TurboStack CLI

Manage services, caches, the firewall, email and logs directly on your server with the tscli command-line tool.

tscli is the TurboStack command-line tool that ships on every TurboStack server. It gives you safe, audited control over day-to-day operations: checking and restarting services, clearing caches, managing the firewall, validating email Domain Name System (DNS), searching logs, and more, without needing to know the underlying system commands.

Where the API manages your configuration from the outside (the desired state that TurboStack deploys), tscli acts on the running server itself: it operates on live services and caches right now.

Note

tscli runs on the server, over SSH. Connect first (see your host's SSH tab for connection details), then run the commands below from that shell.

How it works

Run commands in the form:

tscli <group> <command> [arguments] [options]

For example:

tscli nginx reload
tscli service status
tscli firewall block 203.0.113.10 --comment "abuse"

Useful global flags:

Flag	What it does
`tscli --help` / `-h`	Show help for the tool, a group, or a command (for example `tscli firewall --help`).
`tscli --version` / `-v`	Show the installed `tscli` version.

Tab-completion is enabled, so you can press Tab to complete groups, commands, log sources and options.

Permissions and auditing

Most tscli commands act on system services and therefore need root privileges. This is configured for you: when you run tscli, it elevates automatically. You do not need to type sudo and you are not prompted for a password.

Every invocation is logged, including the connecting SSH IP address, to:

/var/log/tscli.log

This gives you (and Hosted Power) a clear audit trail of who ran what, and when.

Checking status

Almost every service group has a status command that shows whether the service is active and enabled, its uptime, and a liveness check. To see everything on the host at once, use tscli service status.

Warning

Some commands are destructive: they flush caches, kill processes, remove firewall rules, or overwrite files. They take effect immediately and cannot be undone. Each one is flagged below and listed under Destructive commands.

Web servers

Manage Nginx and Apache. Both validate the configuration first and abort safely if it is invalid, so a bad config can never take a site offline.

Command	What it does
`tscli nginx reload`	Validate the config and gracefully reload Nginx.
`tscli nginx restart`	Validate the config and restart Nginx.
`tscli nginx status`	Show Nginx service status and a config check.
`tscli apache reload`	Validate the config and reload Apache.
`tscli apache restart`	Validate the config and restart Apache.
`tscli apache status`	Show Apache service status and a config check.

# Apply a config change without interrupting live traffic
tscli nginx reload

Tip

Prefer reload over restart: it applies changes without dropping active connections. Use restart only when a full restart is genuinely needed.

Caching

Manage the Varnish full-page cache, the Redis object cache, and the PHP OPcache.

Command	What it does
`tscli varnish clear`	Clear the entire Varnish full-page cache.
`tscli varnish reload`	Validate and reload the Varnish configuration.
`tscli varnish status`	Show Varnish service status.
`tscli redis clear`	Flush the Redis cache instance (6379). The persistent instance (6378) is left untouched.
`tscli redis status`	Show Redis service status and a liveness check.
`tscli opcache clear`	Clear the PHP OPcache.

# Purge the full-page cache after a deploy or content change
tscli varnish clear

Note

tscli redis clear runs redis-cli flushall on the cache instance (6379), clearing all of its databases. The persistent instance (6378) - sessions and queues - is not affected. Expect a short performance dip while the cache warms up again. See Clear the Redis cache to target a single database.

Note

Clearing OPcache makes PHP recompile scripts on the next request, so the first hit after clearing is slightly slower. This is normal.

PHP

Command	What it does
`tscli php status`	Show PHP-FPM status for each installed PHP version.
`tscli php kill`	Terminate all PHP-FPM worker processes.

Warning

tscli php kill immediately stops all PHP processing on the server (graceful stop first, then a forced kill if needed). Requests in flight are aborted, which can interrupt transactions. Use it only as a last resort when PHP is stuck; for normal config changes, reload the web server instead.

Blackfire profiler

Manage the Blackfire PHP profiler.

Command	What it does
`tscli blackfire enable`	Install and enable the Blackfire profiler.
`tscli blackfire disable`	Remove and disable the Blackfire profiler.
`tscli blackfire configure`	Set the Blackfire server ID and token interactively.
`tscli blackfire reload`	Restart the Blackfire agent.
`tscli blackfire status`	Show Blackfire agent status.

# Enable profiling temporarily to investigate a performance problem
tscli blackfire enable
# ... profile your application ...
tscli blackfire disable

Note

enable and disable restart the PHP-FPM services so the change takes effect, which briefly interrupts PHP processing.

