diff --git a/pkg/i18n/locales/es.po b/pkg/i18n/locales/es.po
index 4fe1b7946f..fd9d2f9ed8 100644
--- a/pkg/i18n/locales/es.po
+++ b/pkg/i18n/locales/es.po
@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2025-08-26 13:36-0400\n"
+"POT-Creation-Date: 2025-08-27 12:59-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -11,7 +11,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 
-#: cli/app/cp.go:32
+#: cli/app/cp.go:33
 msgid ""
 "  # copy myfile.txt to the root of the app service\n"
 "  abra app cp 1312.net myfile.txt app:/\n"
@@ -20,7 +20,7 @@ msgid ""
 "  abra app cp 1312.net app:/myfile.txt ./"
 msgstr ""
 
-#: cli/app/volume.go:88
+#: cli/app/volume.go:90
 msgid ""
 "  # delete volumes interactively\n"
 "  abra app volume rm 1312.net\n"
@@ -29,7 +29,7 @@ msgid ""
 "  abra app volume rm 1312.net my_volume"
 msgstr ""
 
-#: cli/recipe/fetch.go:23
+#: cli/recipe/fetch.go:24
 msgid ""
 "  # fetch from recipe catalogue\n"
 "  abra recipe fetch gitea\n"
@@ -41,7 +41,7 @@ msgid ""
 "  abra recipe fetch gitea --ssh"
 msgstr ""
 
-#: cli/run.go:84
+#: cli/run.go:86
 msgid ""
 "  # generate the man pages into /usr/local/share/man/man1\n"
 "  abra_path=$(which abra)  # pass abra absolute path to sudo below\n"
@@ -53,16 +53,19 @@ msgid ""
 "  man abra-app-deploy"
 msgstr ""
 
-#: cli/app/secret.go:156
+#: cli/app/secret.go:161
 msgid ""
 "  # insert regular secret\n"
 "  abra app secret insert 1312.net my_secret v1 mySuperSecret\n"
 "\n"
 "  # insert secret as file\n"
-"  abra app secret insert 1312.net my_secret v1 secret.txt -f"
+"  abra app secret insert 1312.net my_secret v1 secret.txt -f\n"
+"\n"
+"  # insert secret from stdin\n"
+"  echo \"mmySuperSecret\" | abra app secret insert 1312.net my_secret v1"
 msgstr ""
 
-#: cli/app/list.go:49
+#: cli/app/list.go:50
 msgid ""
 "  # list apps of all servers without live status\n"
 "  abra app ls\n"
@@ -74,7 +77,7 @@ msgid ""
 "  abra app ls -r gitea"
 msgstr ""
 
-#: cli/app/cmd.go:35
+#: cli/app/cmd.go:36
 msgid ""
 "  # pass <cmd> args/flags without \"--\"\n"
 "  abra app cmd 1312.net app my_cmd_arg foo --user bar\n"
@@ -86,7 +89,7 @@ msgid ""
 "  abra app cmd 1312.net my_cmd --local"
 msgstr ""
 
-#: cli/app/restart.go:29
+#: cli/app/restart.go:30
 msgid ""
 "  # restart a single app service\n"
 "  abra app restart 1312.net app\n"
@@ -95,7 +98,7 @@ msgid ""
 "  abra app restart 1312.net -a"
 msgstr ""
 
-#: cli/app/run.go:24
+#: cli/app/run.go:25
 msgid ""
 "  # run <cmd> with args/flags\n"
 "  abra app run 1312.net app -- ls -lha\n"
@@ -107,7 +110,7 @@ msgid ""
 "  abra app run 1312.net app --user nobody -- ls -lha"
 msgstr ""
 
-#: cli/app/deploy.go:36
+#: cli/app/deploy.go:37
 msgid ""
 "  # standard deployment\n"
 "  abra app deploy 1312.net\n"
@@ -122,35 +125,31 @@ msgid ""
 "  abra app deploy 1312.net 886db76d"
 msgstr ""
 
-#: cli/app/env.go:18
+#: cli/app/env.go:19
 msgid "  abra app env 1312.net"
 msgstr ""
 
-#: cli/app/labels.go:27
-msgid "  abra app labels 1312.net"
-msgstr ""
-
-#: cli/app/remove.go:38
+#: cli/app/remove.go:39
 msgid "  abra app remove 1312.net"
 msgstr ""
 
-#: cli/app/secret.go:293
+#: cli/app/secret.go:331
 msgid "  abra app secret rm 1312.net oauth_key"
 msgstr ""
 
-#: cli/app/config.go:19
+#: cli/app/config.go:20
 msgid "  abra config 1312.net"
 msgstr ""
 
-#: cli/server/add.go:40
+#: cli/server/add.go:41
 msgid "  abra server add 1312.net"
 msgstr ""
 
-#: cli/upgrade.go:26
+#: cli/upgrade.go:27
 msgid "  abra upgrade --rc"
 msgstr ""
 
-#: cli/app/rollback.go:42
+#: cli/app/rollback.go:43
 msgid ""
 " # standard rollback\n"
 "  abra app rollback 1312.net\n"
@@ -163,7 +162,7 @@ msgstr ""
 msgid " ago"
 msgstr ""
 
-#: cli/app/remove.go:92
+#: cli/app/remove.go:93
 #, c-format
 msgid "%d config(s) removed successfully"
 msgstr ""
@@ -173,17 +172,17 @@ msgstr ""
 msgid "%d retries failed"
 msgstr ""
 
-#: cli/app/remove.go:139
+#: cli/app/remove.go:140
 #, c-format
 msgid "%d volume(s) removed successfully"
 msgstr ""
 
-#: cli/app/volume.go:182
+#: cli/app/volume.go:184
 #, c-format
 msgid "%d volumes removed successfully"
 msgstr ""
 
-#: cli/updater/updater.go:231
+#: cli/updater/updater.go:233
 #, c-format
 msgid "%s (%s) can be upgraded from version %s to %s"
 msgstr ""
@@ -203,7 +202,7 @@ msgstr ""
 msgid "%s OVERVIEW"
 msgstr ""
 
-#: cli/server/add.go:120 pkg/secret/secret.go:223 pkg/secret/secret.go:243
+#: cli/server/add.go:121 pkg/secret/secret.go:223 pkg/secret/secret.go:243
 #: pkg/server/server.go:21
 #, c-format
 msgid "%s already exists"
@@ -214,12 +213,12 @@ msgstr ""
 msgid "%s already exists?"
 msgstr ""
 
-#: cli/app/new.go:185
+#: cli/app/new.go:186
 #, c-format
 msgid "%s created (version: %s)"
 msgstr ""
 
-#: cli/recipe/release.go:146 cli/recipe/sync.go:251 cli/recipe/upgrade.go:330
+#: cli/recipe/release.go:147 cli/recipe/sync.go:252 cli/recipe/upgrade.go:331
 #, c-format
 msgid "%s currently has these unstaged changes 👇"
 msgstr ""
@@ -229,22 +228,22 @@ msgstr ""
 msgid "%s does not exist for %s, use /bin/sh as fallback"
 msgstr ""
 
-#: cli/app/cmd.go:108 cli/internal/deploy.go:151
+#: cli/app/cmd.go:109 cli/internal/deploy.go:151
 #, c-format
 msgid "%s does not exist for %s?"
 msgstr ""
 
-#: cli/app/cmd.go:137
+#: cli/app/cmd.go:138
 #, c-format
 msgid "%s does not exist locally, use /bin/sh as fallback"
 msgstr ""
 
-#: cli/app/secret.go:77
+#: cli/app/secret.go:81
 #, c-format
 msgid "%s doesn't exist in the env config?"
 msgstr ""
 
-#: cli/app/secret.go:389
+#: cli/app/secret.go:427
 #, c-format
 msgid "%s doesn't exist on server?"
 msgstr ""
@@ -264,12 +263,12 @@ msgstr ""
 msgid "%s has been detected as not deployed"
 msgstr ""
 
-#: cli/app/restart.go:132
+#: cli/app/restart.go:133
 #, c-format
 msgid "%s has been scaled to 0"
 msgstr ""
 
-#: cli/app/restart.go:143
+#: cli/app/restart.go:144
 #, c-format
 msgid "%s has been scaled to 1"
 msgstr ""
@@ -286,12 +285,12 @@ msgstr ""
 msgid "%s has no main 'app' service?"
 msgstr ""
 
-#: cli/recipe/version.go:53
+#: cli/recipe/version.go:54
 #, c-format
 msgid "%s has no published versions?"
 msgstr ""
 
-#: cli/app/new.go:270
+#: cli/app/new.go:271
 #, c-format
 msgid "%s has no secrets to generate, skipping..."
 msgstr ""
@@ -306,12 +305,12 @@ msgstr ""
 msgid "%s inserted into pass store"
 msgstr ""
 
-#: cli/app/deploy.go:96
+#: cli/app/deploy.go:97
 #, c-format
 msgid "%s is already deployed"
 msgstr ""
 
-#: cli/recipe/fetch.go:55
+#: cli/recipe/fetch.go:56
 #, c-format
 msgid "%s is already fetched"
 msgstr ""
@@ -331,39 +330,39 @@ msgstr ""
 msgid "%s is missing the TYPE env var?"
 msgstr ""
 
-#: cli/app/rollback.go:278 cli/app/rollback.go:282
+#: cli/app/rollback.go:279 cli/app/rollback.go:283
 #, c-format
 msgid "%s is not a downgrade for %s?"
 msgstr ""
 
-#: cli/app/upgrade.go:400 cli/app/upgrade.go:404
+#: cli/app/upgrade.go:401 cli/app/upgrade.go:405
 #, c-format
 msgid "%s is not an upgrade for %s?"
 msgstr ""
 
-#: cli/app/logs.go:58 cli/app/ps.go:56 cli/app/restart.go:93
-#: cli/app/services.go:49 cli/app/undeploy.go:59 cli/app/upgrade.go:421
-#: cli/updater/updater.go:247
+#: cli/app/logs.go:59 cli/app/ps.go:57 cli/app/restart.go:94
+#: cli/app/services.go:50 cli/app/undeploy.go:60 cli/app/upgrade.go:422
+#: cli/updater/updater.go:249
 #, c-format
 msgid "%s is not deployed?"
 msgstr ""
 
-#: cli/server/remove.go:43
+#: cli/server/remove.go:44
 #, c-format
 msgid "%s is now lost in time, like tears in rain"
 msgstr ""
 
-#: cli/app/remove.go:73 cli/app/volume.go:120
+#: cli/app/remove.go:74 cli/app/volume.go:122
 #, c-format
 msgid "%s is still deployed. Run \"abra app undeploy %s\""
 msgstr ""
 
-#: cli/app/upgrade.go:208 cli/app/deploy.go:166
+#: cli/app/deploy.go:167 cli/app/upgrade.go:209
 #, c-format
 msgid "%s missing from %s.env"
 msgstr ""
 
-#: cli/recipe/upgrade.go:145
+#: cli/recipe/upgrade.go:146
 #, c-format
 msgid "%s not considered semver-like"
 msgstr ""
@@ -373,7 +372,7 @@ msgstr ""
 msgid "%s not enabled in recipe config, skipping"
 msgstr ""
 
-#: cli/recipe/new.go:50
+#: cli/recipe/new.go:51
 #, c-format
 msgid "%s recipe directory already exists?"
 msgstr ""
@@ -388,7 +387,7 @@ msgstr ""
 msgid "%s removed from pass store"
 msgstr ""
 
-#: cli/app/new.go:134
+#: cli/app/new.go:135
 #, c-format
 msgid "%s sanitised as %s for new app"
 msgstr ""
@@ -398,22 +397,22 @@ msgstr ""
 msgid "%s service is missing image tag?"
 msgstr ""
 
-#: cli/app/restart.go:144
+#: cli/app/restart.go:145
 #, c-format
 msgid "%s service successfully restarted"
 msgstr ""
 
-#: cli/server/add.go:111
+#: cli/server/add.go:112
 #, c-format
 msgid "%s successfully added"
 msgstr ""
 
-#: cli/app/secret.go:256
+#: cli/app/secret.go:244
 #, c-format
 msgid "%s successfully stored on server"
 msgstr ""
 
-#: cli/recipe/new.go:53
+#: cli/recipe/new.go:54
 #, c-format
 msgid "%s/example.git"
 msgstr ""
@@ -488,23 +487,23 @@ msgstr ""
 msgid "%s: waiting %d seconds before next retry"
 msgstr ""
 
-#: cli/app/upgrade.go:395
+#: cli/app/upgrade.go:396
 #, c-format
 msgid "'%s' is not a known version"
 msgstr ""
 
-#: cli/app/rollback.go:273 cli/app/upgrade.go:390
+#: cli/app/rollback.go:274 cli/app/upgrade.go:391
 #, c-format
 msgid "'%s' is not a known version for %s"
 msgstr ""
 
-#: cli/app/volume.go:162
+#: cli/app/volume.go:164
 msgid ""
 "'x' indicates selected, enter / return to confirm, ctrl-c to exit, vim mode "
 "is enabled"
 msgstr ""
 
-#: cli/app/cmd.go:119
+#: cli/app/cmd.go:120
 #, c-format
 msgid "--local detected, running %s on local work station"
 msgstr ""
@@ -513,11 +512,11 @@ msgstr ""
 msgid ".env.sample provided"
 msgstr ""
 
-#: cli/recipe/new.go:37
+#: cli/recipe/new.go:38
 msgid "A community managed recipe template is used."
 msgstr ""
 
-#: cli/recipe/recipe.go:13
+#: cli/recipe/recipe.go:14
 msgid ""
 "A recipe is a blueprint for an app.\n"
 "\n"
@@ -533,20 +532,20 @@ msgid ""
 "manner."
 msgstr ""
 
-#: cli/app/remove.go:50
+#: cli/app/remove.go:51
 #, c-format
 msgid "ALERTA ALERTA: deleting %s data and config (local/remote)"
 msgstr ""
 
-#: cli/app/list.go:223
+#: cli/app/list.go:224
 msgid "AUTOUPDATE"
 msgstr ""
 
-#: cli/server/add.go:23
+#: cli/server/add.go:24
 msgid "Add a new server"
 msgstr ""
 
-#: cli/server/add.go:24
+#: cli/server/add.go:25
 msgid ""
 "Add a new server to your configuration so that it can be managed by Abra.\n"
 "\n"
@@ -569,21 +568,21 @@ msgid ""
 "developer machine. The domain is then set to \"default\"."
 msgstr ""
 
-#: cli/app/labels.go:26
+#: cli/app/labels.go:27
 msgid "Both local recipe and live deployment labels are shown."
 msgstr ""
 
-#: cli/app/backup.go:288 cli/app/backup.go:304 cli/app/check.go:88
-#: cli/app/cmd.go:273 cli/app/cp.go:379 cli/app/labels.go:136
-#: cli/app/new.go:366 cli/app/ps.go:207 cli/app/restart.go:155
-#: cli/app/restore.go:132 cli/app/secret.go:504 cli/app/secret.go:544
-#: cli/app/secret.go:568 cli/app/secret.go:576 cli/app/deploy.go:325
-#: cli/catalogue/catalogue.go:303 cli/recipe/lint.go:129
-#: cli/updater/updater.go:538
+#: cli/app/backup.go:293 cli/app/backup.go:309 cli/app/check.go:89
+#: cli/app/cmd.go:275 cli/app/cp.go:380 cli/app/deploy.go:326
+#: cli/app/labels.go:137 cli/app/new.go:367 cli/app/ps.go:208
+#: cli/app/restart.go:156 cli/app/restore.go:133 cli/app/secret.go:548
+#: cli/app/secret.go:588 cli/app/secret.go:612 cli/app/secret.go:620
+#: cli/catalogue/catalogue.go:306 cli/recipe/lint.go:130
+#: cli/updater/updater.go:541
 msgid "C"
 msgstr ""
 
-#: cli/app/list.go:220 cli/app/ps.go:183
+#: cli/app/list.go:221 cli/app/ps.go:184
 msgid "CHAOS"
 msgstr ""
 
@@ -610,7 +609,7 @@ msgstr ""
 msgid "CONFIG"
 msgstr ""
 
-#: cli/app/secret.go:422
+#: cli/app/secret.go:461
 msgid "CREATED ON SERVER"
 msgstr ""
 
@@ -618,19 +617,19 @@ msgstr ""
 msgid "CURRENT DEPLOYMENT"
 msgstr ""
 
-#: cli/app/ps.go:30
+#: cli/app/ps.go:31
 msgid "Check app deployment status"
 msgstr ""
 
-#: cli/updater/updater.go:37
+#: cli/updater/updater.go:38
 msgid "Check for available upgrades"
 msgstr ""
 
-#: cli/recipe/fetch.go:20
+#: cli/recipe/fetch.go:21
 msgid "Clone recipe(s) locally"
 msgstr ""
 
-#: cli/app/check.go:20
+#: cli/app/check.go:21
 msgid ""
 "Compare env vars in both the app \".env\" and recipe \".env.sample\" file.\n"
 "\n"
@@ -648,23 +647,23 @@ msgid ""
 "${FOO:<default>} syntax). \"check\" does not confirm or deny this for you."
 msgstr ""
 
-#: cli/app/cp.go:31
+#: cli/app/cp.go:32
 msgid "Copy files to/from a deployed app service"
 msgstr ""
 
-#: cli/app/new.go:48
+#: cli/app/new.go:49
 msgid "Create a new app"
 msgstr ""
 
-#: cli/recipe/new.go:36
+#: cli/recipe/new.go:37
 msgid "Create a new recipe"
 msgstr ""
 
-#: cli/app/backup.go:136
+#: cli/app/backup.go:139
 msgid "Create a new snapshot"
 msgstr ""
 
-#: cli/recipe/release.go:30
+#: cli/recipe/release.go:31
 msgid ""
 "Create a new version of a recipe.\n"
 "\n"
@@ -734,8 +733,8 @@ msgid ""
 "on your $PATH."
 msgstr ""
 
-#: cli/app/new.go:342 cli/app/rollback.go:330 cli/app/upgrade.go:441
-#: cli/app/deploy.go:341
+#: cli/app/deploy.go:342 cli/app/new.go:343 cli/app/rollback.go:331
+#: cli/app/upgrade.go:442
 msgid "D"
 msgstr ""
 
