0 intelliask

update does a best-effort private-registry login first (using the CI_* credentials in config/.env); pass --skip-login to skip it. It does not edit any other .env values or run a full down/up — only the targeted services are recreated. See Configuration & Secrets.

Backup & restore

backup dumps MongoDB and the pgvector Postgres database (streamed straight out of the containers) and archives the whole config/ directory (.env, intelliask.yaml, compose files, garage.toml, proxy config/certs). The bind-mounted storage folder is excluded by default — add --with-files to include uploads, generated images, and licenses.

intelliask backup                          # DBs + config -> <storage>/backups/<timestamp>/
intelliask backup --with-files             # also archive the storage folder
intelliask backup --keep 7                 # prune all but the newest 7 backups
intelliask backup --out /mnt/backups       # choose the destination

Schedule daily backups with a systemd timer (requires root):

intelliask backup schedule --time 02:00 --keep 7   # daily at 02:00, keep 7
intelliask backup unschedule                       # remove the timer

Restore points at a backup directory and overwrites the current databases (you must type restore to confirm). The captured config/ is restored too:

intelliask backup restore --from ./storage/backups/20260721-020000
intelliask backup restore --from <dir> --with-files # also restore storage files
intelliask restart                                 # pick up restored config

intelliask restore --from ... still works as a top-level alias for intelliask backup restore.

Tearing down

intelliask down                  # stop + remove containers, KEEP data
intelliask down --volumes        # ALSO delete named volumes (DESTROYS DATA)
intelliask down --local-storage  # ALSO delete the host STORAGE_ROOT files

Destructive flags

--volumes wipes Mongo/Postgres/Garage data. Secrets stay in .env, but after the next up you must re-bootstrap Garage (intelliask garage, or re-run intelliask provision) to recreate the S3 bucket/key. You'll be asked to type yes to confirm.
--local-storage (alias --storage) deletes the host bind-mounted STORAGE_ROOT folder (uploads, generated files, Code Interpreter data). It does not delete .env, config, or proxy certs. You'll be asked to type delete local storage to confirm.

Running on boot (systemd)

Provisioning installs and enables intelliask.service, so the stack comes up automatically after a reboot. Manage the unit with the binary or systemctl:

intelliask service                # install + enable the boot unit
intelliask service --start        # install, enable, and start now
intelliask service --uninstall    # stop, disable, and remove the unit
 
sudo systemctl start intelliask
sudo systemctl stop intelliask
sudo systemctl restart intelliask
sudo systemctl status intelliask

Both the systemd service and the day-2 commands honour the persisted reverse-proxy choice (PROXY_ENABLED in config/.env).