CLI 参考

tiyi CLI 是驱动 UI 的同一个 ConnectRPC API 的瘦客户端。每一个写入路径只有一处；CLI 与 API 由架构保证同步。本页按资源分组列出命令 —— 任意子命令的完整 flag 接口请运行 tiyi <cmd> --help。

鉴权模式

CLI 用两种方式之一与 Tiyi 通信。本地命令不需要 token；远程命令需要 API URL 与一个 JWT。

从用户名/密码取一个 JWT：

$ tiyi auth login --api http://primary:8080 --username admin
# 输入密码,打印 JWT,可选写入 ~/.config/tiyi/credentials

声明式 apply

kubectl 风格入口。一份 YAML、一条命令、一行审计：

$ tiyi apply -f site.yaml
# 预览 apply、显示按资源 diff、提示确认、最后真正 apply

与 UI 用同一个验证器和写入器。带 --yes 跳过提示。一个文件中的多个资源按依赖顺序 apply。

站点

tiyi site list
tiyi site get <name|id>
tiyi site create --name N --hostname H --upstream P --policy P [--tls auto|none|CERT]
tiyi site update <id> [...flag]
tiyi site enable <id>
tiyi site disable <id>
tiyi site delete <id>
tiyi site preview <id>           # dump 写入器要发出的 Caddy JSON
tiyi site policy-override <id> [--blocking-pl N --inbound-threshold N ...]

上游

tiyi upstream list
tiyi upstream get <name|id>
tiyi upstream create --name N --target URL [--target URL2 ...]
tiyi upstream update <id> [...flag]
tiyi upstream delete <id>      # 若任何站点引用,拒绝(UPSTREAM_IN_USE)

证书

tiyi cert list
tiyi cert get <id>
tiyi cert upload --name N --cert FILE --key FILE
tiyi cert issue --domain D --email E [--challenge http-01|dns-01] [--directory URL]
tiyi cert renew <id>
tiyi cert delete <id>
tiyi cert dns-provider drivers
tiyi cert dns-provider list
tiyi cert dns-provider create --name N --provider cloudflare --credentials-file F
tiyi cert dns-provider get <id>
tiyi cert dns-provider update <id>
tiyi cert dns-provider delete <id>

WAF 策略

tiyi policy list
tiyi policy get <id>
tiyi policy create --name N --template strict|standard|permissive
tiyi policy update <id> [...layer flag]
tiyi policy delete <id>
tiyi policy preview <id> [--site-id S]   # 实际编译后的 SecLang
tiyi policy versions <id>                       # 列出快照版本
tiyi policy diff <id> --from A --to B           # 并排 diff
tiyi policy rollback <id> --to REV

规则覆盖、自定义规则、IP 列表

tiyi rule override upsert --policy P --rule-id N --action default|disable|log_only|score_override [--score-override N] [--scope global|site --site-id S]
tiyi rule override delete --policy P --rule-id N
tiyi rule custom create --policy P --seclang FILE
tiyi rule custom delete --policy P --rule-id N
tiyi rule ip-list create --policy P --kind allow|deny|monitor --name N
tiyi rule ip-list add-entries <id> 203.0.113.0/24 geo:CN
tiyi rule ip-list import-csv <id> --file F
tiyi rule ip-list bind <id> --policy P [--path-prefix /api]
tiyi rule rate-limit upsert --policy P --endpoint /login --rps 5 --action block

CRS 目录

tiyi crs ingest --tag v4.25.0            # 从上游抓取 release
tiyi crs ingest --archive FILE             # 离线归档导入
tiyi crs releases                            # 列出可用上游 tag
tiyi crs list                                # 已安装 CRS 规则集
tiyi crs rules --tag v4.25.0 --paranoia 1 --tag attack-sqli
tiyi crs exclusion-package list
tiyi crs exclusion-package install --slug wordpress
tiyi crs exclusion-package attach --policy P --slug wordpress [--scope /wp-admin/]

节点

tiyi agents list
tiyi agents get <id>
tiyi agents issue-token [--tag edge] [--ttl 24h]
tiyi agents install-script --server-url URL --enrollment-token T
tiyi agents send-command <id> --kind reload|restart|collect_diagnostics
tiyi agents commands [--agent-id id>]
tiyi agent-group list
tiyi agent-group create --name N --tag-selector role=edge
tiyi agent-group resolve <id>

信任配置

tiyi trust show
tiyi trust set --trusted-proxies 10.0.0.0/8,172.16.0.0/12 --client-ip-headers X-Forwarded-For
tiyi trust reset
tiyi trust test --peer 10.0.0.5 --header "X-Forwarded-For: 1.2.3.4"
tiyi trust status
tiyi trust cdn list
tiyi trust cdn refresh cloudflare

告警

tiyi alert active list
tiyi alert active ack <id>
tiyi alert active resolve <id>
tiyi alert rule list
tiyi alert rule upsert --name N --kind security_threshold --condition FILE
tiyi alert channel list
tiyi alert channel upsert --name N --kind webhook|slack|pagerduty|feishu|wecom --config FILE
tiyi alert channel test <id>

日志

tiyi log security list [--site S] [--client-ip IP] [--rule-id N] [--from T] [--to T]
tiyi log security get <event-id>
tiyi log security export --format ndjson --output F
tiyi log access  list [...过滤器]
tiyi log error   list [...过滤器]
tiyi log audit   list [...过滤器]
tiyi log tail-security                       # 实时流

审计链

tiyi audit list [--actor UUID] [--action prefix] [--from T] [--to T]
tiyi audit get <id>
tiyi audit verify-chain                      # 走完整条链并报告每一段

系统

tiyi system stats
tiyi system traffic --window 1h
tiyi system attack-distribution --window 1h
tiyi system top-attackers --window 1h
tiyi system settings get
tiyi system settings update --key siem.filter.include_audit --value true
tiyi system settings update --key telemetry.enabled --value true

发布（滚动节点升级）

tiyi release import --tarball ./tiyi-1.2.3.tar.gz
tiyi release list
tiyi release apply <release-id>           # 把 APPLY_BINARY 散到所有匹配的节点
tiyi release apply <release-id> --agent-id A --agent-id B
tiyi release runs
tiyi release run-get <run-id>
tiyi release run-cancel <run-id>
tiyi release rollback
tiyi release check-updates

用户与角色

tiyi user list
tiyi user create --username U --role R
tiyi user reset-password <id>
tiyi user lock <id>
tiyi user unlock <id>
tiyi role list
tiyi role get <id>

集群故障转移

tiyi promote                     # 在备节点上,确认主节点不可达后
tiyi promote --force             # 跳过 demote;接受有界数据丢失

退出码