@@ -743,11 +742,11 @@ msgstr ""
 msgid "DEPLOY"
 msgstr ""
 
-#: cli/app/labels.go:53
+#: cli/app/labels.go:54
 msgid "DEPLOYED LABELS"
 msgstr ""
 
-#: cli/app/list.go:216 cli/internal/deploy.go:75
+#: cli/app/list.go:217 cli/internal/deploy.go:75
 msgid "DOMAIN"
 msgstr ""
 
@@ -755,11 +754,11 @@ msgstr ""
 msgid "DOWNGRADE"
 msgstr ""
 
-#: cli/app/deploy.go:30
+#: cli/app/deploy.go:31
 msgid "Deploy an app"
 msgstr ""
 
-#: cli/app/deploy.go:31
+#: cli/app/deploy.go:32
 msgid ""
 "Deploy an app.\n"
 "\n"
@@ -770,15 +769,15 @@ msgid ""
 "operations."
 msgstr ""
 
-#: cli/app/services.go:23
+#: cli/app/services.go:24
 msgid "Display all services of an app"
 msgstr ""
 
-#: cli/app/backup.go:67
+#: cli/app/backup.go:69
 msgid "Download a snapshot"
 msgstr ""
 
-#: cli/app/backup.go:68
+#: cli/app/backup.go:70
 msgid ""
 "Downloads a backup.tar.gz to the current working directory.\n"
 "\n"
@@ -787,7 +786,7 @@ msgid ""
 "\"backupbot.backup.path\" labels."
 msgstr ""
 
-#: cli/app/env.go:41
+#: cli/app/env.go:42
 msgid "ENV OVERVIEW"
 msgstr ""
 
@@ -795,11 +794,11 @@ msgstr ""
 msgid "ENV VERSION"
 msgstr ""
 
-#: cli/app/config.go:18
+#: cli/app/config.go:19
 msgid "Edit app config"
 msgstr ""
 
-#: cli/app/check.go:19
+#: cli/app/check.go:20
 msgid "Ensure an app is well configured"
 msgstr ""
 
@@ -812,11 +811,11 @@ msgstr ""
 msgid "Error monitoring TTY size:"
 msgstr ""
 
-#: cli/app/secret.go:422
+#: cli/app/secret.go:461
 msgid "GENERATED NAME"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:46
+#: cli/catalogue/catalogue.go:48
 msgid ""
 "Generate a new copy of the recipe catalogue.\n"
 "\n"
@@ -848,22 +847,22 @@ msgid ""
 "    ssh-add ~/.ssh/<my-ssh-private-key-for-git-coopcloud-tech>"
 msgstr ""
 
-#: cli/app/list.go:46
+#: cli/app/list.go:47
 msgid ""
 "Generate a report of all managed apps.\n"
 "\n"
 "Use \"--status/-S\" flag to query all servers for the live deployment status."
 msgstr ""
 
-#: cli/app/new.go:276
+#: cli/app/new.go:277
 msgid "Generate app secrets?"
 msgstr ""
 
-#: cli/complete.go:12
+#: cli/complete.go:13
 msgid "Generate autocompletion script"
 msgstr ""
 
-#: cli/recipe/sync.go:25
+#: cli/recipe/sync.go:26
 msgid ""
 "Generate labels for the main recipe service.\n"
 "\n"
@@ -876,120 +875,120 @@ msgid ""
 "local file system."
 msgstr ""
 
-#: cli/run.go:83
+#: cli/run.go:85
 msgid "Generate manpage"
 msgstr ""
 
-#: cli/app/secret.go:27
+#: cli/app/secret.go:31
 msgid "Generate secrets"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:45
+#: cli/catalogue/catalogue.go:47
 msgid "Generate the recipe catalogue"
 msgstr ""
 
-#: cli/recipe/new.go:118
+#: cli/recipe/new.go:119
 msgid "Git (user) name to do commits with"
 msgstr ""
 
-#: cli/recipe/new.go:126
+#: cli/recipe/new.go:127
 msgid "Git email name to do commits with"
 msgstr ""
 
-#: cli/app/restore.go:124
+#: cli/app/restore.go:125
 msgid "H"
 msgstr ""
 
-#: cli/server/list.go:34
+#: cli/server/list.go:35
 msgid "HOST"
 msgstr ""
 
-#: cli/app/ps.go:181 cli/recipe/version.go:62
+#: cli/app/ps.go:182 cli/recipe/version.go:63
 msgid "IMAGE"
 msgstr ""
 
-#: cli/app/secret.go:147
+#: cli/app/secret.go:152
 msgid "Insert secret"
 msgstr ""
 
-#: cli/app/labels.go:102
+#: cli/app/labels.go:103
 msgid "LABELS OVERVIEW"
 msgstr ""
 
-#: cli/recipe/lint.go:15
+#: cli/recipe/lint.go:16
 msgid "Lint a recipe"
 msgstr ""
 
-#: cli/app/cmd.go:198
+#: cli/app/cmd.go:200
 msgid "List all available commands"
 msgstr ""
 
-#: cli/app/list.go:45
+#: cli/app/list.go:46
 msgid "List all managed apps"
 msgstr ""
 
-#: cli/app/secret.go:401
+#: cli/app/secret.go:440
 msgid "List all secrets"
 msgstr ""
 
-#: cli/app/backup.go:180
+#: cli/app/backup.go:184
 msgid "List all snapshots"
 msgstr ""
 
-#: cli/server/list.go:20
+#: cli/server/list.go:21
 msgid "List managed servers"
 msgstr ""
 
-#: cli/recipe/version.go:19
+#: cli/recipe/version.go:20
 msgid "List recipe versions"
 msgstr ""
 
-#: cli/recipe/list.go:19
+#: cli/recipe/list.go:20
 msgid "List recipes"
 msgstr ""
 
-#: cli/app/backup.go:17
+#: cli/app/backup.go:18
 msgid "List the contents of a snapshot"
 msgstr ""
 
-#: cli/app/volume.go:21
+#: cli/app/volume.go:22
 msgid "List volumes associated with an app"
 msgstr ""
 
-#: cli/app/backup.go:215
+#: cli/app/backup.go:220
 msgid "Manage app backups"
 msgstr ""
 
-#: cli/app/secret.go:472
+#: cli/app/secret.go:516
 msgid "Manage app secrets"
 msgstr ""
 
-#: cli/app/volume.go:192
+#: cli/app/volume.go:195
 msgid "Manage app volumes"
 msgstr ""
 
-#: cli/app/app.go:11
+#: cli/app/app.go:12
 msgid "Manage apps"
 msgstr ""
 
-#: cli/recipe/recipe.go:12
+#: cli/recipe/recipe.go:13
 msgid "Manage recipes"
 msgstr ""
 
-#: cli/server/server.go:12
+#: cli/server/server.go:13
 msgid "Manage servers"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:266
+#: cli/catalogue/catalogue.go:269
 msgid "Manage the recipe catalogue"
 msgstr ""
 
-#: cli/recipe/new.go:116
+#: cli/recipe/new.go:117
 msgid "N"
 msgstr ""
 
-#: cli/app/volume.go:47 cli/app/secret.go:108 cli/app/secret.go:422
-#: cli/recipe/version.go:103 cli/server/list.go:34
+#: cli/app/secret.go:112 cli/app/secret.go:461 cli/app/volume.go:48
+#: cli/recipe/version.go:104 cli/server/list.go:35
 msgid "NAME"
 msgstr ""
 
@@ -1001,15 +1000,15 @@ msgstr ""
 msgid "NEW DEPLOYMENT"
 msgstr ""
 
-#: cli/app/secret.go:138
+#: cli/app/secret.go:142
 msgid "NOT"
 msgstr ""
 
-#: cli/app/secret.go:139
+#: cli/app/secret.go:143
 msgid "NOW"
 msgstr ""
 
-#: cli/updater/updater.go:38
+#: cli/updater/updater.go:39
 msgid ""
 "Notify on new versions for deployed apps.\n"
 "\n"
@@ -1018,19 +1017,19 @@ msgid ""
 "Use \"--major/-m\" to include new major versions."
 msgstr ""
 
-#: cli/app/volume.go:47
+#: cli/app/volume.go:48
 msgid "ON SERVER"
 msgstr ""
 
-#: cli/recipe/sync.go:128
+#: cli/recipe/sync.go:129
 msgid "PROPOSED CHANGES"
 msgstr ""
 
-#: cli/server/prune.go:17
+#: cli/server/prune.go:18
 msgid "Prune resources on a server"
 msgstr ""
 
-#: cli/server/prune.go:18
+#: cli/server/prune.go:19
 msgid ""
 "Prunes unused containers, networks, and dangling images.\n"
 "\n"
@@ -1043,23 +1042,23 @@ msgstr ""
 msgid "README.md metadata filled in"
 msgstr ""
 
-#: cli/app/list.go:216 cli/internal/deploy.go:76
+#: cli/app/list.go:217 cli/internal/deploy.go:76
 msgid "RECIPE"
 msgstr ""
 
-#: cli/app/labels.go:74
+#: cli/app/labels.go:75
 msgid "RECIPE LABELS"
 msgstr ""
 
-#: cli/recipe/release.go:29
+#: cli/recipe/release.go:30
 msgid "Release a new recipe version"
 msgstr ""
 
-#: cli/server/remove.go:19
+#: cli/server/remove.go:20
 msgid "Remove a managed server"
 msgstr ""
 
-#: cli/server/remove.go:20
+#: cli/server/remove.go:21
 msgid ""
 "Remove a managed server.\n"
 "\n"
@@ -1069,19 +1068,19 @@ msgid ""
 "like tears in rain."
 msgstr ""
 
-#: cli/app/secret.go:288
+#: cli/app/secret.go:326
 msgid "Remove a secret"
 msgstr ""
 
-#: cli/app/remove.go:21
+#: cli/app/remove.go:22
 msgid "Remove all app data, locally and remotely"
 msgstr ""
 
-#: cli/recipe/reset.go:15
+#: cli/recipe/reset.go:16
 msgid "Remove all unstaged changes from recipe config"
 msgstr ""
 
-#: cli/app/remove.go:22
+#: cli/app/remove.go:23
 msgid ""
 "Remove everything related to an app which is already undeployed.\n"
 "\n"
@@ -1104,11 +1103,11 @@ msgid ""
 "flag."
 msgstr ""
 
-#: cli/app/volume.go:77
+#: cli/app/volume.go:79
 msgid "Remove volume(s) associated with an app"
 msgstr ""
 
-#: cli/app/volume.go:78
+#: cli/app/volume.go:80
 msgid ""
 "Remove volumes associated with an app.\n"
 "\n"
@@ -1125,23 +1124,23 @@ msgid ""
 "Passing \"--force/-f\" will select all volumes for removal. Be careful."
 msgstr ""
 
-#: cli/app/restart.go:23
+#: cli/app/restart.go:24
 msgid "Restart an app"
 msgstr ""
 
-#: cli/app/restore.go:18
+#: cli/app/restore.go:19
 msgid "Restore a snapshot"
 msgstr ""
 
-#: cli/app/rollback.go:27
+#: cli/app/rollback.go:28
 msgid "Roll an app back to a previous version"
 msgstr ""
 
-#: cli/app/run.go:23
+#: cli/app/run.go:24
 msgid "Run a command inside a service container"
 msgstr ""
 
-#: cli/app/cmd.go:25
+#: cli/app/cmd.go:26
 msgid ""
 "Run an app specific command.\n"
 "\n"
@@ -1160,33 +1159,33 @@ msgid ""
 "does not)."
 msgstr ""
 
-#: cli/app/cmd.go:24
+#: cli/app/cmd.go:25
 msgid "Run app commands"
 msgstr ""
 
-#: cli/app/backup.go:272 cli/app/list.go:289 cli/app/logs.go:102
-#: cli/app/new.go:358
+#: cli/app/backup.go:277 cli/app/list.go:290 cli/app/logs.go:103
+#: cli/app/new.go:359
 msgid "S"
 msgstr ""
 
-#: cli/app/new.go:193
+#: cli/app/new.go:194
 msgid "SECRETS OVERVIEW"
 msgstr ""
 
-#: cli/app/list.go:216 cli/internal/deploy.go:77
+#: cli/app/list.go:217 cli/internal/deploy.go:77
 msgid "SERVER"
 msgstr ""
 
-#: cli/app/ps.go:179 cli/recipe/sync.go:128 cli/recipe/version.go:62
-#: cli/recipe/version.go:103
+#: cli/app/ps.go:180 cli/recipe/sync.go:129 cli/recipe/version.go:63
+#: cli/recipe/version.go:104
 msgid "SERVICE"
 msgstr ""
 
-#: cli/app/services.go:67
+#: cli/app/services.go:68
 msgid "SERVICE (LONG)"
 msgstr ""
 
-#: cli/app/services.go:67
+#: cli/app/services.go:68
 msgid "SERVICE (SHORT)"
 msgstr ""
 
@@ -1195,15 +1194,15 @@ msgstr ""
 msgid "SSH host key verification failed for %s"
 msgstr ""
 
-#: cli/recipe/list.go:44
+#: cli/recipe/list.go:45
 msgid "SSO"
 msgstr ""
 
-#: cli/app/list.go:219 cli/app/ps.go:180
+#: cli/app/list.go:220 cli/app/ps.go:181
 msgid "STATUS"
 msgstr ""
 
-#: cli/app/new.go:301
+#: cli/app/new.go:302
 msgid "Select app server:"
 msgstr ""
 
@@ -1211,19 +1210,19 @@ msgstr ""
 msgid "Select recipe"
 msgstr ""
 
-#: cli/app/env.go:17
+#: cli/app/env.go:18
 msgid "Show app .env values"
 msgstr ""
 
-#: cli/app/labels.go:25
+#: cli/app/labels.go:26
 msgid "Show deployment labels"
 msgstr ""
 
-#: cli/recipe/diff.go:15
+#: cli/recipe/diff.go:16
 msgid "Show unstaged changes in recipe config"
 msgstr ""
 
-#: cli/app/restore.go:19
+#: cli/app/restore.go:20
 msgid ""
 "Snapshots are restored while apps are deployed.\n"
 "\n"
@@ -1238,39 +1237,39 @@ msgstr ""
 msgid "Specify a server name"
 msgstr ""
 
-#: cli/app/new.go:252
+#: cli/app/new.go:253
 msgid "Specify app domain"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:27
+#: cli/catalogue/catalogue.go:28
 msgid "Sync recipe catalogue for latest changes"
 msgstr ""
 
-#: cli/recipe/sync.go:24
+#: cli/recipe/sync.go:25
 msgid "Sync recipe version label"
 msgstr ""
 
-#: cli/app/cmd.go:265
+#: cli/app/cmd.go:267
 msgid "T"
 msgstr ""
 
-#: cli/recipe/version.go:62 cli/recipe/version.go:103
+#: cli/recipe/version.go:63 cli/recipe/version.go:104
 msgid "TAG"
 msgstr ""
 
-#: cli/app/logs.go:20
+#: cli/app/logs.go:21
 msgid "Tail app logs"
 msgstr ""
 
-#: cli/updater/updater.go:473
+#: cli/updater/updater.go:476
 msgid "The Co-op Cloud auto-updater 🤖 🚀"
 msgstr ""
 
-#: cli/run.go:25
+#: cli/run.go:26
 msgid "The Co-op Cloud command-line utility belt 🎩🐇"
 msgstr ""
 
-#: cli/app/secret.go:148
+#: cli/app/secret.go:153
 msgid ""
 "This command inserts a secret into an app environment.\n"
 "\n"
@@ -1283,7 +1282,7 @@ msgid ""
 "(see \"abra app new --secrets/-S\" for more)."
 msgstr ""
 
-#: cli/app/secret.go:289
+#: cli/app/secret.go:327
 msgid ""
 "This command removes a secret from an app environment.\n"
 "\n"
@@ -1291,11 +1290,11 @@ msgid ""
 "match those configured in the recipe beforehand."
 msgstr ""
 
-#: cli/recipe/diff.go:16
+#: cli/recipe/diff.go:17
 msgid "This command requires /usr/bin/git."
 msgstr ""
 
-#: cli/app/restart.go:24
+#: cli/app/restart.go:25
 msgid ""
 "This command restarts services within a deployed app.\n"
 "\n"
@@ -1304,7 +1303,7 @@ msgid ""
 "Pass \"--all-services/-a\" to restart all services."
 msgstr ""
 
-#: cli/app/rollback.go:28
+#: cli/app/rollback.go:29
 msgid ""
 "This command rolls an app back to a previous version.\n"
 "\n"
@@ -1327,7 +1326,7 @@ msgid ""
 "beforehand. See \"abra app backup\" for more."
 msgstr ""
 
-#: cli/app/undeploy.go:25
+#: cli/app/undeploy.go:26
 msgid ""
 "This does not destroy any application data.\n"
 "\n"
@@ -1338,7 +1337,7 @@ msgid ""
 "Passing \"--prune/-p\" does not remove those volumes."
 msgstr ""
 
-#: cli/complete.go:13
+#: cli/complete.go:14
 msgid ""
 "To load completions:\n"
 "\n"
@@ -1386,15 +1385,15 @@ msgstr ""
 msgid "UNDEPLOY"
 msgstr ""
 
-#: cli/app/list.go:222 cli/internal/deploy.go:140
+#: cli/app/list.go:223 cli/internal/deploy.go:140
 msgid "UPGRADE"
 msgstr ""
 
-#: cli/app/undeploy.go:24
+#: cli/app/undeploy.go:25
 msgid "Undeploy an app"
 msgstr ""
 
-#: cli/recipe/upgrade.go:44
+#: cli/recipe/upgrade.go:45
 msgid ""
 "Upgrade a given <recipe> configuration.\n"
 "\n"
@@ -1412,11 +1411,11 @@ msgid ""
 "You may invoke this command in \"wizard\" mode and be prompted for input."
 msgstr ""
 
-#: cli/upgrade.go:18
+#: cli/upgrade.go:19
 msgid "Upgrade abra"
 msgstr ""
 
-#: cli/upgrade.go:19
+#: cli/upgrade.go:20
 msgid ""
 "Upgrade abra in-place with the latest stable or release candidate.\n"
 "\n"
@@ -1429,11 +1428,11 @@ msgid ""
 "for the testing efforts 💗"
 msgstr ""
 
