CLI

opex-flow [CONFIG]                # CONFIG defaults to ./config.yaml
opex-flow /etc/opex-flow/config.yaml
opex-flow --check-config config.yaml   # load + validate, print OK/error, exit 0/1
opex-flow --version
opex-flow --help

An explicitly passed config path that does not exist is a startup error: the connector never silently falls back to defaults. Use --check-config in CI or before a restart to lint a config (including ${VAR} substitution and sink names).

Validate transforms from the UI (Check) or the API (POST /api/script/validate). Set secrets via environment variables and reference them as ${VAR} in the config ($$ writes a literal $, so $${ gives ${). Environment overrides: OPEX_BIND_ADDR, OPEX_DATA_DIR, OPEX_API_TOKEN, RUST_LOG.

Releases: export, import, test, promotion

opex-flow export --dir <repo> [--config c.yaml] [--data-dir d] [--version N]
opex-flow import --dir <repo> [--config c.yaml] [--dry-run] [--message m] [--url U --token T]
opex-flow test   --dir <repo> [--config c.yaml] [--vars vars.json] [--junit out.xml] [--filter s]
opex-flow promotion keygen [--config c.yaml] [--force]    # signing key for promotions; prints the public key
opex-flow promotion pubkey [--config c.yaml]

test exits 0 when every case passes, 1 when a case fails or the flow does not compile, 2 on a usage or I/O error. See Git export, import and CI tests and Promotion.

Secrets

opex-flow secret keygen                              # a new random OPEX_MASTER_KEY
printf %s "$TOKEN" | opex-flow secret set erp_token  # create/replace a local secret (value from stdin)
opex-flow secret list                                # names and change times, never values
opex-flow secret rm erp_token

secret set|list|rm edit <data_dir>/secrets.enc (encrypted with OPEX_MASTER_KEY); use --data-dir DIR or --config FILE to pick the data directory (default: OPEX_DATA_DIR, else the directory of ./config.yaml). Reference a secret as ${secret:erp_token} wherever ${ENV} works. See Data protection.