Scope and prerequisites
Read-only preflight first; full/foundation profile and exact protected bundle acceptance remain release-specific. This reference describes the reviewed newer source CLI. Use the exact approved installed kit and authenticated operator terminal on the designated disposable VM. A marketing/documentation publication does not install these commands or qualify the host. Keep provider console, private configuration, original journals and independent recovery available. Never substitute placeholder digests, automatically accept a confirmation or reset a blocked journal. Inspect a read-only plan first where the family supports planning; apply is a separate explicit reviewed step. Credentials belong in the protected file parameters, not command-line secret values.
Parsed command family
panelctl version|validate|migrate|preflight|install|doctor|repair|amend-prepayload|amend-empty-layout|recover-service-identities|recover-mariadb-bootstrap|recover-mariadb-partial-bootstrap|amend-prebootstrap-coordinator|recovery|backup|backup-destination
Dispatched operator families
public-mail, website-log-layout, account-compensation-recovery, account-compensation-recovery-worker, owner-recovery, setup, activate-machine-root, rename-admin, public-certificate, amend-prebootstrap-coordinator, amend-post-services-verifier, recover-agent-registration, recover-core-startup, recover-core-ipc, recover-core-directories, recover-install-runtime, recover-mariadb-partial-bootstrap, recover-mariadb-bootstrap, amend-prepayload, amend-empty-layout, recover-service-identities, service-identity-shadow-helper, license, update, migration, security, server-executor, backup-destination-metadata, backup-destination, backup, recover-website-runtime, website-runtime-peer-probe, recovery, preflight, install, doctor, repair, version, migrate, validate. Internal worker/helper entries are not ordinary user commands; invoke only the documented release-specific operator route.
Exact parsed options
| Option | Parser default | Purpose |
|---|---|---|
--config |
"packaging/development.json" |
configuration path |
--agent-only |
false |
probe fixed root Unix agent as current unprivileged caller |
--foundation-agent |
false |
probe registered foundation services as an unprivileged agent peer |
--php-script-schedules |
false |
fresh full installation only: opt in to the exact native-qualified PHP8.3 helper bundle; legacy defaults false |
--profile |
"" |
installation profile: foundation for core services; empty retains the existing full profile |
--bundle |
"" |
absolute reviewed installation bundle |
--panel-hostname |
"" |
canonical public FQDN for the root-owned panel certificate target |
--mail-hostname |
"" |
canonical mail service FQDN; empty retains the panel-hostname fallback; does not add a listener |
--mail-outbound-probe |
"" |
authorized canonical public IP:25 endpoint for the outbound SMTP reachability probe |
--ftps-listen |
"" |
assigned public IPv4 for optional explicit-TLS FTPS |
--ftps-passive-address |
"" |
public IPv4 advertised for optional explicit-TLS FTPS passive data |
--ftps-passive-min |
0 |
first explicitly reserved FTPS passive TCP port |
--ftps-passive-max |
0 |
last explicitly reserved FTPS passive TCP port |
--ftps-certificate |
"" |
absolute protected PEM certificate-chain path for optional FTPS |
--ftps-private-key |
"" |
absolute protected PEM private-key path for optional FTPS |
--disposable-vm |
false |
explicitly designate this host a disposable development VM |
--authorize |
"" |
explicit installation authorization phrase |
--plan |
"" |
digest of current reviewed preflight plan |
Verify and handle failure
Read the command result and retained operation/report, then inspect actual owned service state. A saved metadata file or successful verification is not necessarily apply. On stale digest, unknown layout, unavailable agent, partial effect or uncertain delivery, retain the evidence and follow the exact release recovery procedure. Do not disable AppArmor, remove locks/receipts, overwrite unrelated files or claim a source-only test as installed success.