-#: cli/app/upgrade.go:31
+#: cli/app/upgrade.go:32
 msgid "Upgrade an app"
 msgstr ""
 
-#: cli/updater/updater.go:77
+#: cli/updater/updater.go:79
 msgid ""
 "Upgrade an app by specifying stack name and recipe. \n"
 "\n"
@@ -1453,7 +1452,7 @@ msgid ""
 "with care."
 msgstr ""
 
-#: cli/app/upgrade.go:32
+#: cli/app/upgrade.go:33
 msgid ""
 "Upgrade an app.\n"
 "\n"
@@ -1476,34 +1475,34 @@ msgid ""
 "beforehand. See \"abra app backup\" for more."
 msgstr ""
 
-#: cli/updater/updater.go:76
+#: cli/updater/updater.go:78
 msgid "Upgrade apps"
 msgstr ""
 
-#: cli/recipe/upgrade.go:43
+#: cli/recipe/upgrade.go:44
 msgid "Upgrade recipe image tags"
 msgstr ""
 
-#: cli/recipe/release.go:318
+#: cli/recipe/release.go:319
 msgid "Use release note in release/next?"
 msgstr ""
 
-#: cli/recipe/fetch.go:21
+#: cli/recipe/fetch.go:22
 msgid ""
 "Using \"--force/-f\" Git syncs an existing recipe. It does not erase "
 "unstaged changes."
 msgstr ""
 
-#: cli/app/secret.go:108
+#: cli/app/secret.go:112
 msgid "VALUE"
 msgstr ""
 
-#: cli/app/list.go:221 cli/app/ps.go:182 cli/app/secret.go:422
-#: cli/recipe/version.go:62 cli/recipe/version.go:103
+#: cli/app/list.go:222 cli/app/ps.go:183 cli/app/secret.go:461
+#: cli/recipe/version.go:63 cli/recipe/version.go:104
 msgid "VERSION"
 msgstr ""
 
-#: cli/recipe/reset.go:16
+#: cli/recipe/reset.go:17
 msgid "WARNING: this will delete your changes. Be Careful."
 msgstr ""
 
@@ -1515,7 +1514,7 @@ msgstr ""
 msgid "[hijack] end of stdout"
 msgstr ""
 
-#: cli/recipe/sync.go:78
+#: cli/recipe/sync.go:79
 #, c-format
 msgid ""
 "\n"
@@ -1592,22 +1591,27 @@ msgstr ""
 msgid "^%s"
 msgstr ""
 
-#: cli/app/app.go:10 cli/app/backup.go:240 cli/app/restart.go:162
-#: cli/app/secret.go:512 cli/app/secret.go:552 cli/recipe/fetch.go:115
-#: cli/recipe/upgrade.go:378 cli/server/add.go:22 cli/server/prune.go:91
-#: cli/updater/updater.go:554
+#: cli/app/app.go:11 cli/app/backup.go:245 cli/app/restart.go:163
+#: cli/app/secret.go:556 cli/app/secret.go:596 cli/recipe/fetch.go:116
+#: cli/recipe/upgrade.go:379 cli/server/add.go:23 cli/server/prune.go:92
+#: cli/updater/updater.go:557
 msgid "a"
 msgstr ""
 
-#: cli/app/remove.go:59
+#: cli/app/remove.go:60
 msgid "aborting as requested"
 msgstr ""
 
-#: cli/run.go:24
+#. translators: `abra` binary name
+#: cli/run.go:25
 msgid "abra [cmd] [args] [flags]"
 msgstr ""
 
-#: cli/run.go:69
+#: cli/app/labels.go:28
+msgid "abra app labels 1312.net"
+msgstr ""
+
+#: cli/run.go:70
 #, c-format
 msgid "abra version: %s, commit: %s, lang: %s"
 msgstr ""
@@ -1617,7 +1621,7 @@ msgstr ""
 msgid "abra.sh: %s}"
 msgstr ""
 
-#: cli/app/cmd.go:51
+#: cli/app/cmd.go:52
 msgid "accepts at most 2 args with --local/-l"
 msgstr ""
 
@@ -1626,11 +1630,12 @@ msgstr ""
 msgid "add '- \"%s\"' manually to the 'app' service in %s"
 msgstr ""
 
-#: cli/server/add.go:21
+#. translators: `server add` command
+#: cli/server/add.go:22
 msgid "add [[server] | --local] [flags]"
 msgstr ""
 
-#: cli/recipe/release.go:352
+#: cli/recipe/release.go:353
 msgid "add release note? (leave empty to skip)"
 msgstr ""
 
@@ -1639,8 +1644,8 @@ msgstr ""
 msgid "adding env vars to %s service config"
 msgstr ""
 
-#: cli/app/backup.go:239 cli/app/secret.go:511 cli/app/secret.go:551
-#: cli/recipe/fetch.go:114 cli/server/prune.go:90 cli/updater/updater.go:553
+#: cli/app/backup.go:244 cli/app/secret.go:555 cli/app/secret.go:595
+#: cli/recipe/fetch.go:115 cli/server/prune.go:91 cli/updater/updater.go:556
 msgid "all"
 msgstr ""
 
@@ -1652,11 +1657,11 @@ msgstr ""
 msgid "all services have images"
 msgstr ""
 
-#: cli/app/restart.go:161
+#: cli/app/restart.go:162
 msgid "all-services"
 msgstr ""
 
-#: cli/recipe/upgrade.go:377
+#: cli/recipe/upgrade.go:378
 msgid "all-tags"
 msgstr ""
 
@@ -1668,11 +1673,12 @@ msgstr ""
 msgid "ambiguous service list received, prompting for input"
 msgstr ""
 
-#: cli/run.go:28
+#: cli/run.go:29
 msgid "app"
 msgstr ""
 
-#: cli/app/app.go:9
+#. translators: `app` command group
+#: cli/app/app.go:10
 msgid "app [cmd] [args] [flags]"
 msgstr ""
 
@@ -1681,11 +1687,11 @@ msgstr ""
 msgid "app domain %s (%s) does not appear to resolve to app server %s (%s)?"
 msgstr ""
 
-#: cli/recipe/release.go:220
+#: cli/recipe/release.go:221
 msgid "app service is missing image tag?"
 msgstr ""
 
-#: cli/app/remove.go:53
+#: cli/app/remove.go:54
 msgid "are you sure?"
 msgstr ""
 
@@ -1694,7 +1700,7 @@ msgstr ""
 msgid "attempting to checkout '%s' as chaos commit"
 msgstr ""
 
-#: cli/server/add.go:76 cli/server/add.go:103
+#: cli/server/add.go:77 cli/server/add.go:104
 #, c-format
 msgid "attempting to create client for %s"
 msgstr ""
@@ -1704,37 +1710,38 @@ msgstr ""
 msgid "attempting to generate and store %s on %s"
 msgstr ""
 
-#: cli/upgrade.go:37 pkg/secret/pass.go:23 pkg/secret/pass.go:45
+#: cli/upgrade.go:38 pkg/secret/pass.go:23 pkg/secret/pass.go:45
 #, c-format
 msgid "attempting to run %s"
 msgstr ""
 
-#: cli/app/upgrade.go:267 cli/app/deploy.go:229
+#: cli/app/deploy.go:230 cli/app/upgrade.go:268
 #, c-format
 msgid "attempting to run post deploy commands, saw: %s"
 msgstr ""
 
-#: cli/app/restart.go:108
+#: cli/app/restart.go:109
 #, c-format
 msgid "attempting to scale %s to 0"
 msgstr ""
 
-#: cli/app/restart.go:133
+#: cli/app/restart.go:134
 #, c-format
 msgid "attempting to scale %s to 1"
 msgstr ""
 
-#: cli/run.go:29
+#: cli/run.go:30
 msgid "autocomplete"
 msgstr ""
 
-#: cli/complete.go:11
+#. translators: `autocomplete` command
+#: cli/complete.go:12
 msgid "autocomplete [bash|zsh|fish|powershell]"
 msgstr ""
 
-#: cli/app/logs.go:32 cli/app/rollback.go:58 cli/app/upgrade.go:58
-#: cli/app/secret.go:40 cli/app/secret.go:173 cli/app/secret.go:307
-#: cli/app/deploy.go:59 pkg/autocomplete/autocomplete.go:18
+#: cli/app/deploy.go:60 cli/app/logs.go:33 cli/app/rollback.go:59
+#: cli/app/secret.go:44 cli/app/secret.go:181 cli/app/secret.go:345
+#: cli/app/upgrade.go:59 pkg/autocomplete/autocomplete.go:18
 #: pkg/autocomplete/autocomplete.go:33 pkg/autocomplete/autocomplete.go:44
 #: pkg/autocomplete/autocomplete.go:50 pkg/autocomplete/autocomplete.go:70
 #: pkg/autocomplete/autocomplete.go:88 pkg/autocomplete/autocomplete.go:104
@@ -1743,28 +1750,29 @@ msgstr ""
 msgid "autocomplete failed: %s"
 msgstr ""
 
-#: cli/app/new.go:360
+#: cli/app/new.go:361
 msgid "automatically generate secrets"
 msgstr ""
 
-#: cli/recipe/fetch.go:125
+#: cli/recipe/fetch.go:126
 msgid "automatically set ssh remote"
 msgstr ""
 
-#: cli/updater/updater.go:299
+#: cli/updater/updater.go:301
 #, c-format
 msgid "available updates for %s: %s"
 msgstr ""
 
-#: cli/app/backup.go:214
+#: cli/app/backup.go:219
 msgid "b"
 msgstr ""
 
-#: cli/app/backup.go:213
+#. translators: `app backup` command group
+#: cli/app/backup.go:218
 msgid "backup [cmd] [args] [flags]"
 msgstr ""
 
-#: cli/recipe/list.go:41
+#: cli/recipe/list.go:42
 msgid "backups"
 msgstr ""
 
@@ -1781,7 +1789,7 @@ msgstr ""
 msgid "bind options are incompatible with type volume"
 msgstr ""
 
-#: cli/updater/updater.go:176
+#: cli/updater/updater.go:178
 #, c-format
 msgid "boolean label %s could not be found for %s, set default to false."
 msgstr ""
@@ -1791,22 +1799,26 @@ msgstr ""
 msgid "broken symlink in your abra config folders: %s"
 msgstr ""
 
-#: cli/app/backup.go:135 cli/app/cp.go:30 cli/app/rollback.go:338
-#: cli/app/upgrade.go:449 cli/app/deploy.go:349
+#: cli/app/backup.go:138 cli/app/cp.go:31 cli/app/deploy.go:350
+#: cli/app/rollback.go:339 cli/app/upgrade.go:450
 msgid "c"
 msgstr ""
 
+#: cli/app/secret.go:270
+msgid "can not insert from file and read from stdin"
+msgstr ""
+
 #: pkg/recipe/git.go:52
 #, c-format
 msgid "can not redeploy chaos version (%s) without --chaos"
 msgstr ""
 
-#: cli/recipe/upgrade.go:318
+#: cli/recipe/upgrade.go:319
 #, c-format
 msgid "can upgrade service: %s, image: %s, tag: %s ::"
 msgstr ""
 
-#: cli/app/cp.go:272
+#: cli/app/cp.go:273
 msgid "can't copy dir to file"
 msgstr ""
 
@@ -1815,7 +1827,7 @@ msgstr ""
 msgid "can't read local recipes: %s"
 msgstr ""
 
-#: cli/updater/updater.go:197
+#: cli/updater/updater.go:199
 #, c-format
 msgid "can't separate key from value: %s (this variable is probably unset)"
 msgstr ""
@@ -1825,7 +1837,7 @@ msgstr ""
 msgid "cannot ensure %s is up-to-date, no git remotes configured"
 msgstr ""
 
-#: cli/app/config.go:36 pkg/app/app.go:52
+#: cli/app/config.go:37 pkg/app/app.go:52
 #, c-format
 msgid "cannot find app with name %s"
 msgstr ""
@@ -1835,7 +1847,7 @@ msgstr ""
 msgid "cannot get label %s for %s"
 msgstr ""
 
-#: cli/recipe/release.go:97
+#: cli/recipe/release.go:98
 #, c-format
 msgid "cannot parse %s, invalid tag specified?"
 msgstr ""
@@ -1845,43 +1857,44 @@ msgstr ""
 msgid "cannot resolve ipv4 for %s?"
 msgstr ""
 
-#: cli/recipe/release.go:102
+#: cli/recipe/release.go:103
 msgid "cannot specify tag and bump type at the same time"
 msgstr ""
 
-#: cli/app/secret.go:59
+#: cli/app/secret.go:63
 msgid "cannot use '[secret] [version]' and '--all' together"
 msgstr ""
 
-#: cli/app/cmd.go:101
+#: cli/app/cmd.go:102
 msgid "cannot use --local & --user together"
 msgstr ""
 
-#: cli/recipe/fetch.go:48
+#: cli/recipe/fetch.go:49
 msgid "cannot use [recipe] and --all/-a together"
 msgstr ""
 
-#: cli/app/secret.go:334
+#: cli/app/secret.go:372
 msgid "cannot use [secret] and --all/-a together"
 msgstr ""
 
-#: cli/server/add.go:53
+#: cli/server/add.go:54
 msgid "cannot use [server] and --local together"
 msgstr ""
 
-#: cli/app/restart.go:68
+#: cli/app/restart.go:69
 msgid "cannot use [service] and --all-services/-a together"
 msgstr ""
 
-#: cli/app/new.go:69 cli/app/deploy.go:260
+#: cli/app/deploy.go:261 cli/app/new.go:70
 msgid "cannot use [version] and --chaos together"
 msgstr ""
 
-#: cli/run.go:30
+#: cli/run.go:31
 msgid "catalogue"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:265
+#. translators: `catalogue` command group
+#: cli/catalogue/catalogue.go:268
 msgid "catalogue [cmd] [args] [flags]"
 msgstr ""
 
@@ -1889,42 +1902,43 @@ msgstr ""
 msgid "catalogue is missing, retrieving now"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:38
+#: cli/catalogue/catalogue.go:39
 msgid "catalogue successfully synced"
 msgstr ""
 
-#: cli/recipe/list.go:38
+#: cli/recipe/list.go:39
 msgid "category"
 msgstr ""
 
-#: cli/app/config.go:17
+#: cli/app/config.go:18
 msgid "cfg"
 msgstr ""
 
-#: cli/app/backup.go:287 cli/app/backup.go:303 cli/app/check.go:87
-#: cli/app/cmd.go:272 cli/app/cp.go:378 cli/app/labels.go:135
-#: cli/app/new.go:365 cli/app/ps.go:206 cli/app/restart.go:154
-#: cli/app/restore.go:131 cli/app/secret.go:503 cli/app/secret.go:543
-#: cli/app/secret.go:567 cli/app/secret.go:575 cli/app/deploy.go:324
-#: cli/catalogue/catalogue.go:302 cli/recipe/lint.go:128
-#: cli/updater/updater.go:537
+#: cli/app/backup.go:292 cli/app/backup.go:308 cli/app/check.go:88
+#: cli/app/cmd.go:274 cli/app/cp.go:379 cli/app/deploy.go:325
+#: cli/app/labels.go:136 cli/app/new.go:366 cli/app/ps.go:207
+#: cli/app/restart.go:155 cli/app/restore.go:132 cli/app/secret.go:547
+#: cli/app/secret.go:587 cli/app/secret.go:611 cli/app/secret.go:619
+#: cli/catalogue/catalogue.go:305 cli/recipe/lint.go:129
+#: cli/updater/updater.go:540
 msgid "chaos"
 msgstr ""
 
-#: cli/app/check.go:17
+#. translators: `app check` command
+#: cli/app/check.go:18
 msgid "check <domain> [flags]"
 msgstr ""
 
-#: cli/updater/updater.go:548
+#: cli/updater/updater.go:551
 msgid "check for major updates"
 msgstr ""
 
-#: cli/app/undeploy.go:51 cli/app/upgrade.go:413 cli/app/deploy.go:88
+#: cli/app/deploy.go:89 cli/app/undeploy.go:52 cli/app/upgrade.go:414
 #, c-format
 msgid "checking whether %s is already deployed"
 msgstr ""
 
-#: cli/app/check.go:18
+#: cli/app/check.go:19
 msgid "chk"
 msgstr ""
 
@@ -1933,31 +1947,31 @@ msgstr ""
 msgid "choosing %s as latest version of %s"
 msgstr ""
 
-#: cli/recipe/sync.go:228
+#: cli/recipe/sync.go:229
 #, c-format
 msgid "choosing %s as new version for %s"
 msgstr ""
 
-#: cli/app/rollback.go:145
+#: cli/app/rollback.go:146
 #, c-format
 msgid "choosing %s as version to rollback"
 msgstr ""
 
-#: cli/app/upgrade.go:152
+#: cli/app/upgrade.go:153
 #, c-format
 msgid "choosing %s as version to upgrade"
 msgstr ""
 
-#: cli/recipe/release.go:284
+#: cli/recipe/release.go:285
 #, c-format
 msgid "chore: publish %s release"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:222
+#: cli/catalogue/catalogue.go:224
 msgid "chore: publish new catalogue release changes"
 msgstr ""
 
-#: cli/app/cmd.go:23
+#: cli/app/cmd.go:24
 msgid "cmd"
 msgstr ""
 
@@ -1966,7 +1980,7 @@ msgstr ""
 msgid "collected %s for %s"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:120
+#: cli/catalogue/catalogue.go:122
 msgid "collecting catalogue metadata"
 msgstr ""
 
@@ -1991,7 +2005,8 @@ msgid ""
 "18.09 or later is installed on the remote host: stderr=%s"
 msgstr ""
 
-#: cli/app/cmd.go:22
+#. translators: `app command` command
+#: cli/app/cmd.go:23
 msgid ""
 "command <domain> [service | --local] <cmd> [[args] [flags] | [flags] -- "
 "[args]]"
@@ -2035,7 +2050,8 @@ msgstr ""
 msgid "conf %s: %s"
 msgstr ""
 
-#: cli/app/config.go:16
+#. translators: `app config` command
+#: cli/app/config.go:17
 msgid "config <domain> [flags]"
 msgstr ""
 