Databases

Restart and check MySQL/MariaDB, PostgreSQL and MongoDB. postgresql restart covers every detected cluster.

Command	What it does
`tscli mysql restart`	Restart the MySQL/MariaDB service.
`tscli mysql status`	Show MySQL/MariaDB status and a liveness check.
`tscli postgresql restart`	Restart all PostgreSQL clusters.
`tscli postgresql status`	Show PostgreSQL status and a per-cluster liveness check.
`tscli mongo restart`	Restart the MongoDB service.
`tscli mongo status`	Show MongoDB status and a liveness check.

Tip

Restart a database sparingly. A restart briefly interrupts every site that uses it. Check Database problems before restarting.

Search and queues

Command	What it does
`tscli solr restart`	Restart the Solr search service.
`tscli solr status`	Show Solr status.
`tscli rabbitmq status`	Show RabbitMQ status and a liveness check.
`tscli rabbitmq queue list <vhost>`	List the queues in a RabbitMQ virtual host (JSON output).

# List queues in the default virtual host
tscli rabbitmq queue list /

Containers

Command	What it does
`tscli docker restart`	Restart the Docker service.
`tscli docker status`	Show Docker status and the number of running containers.

Firewall

Manage the host Firewall, which works together with TurboShield threat detection. Blocks apply at both the network and web layers, take effect immediately, and repeating a block for the same address does not create a duplicate rule. Every command accepts an IPv4 or IPv6 address, or a Classless Inter-Domain Routing (CIDR) range.

Command	What it does
`tscli firewall check <ip>`	Look up whether an IP (or range) is currently blocked.
`tscli firewall block <ip>`	Block an IP. See the options below.
`tscli firewall unblock <ip>`	Remove a block for an IP.
`tscli firewall whitelist <ip>`	Add an IP to the allow and ignore lists.
`tscli firewall unlist <ip>`	Remove an IP from the allow and ignore lists.
`tscli firewall flush`	Remove all automatic blocks (permanent manual blocks remain).
`tscli firewall display-blocks`	List the active manual blocks. Add `--full` to include automatic blocks.
`tscli firewall display-whitelists`	List the active allow and ignore entries.
`tscli firewall status`	Show firewall status, protection mode and block counts.

Options for tscli firewall block:

Option	Default	What it does
`--time <seconds>`	`2592000` (30 days)	How long the block lasts. Use `-1` for a permanent block.
`--comment <text>`	empty	A short reason for the block (for the audit trail).

# Is this address blocked?
tscli firewall check 203.0.113.10

# Block an abusive IP for a week, with a reason
tscli firewall block 203.0.113.10 --time 604800 --comment "spam"

# Block a whole range permanently
tscli firewall block 203.0.113.0/24 --time -1

# Permanently trust a known-good IP (office, monitoring)
tscli firewall whitelist 198.51.100.7

Warning

tscli firewall flush removes all automatic blocks at once, including blocks that were protecting you from active abuse. Use it only when you are sure a block is a false positive and you need a clean slate. Permanent manual blocks are kept.

Tip

If you (or a customer) are locked out by the firewall, tscli firewall check <ip> confirms whether that IP is the cause, and tscli firewall whitelist <ip> restores access for a trusted address.

Email (DKIM)

Check the DomainKeys Identified Mail (DKIM) DNS records for the domains on the host. See Email for the wider mail setup.

Command	What it does
`tscli dkim records`	Show the DNS TXT records that DKIM requires for each domain.
`tscli dkim validate`	Look up the records in DNS and report whether they match.

# Show the records to add at your DNS provider
tscli dkim records

# Confirm they are live and correct
tscli dkim validate

Service overviews

Command	What it does
`tscli service status`	Show the status of every installed service on the host at a glance.
`tscli app status`	Overview of your application background services (per user).
`tscli app list`	A flat, scriptable list of app services (user, backend, service, active/total).
`tscli app backends`	Show which process manager each app user uses.

