StackStorm

st2

StackStorm is a platform for integration and automation across services and tools, taking actions in response to events.

Runs as st2|macOS, Linux, Windows|docs.stackstorm.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

StackStorm in your home directory Every rule on this page, by file

[general]

base_url = https://st2.example.com

api_version = v1

cacert = /Users/octocat/.st2/ca-bundle.crtmachine-local

[cli]

debug = False

…

Each machine keeps its own copy of these.

passwordapi_keybasic_auth

Lifted into your secret store; the rest of the file syncs.

· token-* Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/st2/otty.tomlThe file this page is generated from

id = "st2"

name = "StackStorm"

homepage = "https://docs.stackstorm.com/reference/cli.html"

description = "StackStorm is a platform for integration and automation across services and tools, taking actions in response to events."

# StackStorm's own mark, the icon its site serves.

icon = "https://stackstorm.com/wp/wp-content/uploads/2015/09/st2.png"

executables = ["st2"]

[dotfiles]

# https://docs.stackstorm.com/reference/cli.html — "CLI Configuration": the

# config file is ~/.st2/config (overridable with ST2_CONFIG_FILE or

# --config-file). It is an ini file with [general], [cli], [credentials],

# [api], [auth] and [stream] sections.

paths = ["~/.st2/config"]

exclude = []

# Same page, "Authentication": auth tokens are "by default cached on the local

# filesystem (in the ~/.st2/token-<username> file) and re-used for subsequent

# requests". A bearer token, whole file.

secret = ["~/.st2/token-*"]

# Read per invocation; st2 is a client, the daemons are on the server.

side_effect = false

# The [credentials] section holds the login itself: `password` in plaintext,

# or `api_key` instead of it, or `basic_auth` as user:password for an HTTP

# proxy in front of the API.

[[dotfiles.secret_paths]]

file = "~/.st2/config"

match = { prefix = ["password", "api_key", "basic_auth"] }

# [general] cacert is a filesystem path to the CA bundle on this host; the

# next machine has that bundle somewhere else, or not at all. base_url and the

# per-service urls are not machine-local — they name the StackStorm deployment

# the user talks to from every machine.

# The bundle is one the user put on this host, so the path is worth keeping to

# rebuild it and worth nothing on a machine that does not carry that file.

[[dotfiles.machine_lines]]

file = "~/.st2/config"

match = { prefix = ["cacert"] }

scope = "backup"

[commands]

format = 1

label = "StackStorm CLI"

description = "Run a StackStorm action. Authentication, packs, rules and execution management are left out."

quality = "ai-draft"

base = "fig:st2"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/st2.ts"

license = "MIT"

[[commands.subcommand]]

path = ["run"]

label = "Run an action"

description = "Invoke an action manually with key=value parameters."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/st2.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "action"

label = "Action ref or ID"

type = "string"

position = 0

description = "Reference or ID of the action, e.g. core.local."

sources = ["fig"]

[[commands.subcommand.field]]

id = "parameters"

label = "Parameters"

type = "string"

position = 1

description = "Keyword arguments such as cmd=\"uname -a\"."

multiple = true

sources = ["fig"]

[[commands.subcommand.field]]

id = "async"

label = "Do not wait"

type = "boolean"

option = ["--async", "-a"]

description = "Do not wait for the action to finish."

sources = ["fig"]

[[commands.subcommand.field]]

id = "tail"

label = "Tail execution"

type = "boolean"

option = ["--tail"]

description = "Automatically start tailing the new execution."

sources = ["fig"]

[[commands.subcommand.field]]

id = "json"

label = "JSON output"

type = "boolean"

option = ["--json", "-j"]

description = "Print output in JSON format."

sources = ["fig"]

[[commands.subcommand.field]]

id = "yaml"

label = "YAML output"

type = "boolean"

option = ["--yaml", "-y"]

description = "Print output in YAML format."

sources = ["fig"]

[[commands.subcommand.field]]

id = "detail"

label = "Full detail"

type = "boolean"

option = ["--detail", "-d"]

description = "Display full detail of the execution in table format."

sources = ["fig"]

[[commands.subcommand.field]]

id = "key"

label = "Result key"

type = "string"

option = ["--key", "-k"]

description = "Print a specific key of a JSON result."

sources = ["fig"]

[[commands.subcommand.field]]

id = "delay"

label = "Delay (ms)"

type = "integer"

option = ["--delay"]

description = "Delay the execution before scheduling."

sources = ["fig"]

[[commands.subcommand.field]]

id = "user"

label = "Run as user"

type = "string"

option = ["--user", "-u"]

description = "User under which to run the action (admins only)."

sources = ["fig"]

[[commands.subcommand.task]]

id = "run"

label = "Run and wait"

fields = ["action", "parameters", "detail"]

required = ["action"]

[[commands.subcommand.task]]

id = "async"

label = "Run in background"

set = { async = [true] }

fields = ["action", "parameters"]

required = ["action"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["action", "parameters", "async", "tail", "json", "detail"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["yaml", "key", "delay", "user"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/st2. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps the credential file out. None of them splits cacert for you — that part is Otty’s own sync, or a template you write by hand.