@@ -2068,7 +2084,7 @@ msgstr ""
 msgid "considering %s config(s) for tag update"
 msgstr ""
 
-#: cli/app/undeploy.go:126 cli/server/prune.go:45
+#: cli/app/undeploy.go:127 cli/server/prune.go:46
 #, c-format
 msgid "containers pruned: %d; space reclaimed: %s"
 msgstr ""
@@ -2077,7 +2093,7 @@ msgstr ""
 msgid "context 'default' cannot be removed"
 msgstr ""
 
-#: cli/server/add.go:163
+#: cli/server/add.go:164
 #, c-format
 msgid "context for %s already exists"
 msgstr ""
@@ -2086,7 +2102,7 @@ msgstr ""
 msgid "context lacks Docker endpoint"
 msgstr ""
 
-#: cli/recipe/sync.go:237 pkg/recipe/compose.go:229
+#: cli/recipe/sync.go:238 pkg/recipe/compose.go:229
 #, c-format
 msgid "coop-cloud.${STACK_NAME}.version=%s"
 msgstr ""
@@ -2096,12 +2112,12 @@ msgstr ""
 msgid "copied & templated %s to %s"
 msgstr ""
 
-#: cli/app/cp.go:164
+#: cli/app/cp.go:165
 #, c-format
 msgid "copy %s from local to %s on container"
 msgstr ""
 
-#: cli/app/cp.go:245
+#: cli/app/cp.go:246
 #, c-format
 msgid "copy: %s"
 msgstr ""
@@ -2121,11 +2137,13 @@ msgstr ""
 msgid "couldn't send EOF: %s"
 msgstr ""
 
-#: cli/app/cp.go:29
+#. translators: `app cp` command
+#: cli/app/cp.go:30
 msgid "cp <domain> <src> <dst> [flags]"
 msgstr ""
 
-#: cli/app/backup.go:134
+#. translators: `app backup create` command
+#: cli/app/backup.go:137
 msgid "create <domain> [flags]"
 msgstr ""
 
@@ -2133,7 +2151,7 @@ msgstr ""
 msgid "create an example .env.sample"
 msgstr ""
 
-#: cli/app/cp.go:145 cli/app/cp.go:184
+#: cli/app/cp.go:146 cli/app/cp.go:185
 #, c-format
 msgid "create remote directory: %s"
 msgstr ""
@@ -2143,7 +2161,7 @@ msgstr ""
 msgid "created client for %s"
 msgstr ""
 
-#: cli/recipe/release.go:422
+#: cli/recipe/release.go:423
 #, c-format
 msgid "created tag %s at %s"
 msgstr ""
@@ -2158,7 +2176,7 @@ msgstr ""
 msgid "creating %s"
 msgstr ""
 
-#: cli/server/add.go:168
+#: cli/server/add.go:169
 #, c-format
 msgid "creating context with domain %s"
 msgstr ""
@@ -2177,41 +2195,42 @@ msgstr ""
 msgid "critical"
 msgstr ""
 
-#: cli/recipe/lint.go:115
+#: cli/recipe/lint.go:116
 #, c-format
 msgid "critical errors present in %s config"
 msgstr ""
 
-#: cli/app/rollback.go:268
+#: cli/app/rollback.go:269
 #, c-format
 msgid "current deployment '%s' is not a known version for %s"
 msgstr ""
 
-#: cli/recipe/release.go:526
+#: cli/recipe/release.go:527
 #, c-format
 msgid "current: %s, new: %s, correct?"
 msgstr ""
 
-#: cli/app/backup.go:66 cli/app/deploy.go:29 cli/recipe/diff.go:14
-#: cli/updater/updater.go:491
+#: cli/app/backup.go:68 cli/app/deploy.go:30 cli/recipe/diff.go:15
+#: cli/updater/updater.go:494
 msgid "d"
 msgstr ""
 
-#: cli/updater/updater.go:490
+#: cli/updater/updater.go:493
 msgid "debug"
 msgstr ""
 
-#: cli/app/secret.go:279
+#: cli/app/secret.go:316
 #, c-format
 msgid "deleted %s successfully from local pass store"
 msgstr ""
 
-#: cli/app/secret.go:272
+#: cli/app/secret.go:309
 #, c-format
 msgid "deleted %s successfully from server"
 msgstr ""
 
-#: cli/app/deploy.go:28
+#. translators: `app deploy` command
+#: cli/app/deploy.go:29
 msgid "deploy <domain> [version] [flags]"
 msgstr ""
 
@@ -2243,7 +2262,7 @@ msgstr ""
 msgid "deployment timed out 🟠"
 msgstr ""
 
-#: cli/app/cp.go:273
+#: cli/app/cp.go:274
 msgid "destination directory does not exist"
 msgstr ""
 
@@ -2256,12 +2275,12 @@ msgstr ""
 msgid "detected ABRA_CI=1"
 msgstr ""
 
-#: cli/recipe/upgrade.go:199
+#: cli/recipe/upgrade.go:200
 #, c-format
 msgid "detected compatible upgradable tags %s for %s"
 msgstr ""
 
-#: cli/recipe/upgrade.go:172
+#: cli/recipe/upgrade.go:173
 #, c-format
 msgid "detected potential upgradable tags %s for %s"
 msgstr ""
@@ -2271,16 +2290,17 @@ msgstr ""
 msgid "detected versions %s for %s"
 msgstr ""
 
-#: cli/app/cmd.go:131 cli/app/cmd.go:176
+#: cli/app/cmd.go:132 cli/app/cmd.go:177
 msgid "did not detect any command arguments"
 msgstr ""
 
-#: cli/recipe/upgrade.go:119
+#: cli/recipe/upgrade.go:120
 #, c-format
 msgid "did not find versions file for %s"
 msgstr ""
 
-#: cli/recipe/diff.go:13
+#. translators: `recipe diff` command
+#: cli/recipe/diff.go:14
 msgid "diff <recipe> [flags]"
 msgstr ""
 
@@ -2299,24 +2319,24 @@ msgstr ""
 msgid "dirty: %v, "
 msgstr ""
 
-#: cli/app/rollback.go:340 cli/app/upgrade.go:451 cli/app/deploy.go:351
+#: cli/app/deploy.go:352 cli/app/rollback.go:341 cli/app/upgrade.go:452
 msgid "disable converge logic checks"
 msgstr ""
 
-#: cli/app/rollback.go:332 cli/app/upgrade.go:443 cli/app/deploy.go:343
+#: cli/app/deploy.go:344 cli/app/rollback.go:333 cli/app/upgrade.go:444
 msgid "disable public DNS checks"
 msgstr ""
 
-#: cli/app/cmd.go:267
+#: cli/app/cmd.go:269
 msgid "disable remote TTY"
 msgstr ""
 
-#: cli/recipe/release.go:609
+#: cli/recipe/release.go:610
 #, c-format
 msgid "discovered %s as currently synced recipe label"
 msgstr ""
 
-#: cli/app/run.go:105
+#: cli/app/run.go:106
 msgid "do not request a TTY"
 msgstr ""
 
@@ -2324,41 +2344,42 @@ msgstr ""
 msgid "docker: is the daemon running / your user has docker permissions?"
 msgstr ""
 
-#: cli/app/new.go:341
+#: cli/app/new.go:342
 msgid "domain"
 msgstr ""
 
-#: cli/app/new.go:344
+#: cli/app/new.go:345
 msgid "domain name for app"
 msgstr ""
 
-#: cli/run.go:108
+#: cli/run.go:110
 msgid "don't forget to run 'sudo mandb'"
 msgstr ""
 
-#: cli/updater/updater.go:386
+#: cli/updater/updater.go:388
 #, c-format
 msgid "don't update %s due to chaos deployment"
 msgstr ""
 
-#: cli/updater/updater.go:396
+#: cli/updater/updater.go:398
 #, c-format
 msgid ""
 "don't update %s due to disabled auto updates or missing ENABLE_AUTO_UPDATE "
 "env"
 msgstr ""
 
-#: cli/updater/updater.go:376
+#: cli/updater/updater.go:378
 #, c-format
 msgid "don't update %s due to missing recipe name"
 msgstr ""
 
-#: cli/updater/updater.go:406
+#: cli/updater/updater.go:408
 #, c-format
 msgid "don't update %s due to no new version"
 msgstr ""
 
-#: cli/app/backup.go:65
+#. translators: `app backup download` command
+#: cli/app/backup.go:67
 msgid "download <domain> [flags]"
 msgstr ""
 
@@ -2367,7 +2388,7 @@ msgstr ""
 msgid "dry run: adding %s"
 msgstr ""
 
-#: cli/recipe/release.go:312
+#: cli/recipe/release.go:313
 #, c-format
 msgid "dry run: move release note from 'next' to %s"
 msgstr ""
@@ -2376,11 +2397,11 @@ msgstr ""
 msgid "dry run: no changes commited"
 msgstr ""
 
-#: cli/recipe/release.go:377
+#: cli/recipe/release.go:378
 msgid "dry run: no changes committed"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:258 cli/recipe/release.go:429
+#: cli/catalogue/catalogue.go:260 cli/recipe/release.go:430
 msgid "dry run: no changes published"
 msgstr ""
 
@@ -2389,12 +2410,12 @@ msgstr ""
 msgid "dry run: no git changes pushed in %s"
 msgstr ""
 
-#: cli/recipe/release.go:402
+#: cli/recipe/release.go:403
 #, c-format
 msgid "dry run: no git tag created (%s)"
 msgstr ""
 
-#: cli/recipe/sync.go:243
+#: cli/recipe/sync.go:244
 #, c-format
 msgid "dry run: not syncing label %s for recipe %s"
 msgstr ""
@@ -2404,8 +2425,8 @@ msgstr ""
 msgid "dry run: remote %s (%s) not created"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:286 cli/recipe/release.go:633
-#: cli/recipe/sync.go:262
+#: cli/catalogue/catalogue.go:289 cli/recipe/release.go:634
+#: cli/recipe/sync.go:263
 msgid "dry-run"
 msgstr ""
 
@@ -2419,15 +2440,15 @@ msgstr ""
 msgid "duplicate secret target for %s not allowed"
 msgstr ""
 
-#: cli/app/env.go:16 cli/recipe/lint.go:137 cli/recipe/new.go:124
+#: cli/app/env.go:17 cli/recipe/lint.go:138 cli/recipe/new.go:125
 msgid "e"
 msgstr ""
 
-#: cli/recipe/list.go:42
+#: cli/recipe/list.go:43
 msgid "email"
 msgstr ""
 
-#: cli/app/restore.go:126
+#: cli/app/restore.go:127
 msgid "enable pre/post-hook command execution"
 msgstr ""
 
@@ -2444,7 +2465,7 @@ msgstr ""
 msgid "ensure \"image: ...\" set on all services"
 msgstr ""
 
-#: cli/app/deploy.go:107
+#: cli/app/deploy.go:108
 #, c-format
 msgid "ensure recipe: %s"
 msgstr ""
@@ -2454,13 +2475,14 @@ msgstr ""
 msgid "ensuring env version %s"
 msgstr ""
 
-#: cli/recipe/upgrade.go:280
+#: cli/recipe/upgrade.go:281
 msgid ""
 "enter / return to confirm, choose 'skip' to not upgrade this tag, vim mode "
 "is enabled"
 msgstr ""
 
-#: cli/app/env.go:15
+#. translators: `app env` command
+#: cli/app/env.go:16
 msgid "env <domain> [flags]"
 msgstr ""
 
@@ -2479,7 +2501,7 @@ msgstr ""
 msgid "err: %v, "
 msgstr ""
 
-#: cli/recipe/lint.go:74 cli/recipe/lint.go:136 pkg/lint/recipe.go:132
+#: cli/recipe/lint.go:75 cli/recipe/lint.go:137 pkg/lint/recipe.go:132
 #: pkg/lint/recipe.go:139 pkg/lint/recipe.go:146 pkg/lint/recipe.go:153
 #: pkg/lint/recipe.go:161 pkg/lint/recipe.go:168 pkg/lint/recipe.go:175
 msgid "error"
@@ -2514,7 +2536,7 @@ msgstr ""
 msgid "exec ID empty"
 msgstr ""
 
-#: cli/recipe/release.go:535
+#: cli/recipe/release.go:536
 msgid "exiting as requested"
 msgstr ""
 
@@ -2528,13 +2550,13 @@ msgstr ""
 msgid "expected 1 service but found %v: %s"
 msgstr ""
 
-#: cli/app/remove.go:156 cli/app/rollback.go:322 cli/app/upgrade.go:433
-#: cli/app/volume.go:199 cli/app/secret.go:528 cli/app/deploy.go:333
-#: cli/recipe/fetch.go:19 cli/recipe/fetch.go:131
+#: cli/app/deploy.go:334 cli/app/remove.go:157 cli/app/rollback.go:323
+#: cli/app/secret.go:572 cli/app/upgrade.go:434 cli/app/volume.go:202
+#: cli/recipe/fetch.go:20 cli/recipe/fetch.go:132
 msgid "f"
 msgstr ""
 
-#: cli/recipe/release.go:255 cli/recipe/release.go:540
+#: cli/recipe/release.go:256 cli/recipe/release.go:541
 #, c-format
 msgid "failed to add release notes: %s"
 msgstr ""
@@ -2549,7 +2571,7 @@ msgstr ""
 msgid "failed to check out %s in %s"
 msgstr ""
 
-#: cli/recipe/release.go:259 cli/recipe/release.go:544
+#: cli/recipe/release.go:260 cli/recipe/release.go:545
 #, c-format
 msgid "failed to commit changes: %s"
 msgstr ""
@@ -2574,7 +2596,7 @@ msgstr ""
 msgid "failed to create secret %s"
 msgstr ""
 
-#: cli/updater/updater.go:251
+#: cli/updater/updater.go:253
 #, c-format
 msgid "failed to determine deployed version of %s"
 msgstr ""
@@ -2602,7 +2624,7 @@ msgstr ""
 msgid "failed to parse image %s, saw: %s"
 msgstr ""
 
-#: cli/recipe/release.go:267 cli/recipe/release.go:552
+#: cli/recipe/release.go:268 cli/recipe/release.go:553
 #, c-format
 msgid "failed to publish new release: %s"
 msgstr ""
@@ -2636,7 +2658,7 @@ msgstr ""
 msgid "failed to resize tty, using default size"
 msgstr ""
 
-#: cli/app/new.go:117
+#: cli/app/new.go:118
 #, c-format
 msgid "failed to retrieve latest commit for %s: %s"
 msgstr ""
@@ -2651,7 +2673,7 @@ msgstr ""
 msgid "failed to select default branch in %s"
 msgstr ""
 
-#: cli/recipe/release.go:263 cli/recipe/release.go:548
+#: cli/recipe/release.go:264 cli/recipe/release.go:549
 #, c-format
 msgid "failed to tag release: %s"
 msgstr ""
@@ -2676,11 +2698,12 @@ msgstr ""
 msgid "failed to wait on tasks of stack: %s: %s"
 msgstr ""
 
-#: cli/recipe/fetch.go:18
+#. translators: `recipe fetch` command
+#: cli/recipe/fetch.go:19
 msgid "fetch [recipe | --all] [flags]"
 msgstr ""
 
-#: cli/recipe/fetch.go:117
+#: cli/recipe/fetch.go:118
 msgid "fetch all recipes"
 msgstr ""
 
@@ -2689,7 +2712,7 @@ msgstr ""
 msgid "fetched latest git changes for %s"
 msgstr ""
 
-#: cli/recipe/fetch.go:93
+#: cli/recipe/fetch.go:94
 msgid "fetching latest recipes..."
 msgstr ""
 
@@ -2698,11 +2721,11 @@ msgstr ""
 msgid "fetching repo metadata from %s"
 msgstr ""
 
-#: cli/app/secret.go:527
+#: cli/app/secret.go:571
 msgid "file"
 msgstr ""
 
-#: cli/app/remove.go:148
+#: cli/app/remove.go:149
 #, c-format
 msgid "file: %s removed"
 msgstr ""
@@ -2711,31 +2734,31 @@ msgstr ""
 msgid "fill out all the metadata"
 msgstr ""
 
-#: cli/recipe/list.go:108
+#: cli/recipe/list.go:109
 msgid "filter by recipe"
 msgstr ""
 
-#: cli/updater/updater.go:202
+#: cli/updater/updater.go:204
 #, c-format
 msgid "for %s read env %s with value: %s from docker service"
 msgstr ""
 
-#: cli/app/remove.go:155 cli/app/rollback.go:321 cli/app/upgrade.go:432
-#: cli/app/volume.go:198 cli/app/deploy.go:332 cli/recipe/fetch.go:130
+#: cli/app/deploy.go:333 cli/app/remove.go:156 cli/app/rollback.go:322
+#: cli/app/upgrade.go:433 cli/app/volume.go:201 cli/recipe/fetch.go:131
 msgid "force"
 msgstr ""
 
-#: cli/recipe/fetch.go:133
+#: cli/recipe/fetch.go:134
 msgid "force re-fetch"
 msgstr ""
 
-#: cli/recipe/upgrade.go:91
+#: cli/recipe/upgrade.go:92
 #, c-format
 msgid "found versions file for %s"
 msgstr ""
 
-#: cli/app/secret.go:26 cli/catalogue/catalogue.go:26
-#: cli/catalogue/catalogue.go:44
+#: cli/app/secret.go:30 cli/catalogue/catalogue.go:27
+#: cli/catalogue/catalogue.go:46
 msgid "g"
 msgstr ""
 
@@ -2743,15 +2766,17 @@ msgstr ""
 msgid "generate"
 msgstr ""
 
-#: cli/app/secret.go:25
+#. translators: `app secret generate` command
+#: cli/app/secret.go:29
 msgid "generate <domain> [[secret] [version] | --all] [flags]"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:43
+#. translators: `catalogue generate` command
+#: cli/catalogue/catalogue.go:45
 msgid "generate [recipe] [flags]"
 msgstr ""
 
-#: cli/app/secret.go:514
+#: cli/app/secret.go:558
 msgid "generate all secrets"
 msgstr ""
 
@@ -2765,17 +2790,17 @@ msgstr ""
 msgid "generated and stored %v on %s"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:206
+#: cli/catalogue/catalogue.go:208
 #, c-format
 msgid "generated recipe catalogue: %s"
 msgstr ""
 
