opschain support bundle
Included from Basic tier
Collects a diagnostics bundle for a support case into one tar.gz — with no customer secrets, no tokens and no key material. Secret-bearing values in the server config are REDACTED (the store DSN password, the LDAP bind password, the vault block's secret keys); non-secret operational values stay readable.
What goes in:
- Always: the home's
config.yaml(redacted), a key-material presence report (keys-presence.txt— which key files exist, never their contents), and abundle.jsonmanifest carrying the CLI version, commit, build date and the server it collected from. - With
--server: live diagnostics fetched from that server — health (healthz.json) and readiness (readyz.json) snapshots, admin status and queue (admin-status.json,admin-queue.json), the licence usage report (licence.json: resolved licence status plus usage counts against each limit — no envelope contents beyond licence id, licensee and expiry), the fleet summary (runners.json,runner-groups.json), recent events (events.json) and the metrics exposition (metrics.txt). A failed fetch is recorded as<name>.error.txtinside the bundle rather than failing the whole collection.
On success it prints wrote <path> (<n> files; secrets redacted, key material excluded). The output file is created exclusively — an existing
file of the same name fails the command rather than being overwritten.
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL to collect live diagnostics from (omit for an offline config-only bundle). This local flag is the collection target; it is independent of the global server/context targeting. |
--auth-token <token> | Bearer token for the admin-gated diagnostics (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). Without any credential the admin-gated fetches land as .error.txt entries. |
--out <file> | Output file (default: ./opschain-support-bundle-<timestamp>.tar.gz). |
Environment
| Variable | Meaning |
|---|---|
OPSCHAIN_ADMIN_TOKEN | Fallback for --auth-token, after your stored login. |
Exit codes
| Code | Meaning |
|---|---|
| 0 | Bundle written (individual fetch failures are recorded inside it, not fatal). |
| 1 | The home could not be resolved or the bundle file could not be written (an already-existing output file included). |
| 2 | Usage error. |
Examples
Offline, config-only:
opschain support bundle
Full live collection:
opschain support bundle --server https://opschain.example.com --out case-1234.tar.gz
See also
opschain docs cli/api-routes— the admin endpoints the live collection reads.