CLI Reference

Oriel exposes one root command:

oriel [--config oriel.toml] <command>

The config flag is also available as ORIEL_CONFIG.

Root Flag

Flag	Default	Description
--config, -c	oriel.toml	Path to the TOML config file. Environment overrides still apply.

serve

Run the Oriel server.

oriel serve --role=all

Flag	Default	Values
--role	all	all, ingest, query, worker

migrate

Apply or inspect metadata and ClickHouse schema migrations.

oriel migrate up
oriel migrate status
oriel migrate down --steps 1 --yes

Subcommand	Purpose
migrate up	Apply all pending migrations.
migrate status	Show migration ledger state for each store.
migrate down	Roll back applied migrations. This destroys data and requires --yes.

Common flag:

Flag	Default	Values
--store	all	metadata, clickhouse, all

migrate down flags:

Flag	Default	Description
--steps	1	Number of versions to roll back.
--all	false	Roll back every applied version.
--yes	false	Confirm destructive rollback.

admin

First-run and emergency administration helpers.

ORIEL_BOOTSTRAP_PASSWORD='change-me' \
  oriel admin bootstrap --email you@example.com
oriel admin create-workspace --slug demo
oriel admin token --workspace demo --permissions telemetry:query
oriel admin invite --email user@example.com --workspace demo --role viewer

Subcommand	Purpose
admin bootstrap	Create the first instance-admin user. Refuses to run once any user exists.
admin create-workspace	Create a workspace.
admin token	Mint an API token for a workspace. The secret is printed once.
admin invite	Create an invitation and print its one-time accept link.

admin bootstrap flags:

Flag	Required	Description
--email	Yes	User email.
--password	Yes	Prefer ORIEL_BOOTSTRAP_PASSWORD because flags are visible in process lists.
--name	No	Display name. Defaults to email.

admin create-workspace flags:

Flag	Required	Description
--slug	Yes	Workspace slug. Leading underscore slugs are reserved.
--name	No	Display name. Defaults to slug.
--owner-email	No	Instance-admin recorded as creator.

admin token flags:

Flag	Required	Default	Description
--workspace	Yes		Workspace slug.
--name	No	api	Token name.
--permissions	No	telemetry:query	Comma-separated API permissions.

admin invite flags:

Flag	Required	Description
--email	Yes	Invitation recipient.
--workspace	No	Workspace slug. Omit for an instance account-only invite.
--role	No	Workspace role slug. Defaults to viewer for workspace invites.
--instance-admin	No	Grant instance-admin on an instance invite.

doctor

Check deployment health.

oriel --config /etc/oriel/oriel.toml doctor

doctor checks:

• Metadata DSN and PostgreSQL connectivity
• ClickHouse DSN, connectivity, and version floor
• Valkey DSN and connectivity
• Migration status for both stores
• Clock skew
• TLS or plaintext listener safety
• Disk headroom