-#: cli/app/secret.go:136
+#: cli/app/secret.go:140
 #, c-format
 msgid "generated secrets %s shown again, please take note of them %s"
 msgstr ""
 
-#: cli/app/deploy.go:101
+#: cli/app/deploy.go:102
 #, c-format
 msgid "get deploy version: %s"
 msgstr ""
@@ -2871,11 +2896,11 @@ msgstr ""
 msgid "git worktree: %s"
 msgstr ""
 
-#: cli/recipe/new.go:123
+#: cli/recipe/new.go:124
 msgid "git-email"
 msgstr ""
 
-#: cli/recipe/new.go:115
+#: cli/recipe/new.go:116
 msgid "git-name"
 msgstr ""
 
@@ -2888,7 +2913,7 @@ msgstr ""
 msgid "git: opening repository in %s"
 msgstr ""
 
-#: cli/recipe/new.go:87
+#: cli/recipe/new.go:88
 msgid "happy hacking 🎉"
 msgstr ""
 
@@ -2896,7 +2921,7 @@ msgstr ""
 msgid "has published catalogue version"
 msgstr ""
 
-#: cli/recipe/list.go:40
+#: cli/recipe/list.go:41
 msgid "healthcheck"
 msgstr ""
 
@@ -2904,11 +2929,11 @@ msgstr ""
 msgid "healthcheck enabled for all services"
 msgstr ""
 
-#: cli/app/restore.go:123
+#: cli/app/restore.go:124
 msgid "hooks"
 msgstr ""
 
-#: cli/app/secret.go:146
+#: cli/app/secret.go:151
 msgid "i"
 msgstr ""
 
@@ -2917,21 +2942,21 @@ msgstr ""
 msgid "id: %s, "
 msgstr ""
 
-#: cli/run.go:141
+#: cli/run.go:143
 msgid "ignore .env version checkout"
 msgstr ""
 
-#: cli/app/backup.go:290 cli/app/backup.go:306 cli/app/check.go:90
-#: cli/app/cmd.go:275 cli/app/cp.go:381 cli/app/labels.go:138
-#: cli/app/new.go:368 cli/app/ps.go:209 cli/app/restart.go:157
-#: cli/app/restore.go:134 cli/app/secret.go:506 cli/app/secret.go:546
-#: cli/app/secret.go:570 cli/app/secret.go:578 cli/app/deploy.go:327
-#: cli/catalogue/catalogue.go:305 cli/recipe/lint.go:131
-#: cli/updater/updater.go:540
+#: cli/app/backup.go:295 cli/app/backup.go:311 cli/app/check.go:91
+#: cli/app/cmd.go:277 cli/app/cp.go:382 cli/app/deploy.go:328
+#: cli/app/labels.go:139 cli/app/new.go:369 cli/app/ps.go:210
+#: cli/app/restart.go:158 cli/app/restore.go:135 cli/app/secret.go:550
+#: cli/app/secret.go:590 cli/app/secret.go:614 cli/app/secret.go:622
+#: cli/catalogue/catalogue.go:308 cli/recipe/lint.go:132
+#: cli/updater/updater.go:543
 msgid "ignore uncommitted recipes changes"
 msgstr ""
 
-#: cli/app/undeploy.go:141 cli/server/prune.go:66
+#: cli/app/undeploy.go:142 cli/server/prune.go:67
 #, c-format
 msgid "images pruned: %d; space reclaimed: %s"
 msgstr ""
@@ -2944,87 +2969,87 @@ msgstr ""
 msgid "include \"traefik.enable=true\" deploy label"
 msgstr ""
 
-#: cli/app/backup.go:274
+#: cli/app/backup.go:279
 msgid "include secrets"
 msgstr ""
 
-#: cli/app/backup.go:250
+#: cli/app/backup.go:255
 msgid "include timestamps"
 msgstr ""
 
-#: cli/app/backup.go:282
+#: cli/app/backup.go:287
 msgid "include volumes"
 msgstr ""
 
-#: cli/app/restore.go:74
+#: cli/app/restore.go:75
 #, c-format
 msgid "including CONTAINER=%s in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/backup.go:107
+#: cli/app/backup.go:109
 #, c-format
 msgid "including INCLUDE_PATH=%s in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/restore.go:62
+#: cli/app/restore.go:63
 #, c-format
 msgid "including NONINTERACTIVE=%v in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/restore.go:79
+#: cli/app/restore.go:80
 #, c-format
 msgid "including NO_COMMANDS=%v in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/backup.go:167
+#: cli/app/backup.go:170
 #, c-format
 msgid "including RETRIES=%s in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/backup.go:112
+#: cli/app/backup.go:114
 #, c-format
 msgid "including SECRETS=%v in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/backup.go:49
+#: cli/app/backup.go:50
 #, c-format
 msgid "including SHOW_ALL=%v in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/backup.go:44 cli/app/backup.go:102 cli/app/restore.go:52
+#: cli/app/backup.go:45 cli/app/backup.go:104 cli/app/restore.go:53
 #, c-format
 msgid "including SNAPSHOT=%s in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/restore.go:57
+#: cli/app/restore.go:58
 #, c-format
 msgid "including TARGET=%s in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/backup.go:54
+#: cli/app/backup.go:55
 #, c-format
 msgid "including TIMESTAMPS=%v in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/restore.go:68
+#: cli/app/restore.go:69
 #, c-format
 msgid "including VOLUMES=%s in backupbot exec invocation"
 msgstr ""
 
-#: cli/app/backup.go:117
+#: cli/app/backup.go:119
 #, c-format
 msgid "including VOLUMES=%v in backupbot exec invocation"
 msgstr ""
 
-#: cli/recipe/release.go:644 cli/recipe/sync.go:273 cli/recipe/upgrade.go:348
+#: cli/recipe/release.go:645 cli/recipe/sync.go:274 cli/recipe/upgrade.go:349
 msgid "increase the major part of the version"
 msgstr ""
 
-#: cli/recipe/release.go:652 cli/recipe/sync.go:281 cli/recipe/upgrade.go:356
+#: cli/recipe/release.go:653 cli/recipe/sync.go:282 cli/recipe/upgrade.go:357
 msgid "increase the minor part of the version"
 msgstr ""
 
-#: cli/recipe/release.go:660 cli/recipe/sync.go:289 cli/recipe/upgrade.go:364
+#: cli/recipe/release.go:661 cli/recipe/sync.go:290 cli/recipe/upgrade.go:365
 msgid "increase the patch part of the version"
 msgstr ""
 
@@ -3046,11 +3071,12 @@ msgstr ""
 msgid "initialising undeploy"
 msgstr ""
 
-#: cli/app/secret.go:145
+#. translators: `app secret insert` command
+#: cli/app/secret.go:150
 msgid "insert <domain> <secret> <version> [<data>] [flags]"
 msgstr ""
 
-#: cli/upgrade.go:55
+#: cli/upgrade.go:56
 msgid "install release candidate (may contain bugs)"
 msgstr ""
 
@@ -3102,43 +3128,46 @@ msgstr ""
 msgid "invalid tmpfs source, source must be empty"
 msgstr ""
 
-#: cli/recipe/sync.go:233
+#: cli/recipe/sync.go:234
 #, c-format
 msgid "invalid version %s specified"
 msgstr ""
 
-#: cli/updater/updater.go:471
+#. translators: `kadabra` binary name
+#: cli/updater/updater.go:474
 msgid "kadabra [cmd] [flags]"
 msgstr ""
 
-#: cli/updater/updater.go:484
+#: cli/updater/updater.go:487
 #, c-format
 msgid "kadabra version %s, commit %s"
 msgstr ""
 
-#: cli/app/cmd.go:249 cli/app/logs.go:19 cli/recipe/lint.go:16
-#: cli/server/add.go:200
+#: cli/app/cmd.go:251 cli/app/logs.go:20 cli/recipe/lint.go:17
+#: cli/server/add.go:201
 msgid "l"
 msgstr ""
 
-#: cli/app/labels.go:23
+#. translators: `app labels` command
+#: cli/app/labels.go:24
 msgid "labels <domain> [flags]"
 msgstr ""
 
-#: cli/app/list.go:177
+#: cli/app/list.go:178
 msgid "latest"
 msgstr ""
 
-#: cli/recipe/release.go:521
+#: cli/recipe/release.go:522
 #, c-format
 msgid "latest git tag (%s) and synced label (%s) are the same?"
 msgstr ""
 
-#: cli/app/labels.go:24
+#: cli/app/labels.go:25
 msgid "lb"
 msgstr ""
 
-#: cli/recipe/lint.go:14
+#. translators: `recipe lint` command
+#: cli/recipe/lint.go:15
 msgid "lint <recipe> [flags]"
 msgstr ""
 
@@ -3152,27 +3181,34 @@ msgstr ""
 msgid "linting successful, %s is well configured"
 msgstr ""
 
-#: cli/recipe/list.go:18
+#. translators: `recipe list` command
+#: cli/recipe/list.go:19
 msgid "list"
 msgstr ""
 
-#: cli/app/secret.go:399
+#. translators: `app secret list` command
+#: cli/app/secret.go:438
 msgid "list <domain>"
 msgstr ""
 
-#: cli/app/backup.go:15 cli/app/cmd.go:196 cli/app/volume.go:19
+#. translators: `app backup list` command
+#. translators: `app list` command
+#. translators: `app volume list` command
+#: cli/app/backup.go:16 cli/app/cmd.go:198 cli/app/volume.go:20
 msgid "list <domain> [flags]"
 msgstr ""
 
-#: cli/app/list.go:43 cli/server/list.go:18
+#. translators: `app list` command
+#. translators: `server list` command
+#: cli/app/list.go:44 cli/server/list.go:19
 msgid "list [flags]"
 msgstr ""
 
-#: cli/recipe/upgrade.go:380
+#: cli/recipe/upgrade.go:381
 msgid "list all tags, not just upgrades"
 msgstr ""
 
-#: cli/app/backup.go:234 cli/app/backup.go:258
+#: cli/app/backup.go:239 cli/app/backup.go:263
 msgid "list specific snapshot"
 msgstr ""
 
@@ -3181,24 +3217,25 @@ msgstr ""
 msgid "loaded app %s: %s"
 msgstr ""
 
-#: cli/app/cmd.go:248 cli/server/add.go:199 cli/server/list.go:69
+#: cli/app/cmd.go:250 cli/server/add.go:200 cli/server/list.go:70
 msgid "local"
 msgstr ""
 
-#: cli/app/cp.go:108
+#: cli/app/cp.go:109
 #, c-format
 msgid "local %s "
 msgstr ""
 
-#: cli/server/add.go:86
+#: cli/server/add.go:87
 msgid "local server already exists"
 msgstr ""
 
-#: cli/server/add.go:84
+#: cli/server/add.go:85
 msgid "local server successfully added"
 msgstr ""
 
-#: cli/app/logs.go:18
+#. translators: `app logs` command
+#: cli/app/logs.go:19
 msgid "logs <domain> [service] [flags]"
 msgstr ""
 
@@ -3211,71 +3248,72 @@ msgstr ""
 msgid "long secret names"
 msgstr ""
 
-#: cli/app/backup.go:16 cli/app/cmd.go:197 cli/app/list.go:44
-#: cli/app/volume.go:20 cli/app/secret.go:400 cli/recipe/list.go:20
-#: cli/server/list.go:19
+#: cli/app/backup.go:17 cli/app/cmd.go:199 cli/app/list.go:45
+#: cli/app/secret.go:439 cli/app/volume.go:21 cli/recipe/list.go:21
+#: cli/server/list.go:20
 msgid "ls"
 msgstr ""
 
-#: cli/app/list.go:312 cli/app/ps.go:199 cli/app/secret.go:488
-#: cli/app/secret.go:584 cli/recipe/list.go:98 cli/recipe/upgrade.go:370
-#: cli/recipe/version.go:132 cli/server/list.go:100 cli/updater/updater.go:546
+#: cli/app/list.go:313 cli/app/ps.go:200 cli/app/secret.go:532
+#: cli/app/secret.go:628 cli/recipe/list.go:99 cli/recipe/upgrade.go:371
+#: cli/recipe/version.go:133 cli/server/list.go:101 cli/updater/updater.go:549
 msgid "m"
 msgstr ""
 
-#: cli/app/list.go:311 cli/app/ps.go:198 cli/app/secret.go:487
-#: cli/app/secret.go:583 cli/recipe/list.go:97 cli/recipe/upgrade.go:369
-#: cli/recipe/version.go:131 cli/server/list.go:99
+#: cli/app/list.go:312 cli/app/ps.go:199 cli/app/secret.go:531
+#: cli/app/secret.go:627 cli/recipe/list.go:98 cli/recipe/upgrade.go:370
+#: cli/recipe/version.go:132 cli/server/list.go:100
 msgid "machine"
 msgstr ""
 
-#: cli/recipe/release.go:87
+#: cli/recipe/release.go:88
 #, c-format
 msgid "main app service version for %s is empty?"
 msgstr ""
 
 #: cli/internal/recipe.go:48 cli/internal/recipe.go:66
-#: cli/internal/recipe.go:80 cli/recipe/release.go:641 cli/recipe/sync.go:270
-#: cli/recipe/upgrade.go:345 cli/updater/updater.go:545
+#: cli/internal/recipe.go:80 cli/recipe/release.go:642 cli/recipe/sync.go:271
+#: cli/recipe/upgrade.go:346 cli/updater/updater.go:548
 msgid "major"
 msgstr ""
 
-#: cli/recipe/upgrade.go:101
+#: cli/recipe/upgrade.go:102
 #, c-format
 msgid "malformed version pin specification: %s"
 msgstr ""
 
-#: cli/run.go:31
+#: cli/run.go:32
 msgid "man"
 msgstr ""
 
-#: cli/run.go:81
+#. translators: `man` command
+#: cli/run.go:83
 msgid "man [flags]"
 msgstr ""
 
 #: cli/internal/recipe.go:48 cli/internal/recipe.go:68
-#: cli/internal/recipe.go:82 cli/recipe/release.go:649 cli/recipe/sync.go:278
-#: cli/recipe/upgrade.go:353
+#: cli/internal/recipe.go:82 cli/recipe/release.go:650 cli/recipe/sync.go:279
+#: cli/recipe/upgrade.go:354
 msgid "minor"
 msgstr ""
 
-#: cli/recipe/fetch.go:44
+#: cli/recipe/fetch.go:45
 msgid "missing [recipe] or --all/-a"
 msgstr ""
 
-#: cli/app/restart.go:64
+#: cli/app/restart.go:65
 msgid "missing [service]"
 msgstr ""
 
-#: cli/server/add.go:57
+#: cli/server/add.go:58
 msgid "missing argument or --local/-l flag"
 msgstr ""
 
-#: cli/app/secret.go:55
+#: cli/app/secret.go:59
 msgid "missing arguments [secret]/[version] or '--all'"
 msgstr ""
 
-#: cli/updater/updater.go:103
+#: cli/updater/updater.go:105
 msgid "missing arguments or --all/-a flag"
 msgstr ""
 
@@ -3284,16 +3322,16 @@ msgstr ""
 msgid "missing version for secret? (%s)"
 msgstr ""
 
-#: cli/app/secret.go:199
+#: cli/app/secret.go:282
 msgid "must provide <data> argument if --no-input is passed"
 msgstr ""
 
-#: cli/app/new.go:47 cli/recipe/new.go:35 cli/updater/updater.go:36
-#: cli/updater/updater.go:499
+#: cli/app/new.go:48 cli/recipe/new.go:36 cli/updater/updater.go:37
+#: cli/updater/updater.go:502
 msgid "n"
 msgstr ""
 
-#: cli/recipe/list.go:37
+#: cli/recipe/list.go:38
 msgid "name"
 msgstr ""
 
@@ -3306,6 +3344,10 @@ msgstr ""
 msgid "name: %s, "
 msgstr ""
 
+#: cli/app/secret.go:260
+msgid "need 3 or 4 arguments"
+msgstr ""
+
 #: pkg/upstream/stack/stack.go:348
 #, c-format
 msgid ""
@@ -3321,30 +3363,32 @@ msgid ""
 "instead of \"swarm\""
 msgstr ""
 
-#: cli/app/undeploy.go:133 cli/server/prune.go:52
+#: cli/app/undeploy.go:134 cli/server/prune.go:53
 #, c-format
 msgid "networks pruned: %d"
 msgstr ""
 
-#: cli/recipe/new.go:34
+#. translators: `recipe new` command
+#: cli/recipe/new.go:35
 msgid "new <recipe> [flags]"
 msgstr ""
 
-#: cli/app/new.go:46
+#. translators: `app new` command
+#: cli/app/new.go:47
 msgid "new [recipe] [version] [flags]"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:254
+#: cli/catalogue/catalogue.go:256
 #, c-format
 msgid "new changes published: %s"
 msgstr ""
 
-#: cli/recipe/new.go:86
+#: cli/recipe/new.go:87
 #, c-format
 msgid "new recipe '%s' created: %s"
 msgstr ""
 
-#: cli/recipe/release.go:453
+#: cli/recipe/release.go:454
 #, c-format
 msgid "new release published: %s"
 msgstr ""
@@ -3359,12 +3403,12 @@ msgstr ""
 msgid "no %s exists, skipping reading gitignore paths"
 msgstr ""
 
-#: cli/updater/updater.go:155 pkg/app/compose.go:87
+#: cli/updater/updater.go:157 pkg/app/compose.go:87
 #, c-format
 msgid "no %s label found for %s"
 msgstr ""
 
-#: cli/recipe/release.go:455
+#: cli/recipe/release.go:456
 msgid "no -p/--publish passed, not publishing"
 msgstr ""
 
@@ -3382,15 +3426,15 @@ msgstr ""
 msgid "no app provided"
 msgstr ""
 
-#: cli/app/rollback.go:120
+#: cli/app/rollback.go:121
 msgid "no available downgrades"
 msgstr ""
 
-#: cli/app/upgrade.go:127
+#: cli/app/upgrade.go:128
 msgid "no available upgrades"
 msgstr ""
 
