Command line¶

One binary, cdn, with two halves. The client commands talk to a running service over HTTP and need nothing but a URL and a token. The server commands talk to the database and the object store directly, and are run where DATABASE_URL and the S3 settings are set.

cdn --help

Client commands¶

cdn login stores the address and the token in ~/.config/cdn/config.json, so the rest take neither. CDN_URL and CDN_TOKEN override it — which is what a CI job should use rather than writing a config file.


`cdn login <url> <token>`	store a credential for this machine
`cdn ls <zone> [prefix]`	list objects
`cdn put <zone> <file> [path]`	upload one file
`cdn rm <zone> <path>`	delete one object
`cdn sync <zone> <dir>`	upload a directory, skipping what already matches
`cdn url <zone> <path>`	print an object's URL
`cdn purge <zone> [paths…]`	drop cached copies

cdn sync assets ./dist --delete      # remove objects the directory lacks
cdn sync assets ./dist --dry-run     # say what would happen, do nothing
cdn url assets reports/q3.pdf --expires 2h
cdn purge assets --prefix img/
cdn purge assets --all

sync compares size and MD5 against what is already stored, so a second run over an unchanged tree transfers nothing. Durations are 90, 30m, 2h, 7d.

Server commands¶

Schema and workers¶


`cdn migrate`	bring the database up to the latest schema
`cdn sweep --interval 300`	evict least-recently-read files past the high-water mark
`cdn rollup --interval 3600`	fold hourly statistics into daily, prune the audit log
`cdn reconcile [zone] [--repair]`	compare the index against the object store

The two workers loop on an interval rather than relying on cron, because the platform they run on supervises processes and has no scheduler. reconcile is one-shot and exits non-zero when something disagrees, which makes it a reasonable nightly job.

Provisioning¶


`cdn create-org <slug> <name>`	create an organisation
`cdn create-zone <slug> --org <slug>`	create a zone
`cdn create-user <email> <name> --org <slug>`	create a web UI account
`cdn create-token <name> --org <slug>`	mint a token
`cdn set-quota org\\|zone <slug> <size>`	cap how much may be stored

cdn create-user you@example.com "Your Name" --org acme --role owner
cdn create-token "release uploads" --org acme \
    --zone acme-assets --prefix releases/ --scopes write
cdn create-token "rclone" --org acme --scopes read,write,delete --s3
cdn set-quota org acme 100G
cdn set-quota zone acme-video none      # lift it again

create-user generates and prints the password unless one is given — a password typed on a command line is in the shell history of whoever ran it. create-token prints the secret once; only a hash is stored. --s3 additionally prints what to configure an S3 client with.

Scopes are read, write, delete, purge and stats, comma-separated; the default is read,write. --prefix restricts the token to paths under it, for reads and listings as well as writes.