CLI reference

The orbita CLI is optional. Like the Vercel CLI, it's a convenience for people who prefer the terminal — everything it does for apps can also be done from the dashboard or by pushing to git. You never need it to run Orbita.

What it's genuinely good at: orbita init, which collapses hardening + install + admin account + host registration into one command from your own machine.

Install

Today the CLI is built from source — a one-line installer is not shipped yet

There is no curl … | sh or npm i -g for the CLI yet, and go install does not work either (the module path in go.mod is github.com/orbita-sh/orbita, which doesn't exist — the repo lives at github.com/MUKE-coder/orbita). Building from the clone is the only path that works right now. Nothing else on this site needs it.

Requires Go 1.25+:

Local terminal (your PC)

bash

git clone https://github.com/MUKE-coder/orbita.git
cd orbita
make build-cli

That produces ./orbita. Put it on your PATH:

Local terminal (your PC)

bash

sudo mv ./orbita /usr/local/bin/orbita
orbita --help

It won't clash with the Grit framework CLI

If you also use Grit, its CLI is a different binary (grit) from a different repo. orbita installs alongside it and neither shadows the other.

`orbita init` — provision a server

Hardens the box, installs Orbita, creates your admin login, and registers the host. Interactive by default — run it with no flags and answer the wizard.

Local terminal (your PC)

bash

orbita init

It asks: server IP → how you log in today (password or key) → deploy user name → deploy SSH key (generate or paste) → domain (blank = use the IP) → your admin email → confirm.

Flag	Meaning
`--server user@ip[:port]`	Target server (skips the IP prompt)
`--ssh-key <path>`	Private key for the initial connection
`--domain <host>`	Dashboard domain (blank → install on the IP)
`--acme-email <email>`	Let's Encrypt contact for TLS
`--admin-email <email>`	Orbita super-admin login
`--deploy-user <name>`	Sudo user to create (default `deploy`)
`--deploy-pubkey <path>`	Use an existing public key instead of generating one
`--skip-harden`	Skip hardening (server already hardened)
`--forget-host-key`	Drop a stale `known_hosts` entry for this IP (`ssh-keygen -R`)
`--name <host>`	Name to register the host under (default `prod`)
`--yes`	Non-interactive — use flags + defaults, no prompts

Environment variables

Variable	Purpose
`ORBITA_SSH_PASSWORD`	Root password for the initial connect. The only way to use password auth with `--yes` — it's env-only on purpose, so it stays out of shell history and `ps`.
`ORBITA_ADMIN_PASSWORD`	Set the admin password instead of generating one.
`ORBITA_HOSTS_FILE`	Override `~/.orbita/hosts.yaml` (tests).

Scripted example:

Local terminal (your PC)

bash

export ORBITA_SSH_PASSWORD='…'
orbita init --server root@203.0.113.10 \
  --domain orbita.example.com --acme-email you@example.com \
  --admin-email you@example.com --yes

init locks down root SSH

It creates the deploy user, installs the key, then disables root login and password auth — exactly what the manual hardening step does. Make sure you can log in as the deploy user before you rely on it.

Installed with the one-line installer or set Orbita up from the dashboard? You have a running server but the CLI doesn't know about it yet. orbita login fixes that — it authenticates, mints a deploy token, and registers the host:

Local terminal (your PC)

bash

orbita login https://orbita.example.com

It prompts for your admin email and password (the account you registered in the dashboard), then saves the host as prod in ~/.orbita/hosts.yaml. After that, orbita deploy --host prod works.

Flag	Meaning
`--name <host>`	Name to register under (default `prod`)
`--email <email>`	Admin email (prompted if omitted)
`--password <pw>`	Admin password (prompted if omitted — safer to let it prompt)

init vs login

orbita init provisions a fresh server and registers it in one step. orbita login connects to an already-running Orbita. Use whichever matches your situation — you never need both.

Host management

Command	Does
`orbita status --host prod`	Platform health, version, metrics
`orbita hosts`	List registered hosts
`orbita dashboard --host prod`	Open a private SSH tunnel to the dashboard
`orbita github-auth`	Store a GitHub token (`repo` + `admin:repo_hook`) for repo push

`orbita deploy`

Deploys the app in the current directory, reading orbita.yaml.

Local terminal (your PC)

bash

orbita deploy --host prod

Flag	Meaning
`--host <name>`	Target host
`--plan`	Dry run — print the plan, change nothing
`--org <name>`	Target organisation
`--dir <path>`	Project directory (default: cwd)
`--skip-push`	Don't push to git first

Operating an app

Command	Does
`orbita logs -f --host prod`	Stream logs over WebSocket
`orbita rollback --host prod`	Revert to the previous deploy

Files it touches

Path	Purpose
`~/.orbita/hosts.yaml`	Registered hosts: API URL, `orb_` token, default flag (0600)
`~/.orbita/github`	Stored GitHub token (0600)
`./orbita.yaml`	Per-app deploy manifest (spec)
`~/.ssh/<deploy-key>`	Generated deploy key — the private half never leaves your machine

orbita.yaml spec Troubleshooting

CLI reference

Install

orbita init — provision a server

Environment variables

orbita login — connect the CLI to an existing server

Host management

orbita deploy

Operating an app

Files it touches

Next

`orbita init` — provision a server

`orbita login` — connect the CLI to an existing server

`orbita deploy`