-#: cli/updater/updater.go:224
+#: cli/updater/updater.go:226
 #, c-format
 msgid "no available upgrades for %s"
 msgstr ""
@@ -3399,7 +3443,7 @@ msgstr ""
 msgid "no backupbot discovered, is it deployed?"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:218 cli/recipe/release.go:388
+#: cli/catalogue/catalogue.go:220 cli/recipe/release.go:389
 #, c-format
 msgid "no changes discovered in %s, nothing to publish?"
 msgstr ""
@@ -3412,7 +3456,7 @@ msgstr ""
 msgid "no config file found"
 msgstr ""
 
-#: cli/app/remove.go:94
+#: cli/app/remove.go:95
 msgid "no configs to remove"
 msgstr ""
 
@@ -3421,7 +3465,7 @@ msgstr ""
 msgid "no containers matching the %v filter found?"
 msgstr ""
 
-#: cli/app/new.go:261 cli/internal/validate.go:129
+#: cli/app/new.go:262 cli/internal/validate.go:129
 msgid "no domain provided"
 msgstr ""
 
@@ -3429,19 +3473,19 @@ msgstr ""
 msgid "no existing label found, automagic insertion not supported yet"
 msgstr ""
 
-#: cli/recipe/sync.go:74
+#: cli/recipe/sync.go:75
 #, c-format
 msgid "no git tags found for %s"
 msgstr ""
 
-#: cli/recipe/upgrade.go:177
+#: cli/recipe/upgrade.go:178
 #, c-format
 msgid ""
 "no new versions available for %s, assuming %s is the latest (use -a/--all-"
 "tags to see all anyway)"
 msgstr ""
 
-#: cli/updater/updater.go:273
+#: cli/updater/updater.go:275
 #, fuzzy, c-format
 msgid "no published releases for %s in the recipe catalogue?"
 msgstr "TRANSLATE THIS FUCKING SHIT ALREADY"
@@ -3455,37 +3499,37 @@ msgstr ""
 msgid "no recipe name provided"
 msgstr ""
 
-#: cli/app/secret.go:219
+#: cli/app/secret.go:224
 #, c-format
 msgid "no secret %s available for recipe %s?"
 msgstr ""
 
-#: cli/app/secret.go:338
+#: cli/app/secret.go:376
 msgid "no secret(s) specified?"
 msgstr ""
 
-#: cli/app/secret.go:104
+#: cli/app/secret.go:108
 msgid "no secrets generated"
 msgstr ""
 
-#: cli/app/secret.go:465
+#: cli/app/secret.go:508
 #, c-format
 msgid "no secrets stored for %s"
 msgstr ""
 
-#: cli/app/remove.go:119
+#: cli/app/remove.go:120
 msgid "no secrets to remove"
 msgstr ""
 
-#: cli/app/secret.go:393
+#: cli/app/secret.go:431
 msgid "no secrets to remove?"
 msgstr ""
 
-#: cli/app/new.go:310 cli/internal/validate.go:167
+#: cli/app/new.go:311 cli/internal/validate.go:167
 msgid "no server provided"
 msgstr ""
 
-#: cli/app/cmd.go:168
+#: cli/app/cmd.go:169
 #, c-format
 msgid "no service %s for %s?"
 msgstr ""
@@ -3504,7 +3548,7 @@ msgstr ""
 msgid "no services matching the %v filter found?"
 msgstr ""
 
-#: cli/recipe/release.go:165
+#: cli/recipe/release.go:166
 #, c-format
 msgid ""
 "no tag specified and no previous tag available for %s, assuming initial "
@@ -3519,32 +3563,32 @@ msgstr ""
 msgid "no version bump type specififed?"
 msgstr ""
 
-#: cli/app/volume.go:71
+#: cli/app/volume.go:72
 #, c-format
 msgid "no volumes created for %s"
 msgstr ""
 
-#: cli/app/volume.go:184
+#: cli/app/volume.go:186
 msgid "no volumes removed"
 msgstr ""
 
-#: cli/app/remove.go:141
+#: cli/app/remove.go:142
 msgid "no volumes to remove"
 msgstr ""
 
-#: cli/app/rollback.go:337 cli/app/upgrade.go:448 cli/app/deploy.go:348
+#: cli/app/deploy.go:349 cli/app/rollback.go:338 cli/app/upgrade.go:449
 msgid "no-converge-checks"
 msgstr ""
 
-#: cli/app/rollback.go:329 cli/app/upgrade.go:440 cli/app/deploy.go:340
+#: cli/app/deploy.go:341 cli/app/rollback.go:330 cli/app/upgrade.go:441
 msgid "no-domain-checks"
 msgstr ""
 
-#: cli/updater/updater.go:498
+#: cli/updater/updater.go:501
 msgid "no-input"
 msgstr ""
 
-#: cli/app/run.go:102
+#: cli/app/run.go:103
 msgid "no-tty"
 msgstr ""
 
@@ -3561,12 +3605,12 @@ msgstr ""
 msgid "not requesting a remote TTY"
 msgstr ""
 
-#: cli/recipe/upgrade.go:300
+#: cli/recipe/upgrade.go:301
 #, c-format
 msgid "not upgrading %s, skipping as requested"
 msgstr ""
 
-#: cli/recipe/upgrade.go:239
+#: cli/recipe/upgrade.go:240
 #, c-format
 msgid ""
 "not upgrading from %s to %s for %s, because the upgrade type is more serious "
@@ -3578,15 +3622,16 @@ msgstr ""
 msgid "nothing found in stack: %s"
 msgstr ""
 
-#: cli/updater/updater.go:35
+#. translators: `notify` command
+#: cli/updater/updater.go:36
 msgid "notify [flags]"
 msgstr ""
 
-#: cli/app/backup.go:298
+#: cli/app/backup.go:303
 msgid "number of retry attempts"
 msgstr ""
 
-#: cli/app/cp.go:85
+#: cli/app/cp.go:86
 msgid "one of <src>/<dest> arguments must take $SERVICE:$PATH form"
 msgstr ""
 
@@ -3598,26 +3643,26 @@ msgstr ""
 msgid "only annotated tags used for recipe version"
 msgstr ""
 
-#: cli/recipe/lint.go:139
+#: cli/recipe/lint.go:140
 msgid "only show errors"
 msgstr ""
 
-#: cli/app/upgrade.go:459
+#: cli/app/upgrade.go:460
 msgid "only show release notes"
 msgstr ""
 
-#: cli/app/logs.go:96
+#: cli/app/logs.go:97
 msgid "only tail stderr"
 msgstr ""
 
-#: cli/app/backup.go:264 cli/app/new.go:350 cli/app/ps.go:29
-#: cli/app/undeploy.go:154 cli/app/secret.go:496 cli/app/secret.go:520
-#: cli/app/secret.go:560 cli/catalogue/catalogue.go:279 cli/recipe/list.go:106
-#: cli/recipe/release.go:666 cli/server/prune.go:16
+#: cli/app/backup.go:269 cli/app/new.go:351 cli/app/ps.go:30
+#: cli/app/secret.go:540 cli/app/secret.go:564 cli/app/secret.go:604
+#: cli/app/undeploy.go:155 cli/catalogue/catalogue.go:282
+#: cli/recipe/list.go:107 cli/recipe/release.go:667 cli/server/prune.go:17
 msgid "p"
 msgstr ""
 
-#: cli/recipe/upgrade.go:158
+#: cli/recipe/upgrade.go:159
 #, c-format
 msgid "parsed %s for %s"
 msgstr ""
@@ -3627,33 +3672,33 @@ msgstr ""
 msgid "parsed %s from %s"
 msgstr ""
 
-#: cli/app/cmd.go:128 cli/app/cmd.go:174
+#: cli/app/cmd.go:129 cli/app/cmd.go:175
 #, c-format
 msgid "parsed following command arguments: %s"
 msgstr ""
 
-#: cli/app/upgrade.go:316
+#: cli/app/upgrade.go:317
 #, c-format
 msgid "parsing chosen upgrade version failed: %s"
 msgstr ""
 
-#: cli/app/upgrade.go:360
+#: cli/app/upgrade.go:361
 #, c-format
 msgid "parsing deployed version failed: %s"
 msgstr ""
 
-#: cli/app/upgrade.go:321
+#: cli/app/upgrade.go:322
 #, c-format
 msgid "parsing deployment version failed: %s"
 msgstr ""
 
-#: cli/app/upgrade.go:327 cli/app/upgrade.go:366
+#: cli/app/upgrade.go:328 cli/app/upgrade.go:367
 #, c-format
 msgid "parsing recipe version failed: %s"
 msgstr ""
 
-#: cli/app/new.go:349 cli/app/secret.go:495 cli/app/secret.go:519
-#: cli/app/secret.go:559
+#: cli/app/new.go:350 cli/app/secret.go:539 cli/app/secret.go:563
+#: cli/app/secret.go:603
 msgid "pass"
 msgstr ""
 
@@ -3662,45 +3707,45 @@ msgid "pass command not found on $PATH, is it installed?"
 msgstr ""
 
 #: cli/internal/recipe.go:48 cli/internal/recipe.go:70
-#: cli/internal/recipe.go:84 cli/recipe/release.go:657 cli/recipe/sync.go:286
-#: cli/recipe/upgrade.go:361
+#: cli/internal/recipe.go:84 cli/recipe/release.go:658 cli/recipe/sync.go:287
+#: cli/recipe/upgrade.go:362
 msgid "patch"
 msgstr ""
 
-#: cli/app/backup.go:263
+#: cli/app/backup.go:268
 msgid "path"
 msgstr ""
 
-#: cli/recipe/list.go:105
+#: cli/recipe/list.go:106
 msgid "pattern"
 msgstr ""
 
-#: cli/app/remove.go:158 cli/app/rollback.go:324 cli/app/upgrade.go:435
-#: cli/app/volume.go:201 cli/app/deploy.go:335
+#: cli/app/deploy.go:336 cli/app/remove.go:159 cli/app/rollback.go:325
+#: cli/app/upgrade.go:436 cli/app/volume.go:204
 msgid "perform action without further prompt"
 msgstr ""
 
-#: cli/recipe/release.go:619
+#: cli/recipe/release.go:620
 #, c-format
 msgid "please fix your synced label for %s and re-run this command"
 msgstr ""
 
-#: cli/app/rollback.go:236
+#: cli/app/rollback.go:237
 #, c-format
 msgid "please select a downgrade (version: %s):"
 msgstr ""
 
-#: cli/app/rollback.go:241
+#: cli/app/rollback.go:242
 #, c-format
 msgid "please select a downgrade (version: %s, chaos: %s):"
 msgstr ""
 
-#: cli/app/upgrade.go:283
+#: cli/app/upgrade.go:284
 #, c-format
 msgid "please select an upgrade (version: %s):"
 msgstr ""
 
-#: cli/app/upgrade.go:288
+#: cli/app/upgrade.go:289
 #, c-format
 msgid "please select an upgrade (version: %s, chaos: %s):"
 msgstr ""
@@ -3713,17 +3758,17 @@ msgstr ""
 msgid "polling undeploy status"
 msgstr ""
 
-#: cli/run.go:133
+#: cli/run.go:135
 msgid "prefer offline & filesystem access"
 msgstr ""
 
-#: cli/recipe/release.go:153
+#: cli/recipe/release.go:154
 msgid "previous git tags detected, assuming new semver release"
 msgstr ""
 
-#: cli/app/list.go:314 cli/app/ps.go:201 cli/app/secret.go:490
-#: cli/app/secret.go:586 cli/recipe/list.go:100 cli/recipe/upgrade.go:372
-#: cli/recipe/version.go:134 cli/server/list.go:102
+#: cli/app/list.go:315 cli/app/ps.go:202 cli/app/secret.go:534
+#: cli/app/secret.go:630 cli/recipe/list.go:101 cli/recipe/upgrade.go:373
+#: cli/recipe/version.go:135 cli/server/list.go:103
 msgid "print machine-readable output"
 msgstr ""
 
@@ -3732,23 +3777,25 @@ msgstr ""
 msgid "processing %s for %s"
 msgstr ""
 
-#: cli/app/undeploy.go:153
+#: cli/app/undeploy.go:154
 msgid "prune"
 msgstr ""
 
-#: cli/server/prune.go:15
+#. translators: `server prune` command
+#: cli/server/prune.go:16
 msgid "prune <server> [flags]"
 msgstr ""
 
-#: cli/app/undeploy.go:156
+#: cli/app/undeploy.go:157
 msgid "prune unused containers, networks, and dangling images"
 msgstr ""
 
-#: cli/app/ps.go:28
+#. translators: `app ps` command
+#: cli/app/ps.go:29
 msgid "ps <domain> [flags]"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:278 cli/recipe/release.go:665
+#: cli/catalogue/catalogue.go:281 cli/recipe/release.go:666
 msgid "publish"
 msgstr ""
 
@@ -3756,11 +3803,11 @@ msgstr ""
 msgid "publish a recipe version to the catalogue"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:281 cli/recipe/release.go:668
+#: cli/catalogue/catalogue.go:284 cli/recipe/release.go:669
 msgid "publish changes to git.coopcloud.tech"
 msgstr ""
 
-#: cli/recipe/release.go:435
+#: cli/recipe/release.go:436
 msgid "publish new release?"
 msgstr ""
 
@@ -3768,13 +3815,13 @@ msgstr ""
 msgid "querying remote servers..."
 msgstr ""
 
-#: cli/app/backup.go:296 cli/app/list.go:297 cli/app/run.go:22
-#: cli/app/upgrade.go:457 cli/catalogue/catalogue.go:287
-#: cli/recipe/recipe.go:11 cli/recipe/release.go:634 cli/recipe/sync.go:263
+#: cli/app/backup.go:301 cli/app/list.go:298 cli/app/run.go:23
+#: cli/app/upgrade.go:458 cli/catalogue/catalogue.go:290
+#: cli/recipe/recipe.go:12 cli/recipe/release.go:635 cli/recipe/sync.go:264
 msgid "r"
 msgstr ""
 
-#: cli/app/restart.go:22
+#: cli/app/restart.go:23
 msgid "re"
 msgstr ""
 
@@ -3822,7 +3869,16 @@ msgstr ""
 msgid "reader: %v, "
 msgstr ""
 
-#: cli/app/secret.go:242
+#: cli/app/secret.go:276
+#, c-format
+msgid "reading data from stdin: %s"
+msgstr ""
+
+#: cli/app/secret.go:273
+msgid "reading secret data from stdin"
+msgstr ""
+
+#: cli/app/secret.go:230
 #, c-format
 msgid "reading secret from file: %s"
 msgstr ""
@@ -3832,7 +3888,7 @@ msgstr ""
 msgid "readme: %s, "
 msgstr ""
 
-#: cli/app/list.go:296 cli/app/list.go:303 cli/run.go:32
+#: cli/app/list.go:297 cli/app/list.go:304 cli/run.go:33
 msgid "recipe"
 msgstr ""
 
@@ -3848,7 +3904,8 @@ msgid ""
 "%s"
 msgstr ""
 
-#: cli/recipe/recipe.go:10
+#. translators: `recipe` command group
+#: cli/recipe/recipe.go:11
 msgid "recipe [cmd] [args] [flags]"
 msgstr ""
 
@@ -3861,61 +3918,66 @@ msgstr ""
 msgid "reduce length of secret names to 12 chars"
 msgstr ""
 
-#: cli/recipe/lint.go:32
+#: cli/recipe/lint.go:33
 msgid "ref"
 msgstr ""
 
-#: cli/recipe/release.go:27
+#. translators: `recipe release` command
+#: cli/recipe/release.go:28
 msgid "release <recipe> [version] [flags]"
 msgstr ""
 
-#: cli/app/upgrade.go:456
+#: cli/app/upgrade.go:457
 msgid "releasenotes"
 msgstr ""
 
-#: cli/app/cp.go:117 cli/app/cp.go:199 cli/app/cp.go:210
+#: cli/app/cp.go:118 cli/app/cp.go:200 cli/app/cp.go:211
 #, c-format
 msgid "remote path: %s"
 msgstr ""
 
-#: cli/app/cp.go:197
+#: cli/app/cp.go:198
 #, c-format
 msgid "remote: %s does not exist"
 msgstr ""
 
-#: cli/app/secret.go:286
+#. translators: `app secret remove` command
+#: cli/app/secret.go:324
 msgid "remove <domain> [[secret] | --all] [flags]"
 msgstr ""
 
-#: cli/app/remove.go:19
+#. translators: `app remove` command
+#: cli/app/remove.go:20
 msgid "remove <domain> [flags]"
 msgstr ""
 
-#: cli/app/volume.go:76
+#. translators: `app volume remove` command
+#: cli/app/volume.go:78
 msgid "remove <domain> [volume] [flags]"
 msgstr ""
 
-#: cli/server/remove.go:17
+#. translators: `server remove` command
+#: cli/server/remove.go:18
 msgid "remove <server> [flags]"
 msgstr ""
 
-#: cli/app/secret.go:554
+#: cli/app/secret.go:598
 msgid "remove all secrets"
 msgstr ""
 
-#: cli/server/prune.go:93
+#: cli/server/prune.go:94
 msgid "remove all unused images"
 msgstr ""
 
-#: cli/app/secret.go:562
+#: cli/app/secret.go:606
 msgid "remove generated secrets from a local pass store"
 msgstr ""
 
-#: cli/server/prune.go:101
+#: cli/server/prune.go:102
 msgid "remove volumes"
 msgstr ""
 
-#: cli/recipe/new.go:62
+#: cli/recipe/new.go:63
 #, c-format
 msgid "removed .git repo in %s"
 msgstr ""
@@ -3925,16 +3987,16 @@ msgstr ""
 msgid "removed dirty suffix from .env version: %s -> %s"
 msgstr ""
 
-#: cli/recipe/release.go:576
+#: cli/recipe/release.go:577
 msgid "removed freshly created commit"
 msgstr ""
 
-#: cli/recipe/release.go:594
+#: cli/recipe/release.go:595
 #, c-format
 msgid "removed freshly created tag %s"
 msgstr ""
 
-#: cli/server/prune.go:56
+#: cli/server/prune.go:57
 msgid "removing all images, not only dangling ones"
 msgstr ""
 
@@ -3943,7 +4005,7 @@ msgstr ""
 msgid "removing config %s"
 msgstr ""
 