# Quick health snapshot of every service on the host
tscli service status

Logs

Search the server logs in plain language, without remembering file paths.

tscli logs <source> [query...] [--explain]

source is a log source such as nginx, apache, mysql, postgresql, php, redis, or web (Nginx and Apache together). For web sources, add error or access to narrow the scope.
The query understands phrases like find <text>, show last <n> lines, and time ranges such as from last hour or from 2 hours ago.
When you give more than one search term, they are combined with AND by default: a line must contain every term to match. To match any term instead, put or between them.
--explain shows how your query was interpreted, including whether the terms were combined with "and" or "or".

tscli logs nginx error                          # recent Nginx error log
tscli logs nginx find timeout from last hour    # search both Nginx logs for "timeout"
tscli logs web find 203.0.113.10 timeout        # lines that contain BOTH terms (AND)
tscli logs web find 203.0.113.10 or 203.0.113.11  # lines that contain EITHER term (OR)
tscli logs mysql find error from 2 hours ago    # MySQL log, scoped by time

See Troubleshooting for how to use logs while diagnosing an issue.

Health snapshot

tscli healthcheck [brief]

Shows a one-screen snapshot of the server: uptime and load, memory and swap, disk usage per mount, the top memory-using processes, and active connections. Add brief for a shorter report. For the full picture over time, use the host's Health tab.

Tools

Bot traffic analysis

Analyze how much of your traffic comes from bots and crawlers, which feeds into TurboShield tuning.

Command	What it does
`tscli tools botload list [--time <start> <end>]`	List log files and analyze one (optionally within a time window, `HH:MM:SS`).
`tscli tools botload shared [-n <count>]`	Analyze all web logs and rank them by bot percentage (default top 10).
`tscli tools botload ip <ip> [--cidr <bits>]`	Analyze all entries for an IP or range (default `--cidr 32`).
`tscli tools botload live`	Watch incoming traffic and update bot statistics in real time.

# Which logs have the highest bot share?
tscli tools botload shared -n 20

Image optimizer

Reduce the size of JPG and PNG assets under a path.

tscli tools image-optimizer <path> [options]

Option	Default	What it does
`-a`, `--apply`	off (dry-run)	Replace originals when the optimized file is smaller.
`-q`, `--quality <1-100>`	`90`	JPEG quality target.
`-s`, `--size <pixels>`	`2000`	Maximum width/height before resizing.
`-n`, `--new`	off	Only scan files added since the last run.
`--exclude <path>`	none	Skip a directory tree (repeatable).

# Preview savings (no changes made)
tscli tools image-optimizer /var/www/site/media

# Apply, at quality 85 and max 1500px
tscli tools image-optimizer /var/www/site/media -q 85 -s 1500 -a

Warning

tscli tools image-optimizer with -a/--apply overwrites the original image files. Run it first without -a to preview the savings.

Destructive commands

These change state immediately and cannot be undone. Use them with care:

tscli redis clear, tscli varnish clear, tscli opcache clear - clear caches (temporary performance dip).
tscli php kill - stops all PHP processing; in-flight requests are dropped.
tscli firewall flush - removes all automatic blocks.
tscli blackfire disable / configure - removes the profiler / overwrites its credentials.
tscli tools image-optimizer ... -a - overwrites original image files.
tscli ... restart / reload - can cause a brief interruption if a service fails to come back.

Exit codes

tscli returns 0 on success and a non-zero code on failure, so you can use it safely in scripts:

Code	Meaning
`0`	Success
`1`	Command failed, or could not elevate to root
`6000`	Generic error
`6001`	Invalid user input
`6002`	Service is not installed
`6101`	Invalid Nginx configuration
`6201`	Invalid IP address
`6301`	Could not install Blackfire
`6302`	Could not remove Blackfire
`130`	Interrupted (Ctrl-C)

When to use the CLI

You want to...	Use
Change configuration (versions, services, domains)	In the TurboStack Platform or API, then publish
See whether a service is healthy	`tscli service status` or `tscli <service> status`
Apply a config change to the running web server	`tscli nginx reload`
Clear caches after a deploy or content change	`tscli varnish clear`, `tscli redis clear`, `tscli opcache clear`
Block or trust an IP address	`tscli firewall block` / `whitelist`
Check or validate email DNS	`tscli dkim records` / `validate`
Search logs while troubleshooting	`tscli logs <source> find <text>`

Important

tscli operates on the running server. It does not change your saved TurboStack configuration: a future publish re-applies the desired state. To make a change permanent, set it in the TurboStack Platform or API and publish.

TurboStack CLI

Note

How it works

Permissions and auditing

Checking status

Warning

Web servers

Tip

Caching

Note

Note

PHP

Warning

Blackfire profiler

Note

Databases

Tip

Search and queues

Containers

Firewall

Warning

Tip

Email (DKIM)

Service overviews

Logs

Health snapshot

Tools

Bot traffic analysis

Image optimizer

Warning

Destructive commands

Exit codes

When to use the CLI

Important

Related

See also