-#: cli/app/remove.go:89
+#: cli/app/remove.go:90
 #, c-format
 msgid "removing configs failed: %s"
 msgstr ""
@@ -3963,12 +4025,12 @@ msgstr ""
 msgid "removing service %s"
 msgstr ""
 
-#: cli/app/volume.go:150
+#: cli/app/volume.go:152
 #, c-format
 msgid "removing volume %s failed: %s"
 msgstr ""
 
-#: cli/app/remove.go:136 cli/app/volume.go:179
+#: cli/app/remove.go:137 cli/app/volume.go:181
 #, c-format
 msgid "removing volumes failed: %s"
 msgstr ""
@@ -3991,56 +4053,59 @@ msgstr ""
 msgid "repo set config: %s"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:289 cli/recipe/release.go:636
-#: cli/recipe/sync.go:265
+#: cli/catalogue/catalogue.go:292 cli/recipe/release.go:637
+#: cli/recipe/sync.go:266
 msgid "report changes that would be made"
 msgstr ""
 
-#: cli/app/cmd.go:259
+#: cli/app/cmd.go:261
 msgid "request remote user"
 msgstr ""
 
-#: cli/app/cmd.go:46
+#: cli/app/cmd.go:47
 msgid "requires at least 2 arguments with --local/-l"
 msgstr ""
 
-#: cli/app/cmd.go:67
+#: cli/app/cmd.go:68
 msgid "requires at least 3 arguments"
 msgstr ""
 
-#: cli/recipe/reset.go:13
+#. translators: `recipe reset` command
+#: cli/recipe/reset.go:14
 msgid "reset <recipe> [flags]"
 msgstr ""
 
-#: cli/recipe/lint.go:37
+#: cli/recipe/lint.go:38
 msgid "resolve"
 msgstr ""
 
-#: cli/app/restart.go:21
+#. translators: `app restart` command
+#: cli/app/restart.go:22
 msgid "restart <domain> [[service] | --all-services] [flags]"
 msgstr ""
 
-#: cli/app/restart.go:164
+#: cli/app/restart.go:165
 msgid "restart all services"
 msgstr ""
 
-#: cli/app/restore.go:16
+#. translators: `app restore` command
+#: cli/app/restore.go:17
 msgid "restore <domain> [flags]"
 msgstr ""
 
-#: cli/app/restore.go:110
+#: cli/app/restore.go:111
 msgid "restore specific services"
 msgstr ""
 
-#: cli/app/restore.go:118
+#: cli/app/restore.go:119
 msgid "restore specific volumes"
 msgstr ""
 
-#: cli/app/backup.go:295
+#: cli/app/backup.go:300
 msgid "retries"
 msgstr ""
 
-#: cli/updater/updater.go:239
+#: cli/updater/updater.go:241
 #, c-format
 msgid "retrieve deployed version whether %s is already deployed"
 msgstr ""
@@ -4050,7 +4115,7 @@ msgstr ""
 msgid "retrieved %s as backup enabled service"
 msgstr ""
 
-#: cli/app/cp.go:72 cli/internal/command.go:39
+#: cli/app/cp.go:73 cli/internal/command.go:39
 #, c-format
 msgid "retrieved %s as target container on %s"
 msgstr ""
@@ -4065,7 +4130,7 @@ msgstr ""
 msgid "retrieved %s for %s"
 msgstr ""
 
-#: cli/recipe/upgrade.go:139
+#: cli/recipe/upgrade.go:140
 #, c-format
 msgid "retrieved %s from remote registry for %s"
 msgstr ""
@@ -4080,7 +4145,7 @@ msgstr ""
 msgid "retrieved app statuses: %s"
 msgstr ""
 
-#: cli/recipe/version.go:39
+#: cli/recipe/version.go:40
 msgid "retrieved versions from local recipe repository"
 msgstr ""
 
@@ -4093,16 +4158,17 @@ msgstr ""
 msgid "retrieving recipes"
 msgstr ""
 
-#: cli/app/rollback.go:26 cli/recipe/release.go:28
+#: cli/app/rollback.go:27 cli/recipe/release.go:29
 msgid "rl"
 msgstr ""
 
-#: cli/app/remove.go:20 cli/app/volume.go:93 cli/app/secret.go:287
-#: cli/server/remove.go:18
+#: cli/app/remove.go:21 cli/app/secret.go:325 cli/app/volume.go:95
+#: cli/server/remove.go:19
 msgid "rm"
 msgstr ""
 
-#: cli/app/rollback.go:25
+#. translators: `app rollback` command
+#: cli/app/rollback.go:26
 msgid "rollback <domain> [version] [flags]"
 msgstr ""
 
@@ -4110,27 +4176,28 @@ msgstr ""
 msgid "rolled back"
 msgstr ""
 
-#: cli/app/restore.go:17 cli/recipe/reset.go:14
+#: cli/app/restore.go:18 cli/recipe/reset.go:15
 msgid "rs"
 msgstr ""
 
-#: cli/recipe/lint.go:33
+#: cli/recipe/lint.go:34
 msgid "rule"
 msgstr ""
 
-#: cli/app/run.go:21
+#. translators: `app run` command
+#: cli/app/run.go:22
 msgid "run <domain> <service> <cmd> [[args] [flags] | [flags] -- [args]]"
 msgstr ""
 
-#: cli/app/run.go:113
+#: cli/app/run.go:114
 msgid "run command as user"
 msgstr ""
 
-#: cli/app/cmd.go:251
+#: cli/app/cmd.go:253
 msgid "run command locally"
 msgstr ""
 
-#: cli/app/upgrade.go:264 cli/app/deploy.go:227
+#: cli/app/deploy.go:228 cli/app/upgrade.go:265
 #, c-format
 msgid "run the following post-deploy commands: %s"
 msgstr ""
@@ -4145,7 +4212,7 @@ msgstr ""
 msgid "running command %s %s within the context of %s_%s"
 msgstr ""
 
-#: cli/app/cmd.go:171
+#: cli/app/cmd.go:172
 #, c-format
 msgid "running command %s within the context of %s_%s"
 msgstr ""
@@ -4165,10 +4232,10 @@ msgstr ""
 msgid "running post-command '%s %s' in container %s"
 msgstr ""
 
-#: cli/app/backup.go:179 cli/app/backup.go:232 cli/app/backup.go:256
-#: cli/app/list.go:320 cli/app/logs.go:94 cli/app/new.go:327
-#: cli/app/restore.go:108 cli/app/secret.go:471 cli/catalogue/catalogue.go:295
-#: cli/recipe/fetch.go:123 cli/recipe/sync.go:23 cli/server/server.go:11
+#: cli/app/backup.go:183 cli/app/backup.go:237 cli/app/backup.go:261
+#: cli/app/list.go:321 cli/app/logs.go:95 cli/app/new.go:328
+#: cli/app/restore.go:109 cli/app/secret.go:515 cli/catalogue/catalogue.go:298
+#: cli/recipe/fetch.go:124 cli/recipe/sync.go:24 cli/server/server.go:12
 msgid "s"
 msgstr ""
 
@@ -4177,7 +4244,7 @@ msgstr ""
 msgid "sample env: %s, "
 msgstr ""
 
-#: cli/recipe/lint.go:35
+#: cli/recipe/lint.go:36
 msgid "satisfied"
 msgstr ""
 
@@ -4191,12 +4258,13 @@ msgstr ""
 msgid "secret %s is longer than 12 characters"
 msgstr ""
 
-#: cli/app/secret.go:470
+#. translators: `app secret` command group
+#: cli/app/secret.go:514
 msgid "secret [cmd] [args] [flags]"
 msgstr ""
 
-#: cli/app/secret.go:223
-msgid "secret data not provided on command-line, prompting"
+#: cli/app/secret.go:285
+msgid "secret data not provided on command-line or stdin, prompting"
 msgstr ""
 
 #: pkg/upstream/convert/service.go:72
@@ -4204,27 +4272,27 @@ msgstr ""
 msgid "secret not found: %s"
 msgstr ""
 
-#: cli/app/deploy.go:274
+#: cli/app/deploy.go:275
 #, c-format
 msgid "secret not generated: %s"
 msgstr ""
 
-#: cli/app/remove.go:116
+#: cli/app/remove.go:117
 #, c-format
 msgid "secret: %s removed"
 msgstr ""
 
-#: cli/app/backup.go:271 cli/app/new.go:357
+#: cli/app/backup.go:276 cli/app/new.go:358
 msgid "secrets"
 msgstr ""
 
-#: cli/app/new.go:197
+#: cli/app/new.go:198
 #, c-format
 msgid "secrets are %s shown again, please save them %s"
 msgstr ""
 
-#: cli/app/list.go:319 cli/app/list.go:326 cli/app/new.go:326
-#: cli/app/new.go:333 cli/run.go:33
+#: cli/app/list.go:320 cli/app/list.go:327 cli/app/new.go:327
+#: cli/app/new.go:334 cli/run.go:34
 msgid "server"
 msgstr ""
 
@@ -4233,11 +4301,12 @@ msgstr ""
 msgid "server %s doesn't exist? Run \"abra server ls\" to check"
 msgstr ""
 
-#: cli/server/server.go:10
+#. translators: `server` command group
+#: cli/server/server.go:11
 msgid "server [cmd] [args] [flags]"
 msgstr ""
 
-#: cli/server/add.go:184
+#: cli/server/add.go:185
 #, c-format
 msgid "server dir for %s already created"
 msgstr ""
@@ -4246,43 +4315,44 @@ msgstr ""
 msgid "server doesn't exist?"
 msgstr ""
 
-#: cli/server/add.go:141
+#: cli/server/add.go:142
 #, c-format
 msgid "serverAdd: cleanUp: %s is not empty, aborting cleanup"
 msgstr ""
 
-#: cli/server/add.go:128
+#: cli/server/add.go:129
 #, c-format
 msgid "serverAdd: cleanUp: cleaning up context for %s"
 msgstr ""
 
-#: cli/server/add.go:146
+#: cli/server/add.go:147
 #, c-format
 msgid "serverAdd: cleanUp: failed to remove %s: %s"
 msgstr ""
 
-#: cli/server/add.go:137
+#: cli/server/add.go:138
 #, c-format
 msgid "serverAdd: cleanUp: unable to list files in %s: %s"
 msgstr ""
 
-#: cli/recipe/upgrade.go:222
+#: cli/recipe/upgrade.go:223
 #, c-format
 msgid ""
 "service %s is at version %s, but pinned to %s, please correct your "
 "compose.yml file manually!"
 msgstr ""
 
-#: cli/recipe/upgrade.go:218
+#: cli/recipe/upgrade.go:219
 #, c-format
 msgid "service %s, image %s pinned to %s, no compatible upgrade found"
 msgstr ""
 
-#: cli/app/restore.go:107
+#: cli/app/restore.go:108
 msgid "services"
 msgstr ""
 
-#: cli/app/services.go:21
+#. translators: `app services` command
+#: cli/app/services.go:22
 msgid "services <domain> [flags]"
 msgstr ""
 
@@ -4320,48 +4390,48 @@ msgstr ""
 msgid "set reference: %s"
 msgstr ""
 
-#: cli/recipe/lint.go:34
+#: cli/recipe/lint.go:35
 msgid "severity"
 msgstr ""
 
-#: cli/app/backup.go:242
+#: cli/app/backup.go:247
 msgid "show all paths"
 msgstr ""
 
-#: cli/app/list.go:291
+#: cli/app/list.go:292
 msgid "show app deployment status"
 msgstr ""
 
-#: cli/app/list.go:299
+#: cli/app/list.go:300
 msgid "show apps of a specific recipe"
 msgstr ""
 
-#: cli/app/list.go:322
+#: cli/app/list.go:323
 msgid "show apps of a specific server"
 msgstr ""
 
-#: cli/updater/updater.go:493 cli/run.go:117
+#: cli/run.go:119 cli/updater/updater.go:496
 msgid "show debug messages"
 msgstr ""
 
-#: cli/app/logs.go:101
+#: cli/app/logs.go:102
 msgid "since"
 msgstr ""
 
-#: cli/app/new.go:295
+#: cli/app/new.go:296
 #, c-format
 msgid "single server detected, choosing %s automatically"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:297
+#: cli/catalogue/catalogue.go:300
 msgid "skip updating recipe repositories"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:294
+#: cli/catalogue/catalogue.go:297
 msgid "skip-updates"
 msgstr ""
 
-#: cli/recipe/lint.go:36
+#: cli/recipe/lint.go:37
 msgid "skipped"
 msgstr ""
 
@@ -4370,7 +4440,7 @@ msgstr ""
 msgid "skipping %s based on skip condition"
 msgstr ""
 
-#: cli/recipe/lint.go:53
+#: cli/recipe/lint.go:54
 #, c-format
 msgid "skipping %s, does not have level \"error\""
 msgstr ""
@@ -4383,11 +4453,11 @@ msgstr ""
 msgid "skipping converge logic checks"
 msgstr ""
 
-#: cli/app/deploy.go:180
+#: cli/app/deploy.go:181
 msgid "skipping domain checks"
 msgstr ""
 
-#: cli/app/deploy.go:177
+#: cli/app/deploy.go:178
 msgid "skipping domain checks, no DOMAIN=... configured"
 msgstr ""
 
@@ -4406,35 +4476,36 @@ msgstr ""
 msgid "skipping writing version %s because dry run"
 msgstr ""
 
-#: cli/app/backup.go:231 cli/app/backup.go:255
+#: cli/app/backup.go:236 cli/app/backup.go:260
 msgid "snapshot"
 msgstr ""
 
-#: cli/app/backup.go:178
+#. translators: `app backup snapshots` command
+#: cli/app/backup.go:182
 msgid "snapshots <domain> [flags]"
 msgstr ""
 
-#: cli/app/secret.go:231
+#: cli/app/secret.go:293
 msgid "specify secret file"
 msgstr ""
 
-#: cli/app/secret.go:227
+#: cli/app/secret.go:289
 msgid "specify secret value"
 msgstr ""
 
-#: cli/app/new.go:329
+#: cli/app/new.go:330
 msgid "specify server for new app"
 msgstr ""
 
-#: cli/app/services.go:22
+#: cli/app/services.go:23
 msgid "sr"
 msgstr ""
 
-#: cli/recipe/fetch.go:122
+#: cli/recipe/fetch.go:123
 msgid "ssh"
 msgstr ""
 
-#: cli/server/add.go:107
+#: cli/server/add.go:108
 #, c-format
 msgid "ssh %s error: %s"
 msgstr ""
@@ -4453,17 +4524,17 @@ msgstr ""
 msgid "ssh url: %s, "
 msgstr ""
 
-#: cli/recipe/release.go:445
+#: cli/recipe/release.go:446
 msgid "ssh-agent not found. see \"abra recipe release --help\" and try again"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:85
+#: cli/catalogue/catalogue.go:87
 msgid ""
 "ssh: SSH_AUTH_SOCK missing, --publish/-p will fail. see \"abra catalogue "
 "generate --help\""
 msgstr ""
 
-#: cli/app/list.go:288 cli/recipe/list.go:39
+#: cli/app/list.go:289 cli/recipe/list.go:40
 msgid "status"
 msgstr ""
 
@@ -4472,15 +4543,15 @@ msgstr ""
 msgid "status: %s}"
 msgstr ""
 
-#: cli/app/logs.go:93
+#: cli/app/logs.go:94
 msgid "stderr"
 msgstr ""
 
-#: cli/app/secret.go:498 cli/app/secret.go:522
+#: cli/app/secret.go:542 cli/app/secret.go:566
 msgid "store generated secrets in a local pass store"
 msgstr ""
 
-#: cli/app/new.go:352
+#: cli/app/new.go:353
 msgid "store secrets in a local pass store"
 msgstr ""
 
@@ -4517,11 +4588,13 @@ msgstr ""
 msgid "swarm mode not enabled on local server?"
 msgstr ""
 
-#: cli/recipe/sync.go:22
+#. translators: `recipe sync` command
+#: cli/recipe/sync.go:23
 msgid "sync <recipe> [version] [flags]"
 msgstr ""
 
-#: cli/catalogue/catalogue.go:25
+#. translators: `catalogue sync` command
+#: cli/catalogue/catalogue.go:26
 msgid "sync [flags]"
 msgstr ""
 
@@ -4530,8 +4603,8 @@ msgstr ""
 msgid "synced label %s to service %s"
 msgstr ""
 
-#: cli/app/backup.go:248 cli/app/restore.go:100 cli/app/run.go:103
-#: cli/app/secret.go:536
+#: cli/app/backup.go:253 cli/app/restore.go:101 cli/app/run.go:104
+#: cli/app/secret.go:580
 msgid "t"
 msgstr ""
 
@@ -4539,12 +4612,12 @@ msgstr ""
 msgid "tag all images with stable tags"
 msgstr ""
 
-#: cli/recipe/sync.go:169
+#: cli/recipe/sync.go:170
 #, c-format
 msgid "tag at commit %s is unannotated or otherwise broken"
 msgstr ""
 
-#: cli/recipe/upgrade.go:296
+#: cli/recipe/upgrade.go:297
 #, c-format
 msgid "tag upgraded from %s to %s for %s"
 msgstr ""
@@ -4553,7 +4626,7 @@ msgstr ""
 msgid "tags use semver-like format"
 msgstr ""
 
-#: cli/app/logs.go:104
+#: cli/app/logs.go:105
 msgid "tail logs since YYYY-MM-DDTHH:MM:SSZ"
 msgstr ""
 
@@ -4562,11 +4635,11 @@ msgstr ""
 msgid "tailLogs: unable to copy buffer: %s"
 msgstr ""
 
-#: cli/app/restore.go:99
+#: cli/app/restore.go:100
 msgid "target"
 msgstr ""
 
-#: cli/app/restore.go:102
+#: cli/app/restore.go:103
 msgid "target path"
 msgstr ""
 
@@ -4574,7 +4647,7 @@ msgstr ""
 msgid "test and disable can't be set at the same time"
 msgstr ""
 
-#: cli/recipe/list.go:43
+#: cli/recipe/list.go:44
 msgid "tests"
 msgstr ""
 
@@ -4598,7 +4671,7 @@ msgstr ""
 msgid "timeout: waiting on undeploy tasks (timeout=%v secs)"
 msgstr ""
 
-#: cli/app/backup.go:247
+#: cli/app/backup.go:252
 msgid "timestamps"
 msgstr ""
 
@@ -4614,7 +4687,7 @@ msgstr ""
 msgid "tmpfs options are incompatible with type volume"
 msgstr ""
 
-#: cli/updater/updater.go:501 cli/run.go:125
+#: cli/run.go:127 cli/updater/updater.go:504
 msgid "toggle non-interactive mode"
 msgstr ""
 
@@ -4622,33 +4695,33 @@ msgstr ""
 msgid "traefik routing enabled"
 msgstr ""
 
-#: cli/app/secret.go:530
+#: cli/app/secret.go:574
 msgid "treat input as a file"
 msgstr ""
 
-#: cli/app/secret.go:535
+#: cli/app/secret.go:579
 msgid "trim"
 msgstr ""
 
-#: cli/app/secret.go:538
+#: cli/app/secret.go:582
 msgid "trim input"
 msgstr ""
 
-#: cli/app/new.go:222 pkg/app/app.go:141
+#: cli/app/new.go:223 pkg/app/app.go:141
 #, c-format
 msgid "trimming %s to %s to avoid runtime limits"
 msgstr ""
 
-#: cli/app/cmd.go:264
+#: cli/app/cmd.go:266
 msgid "tty"
 msgstr ""
 
-#: cli/app/cmd.go:257 cli/app/run.go:111 cli/recipe/upgrade.go:42
-#: cli/updater/updater.go:75
+#: cli/app/cmd.go:259 cli/app/run.go:112 cli/recipe/upgrade.go:43
+#: cli/updater/updater.go:77
 msgid "u"
 msgstr ""
 
-#: cli/app/undeploy.go:23
+#: cli/app/undeploy.go:24
 msgid "un"
 msgstr ""
 
@@ -4667,7 +4740,7 @@ msgstr ""
 msgid "unable to clean up git clone of %s: %s"
 msgstr ""
 
-#: cli/app/list.go:148
+#: cli/app/list.go:149
 #, c-format
 msgid "unable to clone %s: %s"
 msgstr ""
@@ -4677,7 +4750,7 @@ msgstr ""
 msgid "unable to connect to %s, please check your SSH config"
 msgstr ""
 
-#: cli/recipe/sync.go:76
+#: cli/recipe/sync.go:77
 msgid "unable to continue, input required for initial version"
 msgstr ""
 
@@ -4686,27 +4759,27 @@ msgstr ""
 msgid "unable to convert timeout label %s to int: %s"
 msgstr ""
 
-#: cli/app/ps.go:165
+#: cli/app/ps.go:166
 #, c-format
 msgid "unable to convert to JSON: %s"
 msgstr ""
 
-#: cli/run.go:49
+#: cli/run.go:50
 #, c-format
 msgid "unable to create %s: %s"
 msgstr ""
 
-#: cli/server/add.go:100
+#: cli/server/add.go:101
 #, c-format
 msgid "unable to create local context: %s"
 msgstr ""
 
-#: cli/recipe/release.go:590
+#: cli/recipe/release.go:591
 #, c-format
 msgid "unable to delete tag %s: %s"
 msgstr ""
 
-#: cli/recipe/upgrade.go:247
+#: cli/recipe/upgrade.go:248
 #, c-format
 msgid "unable to determine versioning semantics of %s, listing all tags"
 msgstr ""
@@ -4716,7 +4789,7 @@ msgstr ""
 msgid "unable to discover .env.sample for %s"
 msgstr ""
 
-#: cli/recipe/fetch.go:64
+#: cli/recipe/fetch.go:65
 #, c-format
 msgid "unable to discover SSH remote for %s"
 msgstr ""
@@ -4740,7 +4813,7 @@ msgstr ""
 msgid "unable to locate git command, cannot output diff"
 msgstr ""
 
-#: cli/recipe/fetch.go:70 pkg/git/read.go:26 pkg/lint/recipe.go:491
+#: cli/recipe/fetch.go:71 pkg/git/read.go:26 pkg/lint/recipe.go:491
 #: pkg/recipe/git.go:236
 #, c-format
 msgid "unable to open %s: %s"
@@ -4751,12 +4824,12 @@ msgstr ""
 msgid "unable to open git work tree in %s: %s"
 msgstr ""
 
-#: cli/recipe/release.go:563 cli/recipe/release.go:585
+#: cli/recipe/release.go:564 cli/recipe/release.go:586
 #, c-format
 msgid "unable to open repo in %s: %s"
 msgstr ""
 
-#: cli/recipe/release.go:568
+#: cli/recipe/release.go:569
 #, c-format
 msgid "unable to open work tree in %s: %s"
 msgstr ""
@@ -4766,7 +4839,7 @@ msgstr ""
 msgid "unable to open worktree of %s: %s"
 msgstr ""
 
-#: cli/recipe/upgrade.go:154
+#: cli/recipe/upgrade.go:155
 #, c-format
 msgid "unable to parse %s, error was: %s, skipping upgrade for %s"
 msgstr ""
@@ -4781,7 +4854,7 @@ msgstr ""
 msgid "unable to parse '%s' value as bool: %s"
 msgstr ""
 
-#: cli/run.go:100
+#: cli/run.go:102
 #, c-format
 msgid "unable to proceed, %s does not exist?"
 msgstr ""
@@ -4796,30 +4869,30 @@ msgstr ""
 msgid "unable to read remotes in %s: %s"
 msgstr ""
 
-#: cli/recipe/upgrade.go:148
+#: cli/recipe/upgrade.go:149
 #, c-format
 msgid "unable to read tag for image %s, is it missing? skipping upgrade for %s"
 msgstr ""
 
-#: cli/recipe/release.go:606
+#: cli/recipe/release.go:607
 #, c-format
 msgid ""
 "unable to read version for %s from synced label. Did you try running \"abra "
 "recipe sync %s\" already?"
 msgstr ""
 
-#: cli/recipe/fetch.go:74
+#: cli/recipe/fetch.go:75
 #, c-format
 msgid "unable to remove default remote in %s: %s"
 msgstr ""
 
-#: cli/app/volume.go:145
+#: cli/app/volume.go:147
 #, c-format
 msgid "unable to remove volume: no volume with name '%s'?"
 msgstr ""
 
-#: cli/app/secret.go:126 cli/app/secret.go:452 cli/recipe/list.go:77
-#: cli/recipe/version.go:106 cli/server/list.go:82
+#: cli/app/secret.go:130 cli/app/secret.go:495 cli/recipe/list.go:78
+#: cli/recipe/version.go:107 cli/server/list.go:83
 #, c-format
 msgid "unable to render to JSON: %s"
 msgstr ""
@@ -4829,12 +4902,12 @@ msgstr ""
 msgid "unable to resolve '%s': %s"
 msgstr ""
 
-#: cli/server/add.go:114
+#: cli/server/add.go:115
 #, c-format
 msgid "unable to resolve IPv4 for %s"
 msgstr ""
 
-#: cli/app/list.go:153
+#: cli/app/list.go:154
 #, c-format
 msgid "unable to retrieve tags for %s: %s"
 msgstr ""
@@ -4844,7 +4917,7 @@ msgstr ""
 msgid "unable to set IO streams as raw terminal: %s"
 msgstr ""
 
-#: cli/recipe/fetch.go:81
+#: cli/recipe/fetch.go:82
 #, c-format
 msgid "unable to set SSH remote in %s: %s"
 msgstr ""
@@ -4854,7 +4927,7 @@ msgstr ""
 msgid "unable to setup input stream: %s"
 msgstr ""
 
-#: cli/recipe/release.go:573
+#: cli/recipe/release.go:574
 #, c-format
 msgid "unable to soft reset %s: %s"
 msgstr ""
@@ -4884,11 +4957,12 @@ msgstr ""
 msgid "undefined volume %q"
 msgstr ""
 
-#: cli/app/undeploy.go:22
+#. translators: `app undeploy` command
+#: cli/app/undeploy.go:23
 msgid "undeploy <domain> [flags]"
 msgstr ""
 
-#: cli/app/undeploy.go:102
+#: cli/app/undeploy.go:103
 msgid "undeploy succeeded 🟢"
 msgstr ""
 
@@ -4912,19 +4986,19 @@ msgstr ""
 msgid "unimplemented call: SetWriteDeadline(%v)"
 msgstr ""
 
-#: cli/app/labels.go:71 cli/app/list.go:111 cli/app/list.go:112
-#: cli/app/list.go:113 cli/app/list.go:114 cli/app/list.go:115
-#: cli/app/list.go:175 cli/app/ps.go:119 cli/app/ps.go:120 cli/app/ps.go:121
-#: cli/app/ps.go:122 cli/app/ps.go:123 cli/server/list.go:59
-#: cli/server/list.go:71
+#: cli/app/labels.go:72 cli/app/list.go:112 cli/app/list.go:113
+#: cli/app/list.go:114 cli/app/list.go:115 cli/app/list.go:116
+#: cli/app/list.go:176 cli/app/ps.go:120 cli/app/ps.go:121 cli/app/ps.go:122
+#: cli/app/ps.go:123 cli/app/ps.go:124 cli/server/list.go:60
+#: cli/server/list.go:72
 msgid "unknown"
 msgstr ""
 
-#: cli/app/rollback.go:142
+#: cli/app/rollback.go:143
 msgid "unknown deployed version, unable to downgrade"
 msgstr ""
 
-#: cli/app/upgrade.go:149
+#: cli/app/upgrade.go:150
 msgid "unknown deployed version, unable to upgrade"
 msgstr ""
 
@@ -4943,16 +5017,16 @@ msgstr ""
 msgid "unknown server, run \"abra server add %s\"?"
 msgstr ""
 
-#: cli/app/cp.go:253
+#: cli/app/cp.go:254
 #, c-format
 msgid "untar: %s"
 msgstr ""
 
-#: cli/app/upgrade.go:30
+#: cli/app/upgrade.go:31
 msgid "up"
 msgstr ""
 
-#: cli/updater/updater.go:556
+#: cli/updater/updater.go:559
 msgid "update all deployed apps"
 msgstr ""
 
@@ -4966,42 +5040,46 @@ msgstr ""
 msgid "updating %s to %s in %s"
 msgstr ""
 
-#: cli/run.go:34
+#: cli/run.go:35
 msgid "upgrade"
 msgstr ""
 
-#: cli/updater/updater.go:444
+#: cli/updater/updater.go:446
 #, c-format
 msgid "upgrade %s (%s) to version %s"
 msgstr ""
 
-#: cli/app/upgrade.go:29
+#. translators: `app upgrade` command
+#: cli/app/upgrade.go:30
 msgid "upgrade <domain> [version] [flags]"
 msgstr ""
 
-#: cli/recipe/upgrade.go:41
+#. translators: `recipe upgrade` command
+#: cli/recipe/upgrade.go:42
 msgid "upgrade <recipe> [flags]"
 msgstr ""
 
-#: cli/updater/updater.go:74
+#. translators: `app upgrade` command
+#: cli/updater/updater.go:76
 msgid "upgrade [[stack] [recipe] | --all] [flags]"
 msgstr ""
 
-#: cli/upgrade.go:16
+#. translators: `upgrade` command
+#: cli/upgrade.go:17
 msgid "upgrade [flags]"
 msgstr ""
 
-#: cli/recipe/upgrade.go:243
+#: cli/recipe/upgrade.go:244
 #, c-format
 msgid "upgrade to which tag? (service: %s, image: %s, tag: %s)"
 msgstr ""
 
-#: cli/recipe/upgrade.go:249
+#: cli/recipe/upgrade.go:250
 #, c-format
 msgid "upgrade to which tag? (service: %s, tag: %s)"
 msgstr ""
 
-#: cli/recipe/upgrade.go:216
+#: cli/recipe/upgrade.go:217
 #, c-format
 msgid "upgrading service %s from %s to %s (pinned tag: %s)"
 msgstr ""
@@ -5010,7 +5088,7 @@ msgstr ""
 msgid "upload your recipe to git.coopcloud.tech/coop-cloud/..."
 msgstr ""
 
-#: cli/recipe/release.go:613
+#: cli/recipe/release.go:614
 #, c-format
 msgid "use %s as the new version?"
 msgstr ""
@@ -5019,7 +5097,7 @@ msgstr ""
 msgid "use a tag for all images"
 msgstr ""
 
-#: cli/server/add.go:202
+#: cli/server/add.go:203
 msgid "use local server"
 msgstr ""
 
@@ -5027,7 +5105,7 @@ msgstr ""
 msgid "use semver-like tags"
 msgstr ""
 
-#: cli/app/cmd.go:256 cli/app/run.go:110
+#: cli/app/cmd.go:258 cli/app/run.go:111
 msgid "user"
 msgstr ""
 
@@ -5035,8 +5113,8 @@ msgstr ""
 msgid "using default abra dir"
 msgstr ""
 
-#: cli/app/backup.go:280 cli/app/restore.go:116 cli/recipe/version.go:18
-#: cli/server/prune.go:99
+#: cli/app/backup.go:285 cli/app/restore.go:117 cli/recipe/version.go:19
+#: cli/server/prune.go:100
 msgid "v"
 msgstr ""
 
@@ -5084,45 +5162,46 @@ msgstr ""
 msgid "version wiped from %s.env"
 msgstr ""
 
-#: cli/app/deploy.go:301
+#: cli/app/deploy.go:302
 #, c-format
 msgid "version: can not redeploy chaos version %s"
 msgstr ""
 
-#: cli/app/deploy.go:288
+#: cli/app/deploy.go:289
 #, c-format
 msgid "version: taking chaos version: %s"
 msgstr ""
 
-#: cli/app/deploy.go:309
+#: cli/app/deploy.go:310
 #, c-format
 msgid "version: taking deployed version: %s"
 msgstr ""
 
-#: cli/app/deploy.go:314
+#: cli/app/deploy.go:315
 #, c-format
 msgid "version: taking new recipe version: %s"
 msgstr ""
 
-#: cli/app/deploy.go:303
+#: cli/app/deploy.go:304
 #, c-format
 msgid "version: taking version from .env file: %s"
 msgstr ""
 
-#: cli/app/deploy.go:294
+#: cli/app/deploy.go:295
 #, c-format
 msgid "version: taking version from cli arg: %s"
 msgstr ""
 
-#: cli/recipe/version.go:17
+#. translators: `recipe versions` command
+#: cli/recipe/version.go:18
 msgid "versions <recipe> [flags]"
 msgstr ""
 
-#: cli/app/volume.go:191
+#: cli/app/volume.go:194
 msgid "vl"
 msgstr ""
 
-#: cli/app/volume.go:153
+#: cli/app/volume.go:155
 #, c-format
 msgid "volume %s removed successfully"
 msgstr ""
@@ -5132,7 +5211,8 @@ msgstr ""
 msgid "volume %s: %s"
 msgstr ""
 
-#: cli/app/volume.go:190
+#. translators: `app volume` command group
+#: cli/app/volume.go:193
 msgid "volume [cmd] [args] [flags]"
 msgstr ""
 
@@ -5152,15 +5232,15 @@ msgstr ""
 msgid "volume type must be volume, bind, tmpfs or npipe"
 msgstr ""
 
-#: cli/app/backup.go:279 cli/app/restore.go:115 cli/server/prune.go:98
+#: cli/app/backup.go:284 cli/app/restore.go:116 cli/server/prune.go:99
 msgid "volumes"
 msgstr ""
 
-#: cli/app/backup.go:266
+#: cli/app/backup.go:271
 msgid "volumes path"
 msgstr ""
 
-#: cli/server/prune.go:75
+#: cli/server/prune.go:76
 #, c-format
 msgid "volumes pruned: %d; space reclaimed: %s"
 msgstr ""
@@ -5196,7 +5276,7 @@ msgstr ""
 msgid "which container are you looking for?"
 msgstr ""
 
-#: cli/app/config.go:42
+#: cli/app/config.go:43
 msgid "which editor do you wish to use?"
 msgstr ""
 
@@ -5204,11 +5284,11 @@ msgstr ""
 msgid "which service are you looking for?"
 msgstr ""
 
-#: cli/recipe/sync.go:98
+#: cli/recipe/sync.go:99
 msgid "which version do you want to begin with?"
 msgstr ""
 
-#: cli/app/volume.go:161
+#: cli/app/volume.go:163
 msgid "which volumes do you want to remove?"
 msgstr ""
 
@@ -5221,33 +5301,33 @@ msgstr ""
 msgid "writer: %v, "
 msgstr ""
 
-#: cli/app/new.go:210 cli/app/rollback.go:225 cli/app/undeploy.go:105
-#: cli/app/upgrade.go:272 cli/app/deploy.go:234
+#: cli/app/deploy.go:235 cli/app/new.go:211 cli/app/rollback.go:226
+#: cli/app/undeploy.go:106 cli/app/upgrade.go:273
 #, c-format
 msgid "writing recipe version failed: %s"
 msgstr ""
 
-#: cli/recipe/release.go:642 cli/recipe/sync.go:271 cli/recipe/upgrade.go:346
+#: cli/recipe/release.go:643 cli/recipe/sync.go:272 cli/recipe/upgrade.go:347
 msgid "x"
 msgstr ""
 
-#: cli/recipe/release.go:650 cli/recipe/sync.go:279 cli/recipe/upgrade.go:354
+#: cli/recipe/release.go:651 cli/recipe/sync.go:280 cli/recipe/upgrade.go:355
 msgid "y"
 msgstr ""
 
-#: cli/recipe/release.go:470
+#: cli/recipe/release.go:471
 msgid "you can only use one of: --major, --minor, --patch"
 msgstr ""
 
-#: cli/recipe/upgrade.go:75
+#: cli/recipe/upgrade.go:76
 msgid "you can only use one of: --major, --minor, --patch."
 msgstr ""
 
-#: cli/recipe/sync.go:194
+#: cli/recipe/sync.go:195
 msgid "you can only use one version flag: --major, --minor or --patch"
 msgstr ""
 
-#: cli/recipe/release.go:658 cli/recipe/sync.go:287 cli/recipe/upgrade.go:362
+#: cli/recipe/release.go:659 cli/recipe/sync.go:288 cli/recipe/upgrade.go:363
 msgid "z"
 msgstr ""