chore(deps): update golang docker tag

Updated by "Update PO files to match POT (msgmerge)" add-on in Weblate.

Translation: Co-op Cloud/abra
Translate-URL: https://translate.coopcloud.tech/projects/co-op-cloud/abra/

.dockerignore

@@ -4,5 +4,4 @@
 Dockerfile
 abra
 dist
-kadabra
 tags

.drone.yml

@@ -3,46 +3,54 @@ kind: pipeline
 name: coopcloud.tech/abra
 steps:
   - name: make check
-    image: golang:1.22
+    image: golang:1.27
     commands:
       - make check
 
+  - name: xgettext-go
+    image: golang:1.27
+    environment:
+      GOPRIVATE: coopcloud.tech
+    commands:
+      - go run git.coopcloud.tech/toolshed/xgettext-go@latest
+        -o pkg/i18n/locales/abra.pot
+        --keyword=i18n.G
+        --keyword-ctx=i18n.GC
+        --sort-output
+        --add-comments-tag="translators"
+        $(find . -name "*.go" -not -path "*vendor*" | sort)
+    depends_on:
+      - make check
+    when:
+      event:
+        exclude:
+          - tag
+
+  - name: xgettext-go status
+    image: golang:1.26-alpine3.22
+    commands:
+      - apk add patchutils git make
+      - cd /drone/src
+      - sed -i "s/charset=CHARSET/charset=UTF-8/g" pkg/i18n/locales/*.pot
+      - git diff pkg/i18n/locales/abra.pot | grepdiff --output-matching=hunk POT-Creation-Date | git apply --reverse --allow-empty
+      - git diff
+      - git diff-files --exit-code
+    depends_on:
+      - xgettext-go
+    when:
+      event:
+        exclude:
+          - tag
+
   - name: make test
-    image: golang:1.22
+    image: golang:1.27
     environment:
-      CATL_URL: https://git.coopcloud.tech/toolshed/recipes-catalogue-json.git
+      ABRA_DIR: /root/.abra_test
     commands:
-      - mkdir -p $HOME/.abra
-      - git clone $CATL_URL $HOME/.abra/catalogue
       - make test
     depends_on:
       - make check
 
-  - name: fetch
-    image: docker:git
-    commands:
-      - git fetch --tags
-    depends_on:
-      - make check
-      - make test
-    when:
-      event: tag
-
-  - name: release
-    image: goreleaser/goreleaser:v2.5.1
-    environment:
-      GITEA_TOKEN:
-        from_secret: goreleaser_gitea_token
-    volumes:
-      - name: deps
-        path: /go
-    commands:
-      - goreleaser release
-    depends_on:
-      - fetch
-    when:
-      event: tag
-
   - name: publish image
     image: plugins/docker
     settings:
@@ -60,7 +68,31 @@ steps:
       - make check
       - make test
 
-  - name: integration test
+  - name: on-demand integration test
+    image: appleboy/drone-ssh
+    settings:
+      host:
+        - int.coopcloud.tech
+      username: abra
+      key:
+        from_secret: abra_int_private_key
+      port: 22
+      command_timeout: 60m
+      script_stop: true
+      request_pty: true
+      script:
+        - |
+          wget https://git.coopcloud.tech/toolshed/abra/raw/branch/main/scripts/tests/run-ci-int -O run-ci-int
+          chmod +x run-ci-int
+          sh run-ci-int
+    when:
+      ref:
+        - refs/heads/int-*
+    depends_on:
+      - make check
+      - make test
+
+  - name: nightly integration test
     image: appleboy/drone-ssh
     settings:
       host:
@@ -87,3 +119,8 @@ steps:
 volumes:
   - name: deps
     temp: {}
+
+trigger:
+  action:
+    exclude:
+      - synchronized

.envrc.sample

@@ -1,6 +1,6 @@
 # integration test suite
 # export ABRA_DIR="$HOME/.abra_test"
-# export ABRA_TEST_DOMAIN=test.example.com
+# export TEST_SERVER=test.example.com
 # export ABRA_CI=1
 
 # release automation

.gitattributes

@@ -0,0 +1 @@
+vendor/** linguist-generated=true

.gitignore

@@ -1,8 +1,9 @@
+*.tar.gz
 *fmtcoverage.html
 .e2e.env
 .envrc
 .vscode/
 /abra
-/kadabra
+/bin
 dist/
 tests/integration/.bats

.goreleaser.yml

@@ -1,4 +1,6 @@
 ---
+version: 2
+
 gitea_urls:
   api: https://git.coopcloud.tech/api/v1
   download: https://git.coopcloud.tech/
@@ -26,31 +28,9 @@ builds:
       - 5
       - 6
       - 7
-    ldflags:
-      - "-X 'main.Commit={{ .Commit }}'"
-      - "-X 'main.Version={{ .Version }}'"
-      - "-s"
-      - "-w"
-
-  - id: kadabra
-    binary: kadabra
-    dir: cmd/kadabra
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - darwin
-    goarch:
-      - 386
-      - amd64
-      - arm
-      - arm64
-    goarm:
-      - 5
-      - 6
-      - 7
-    gcflags:
-      - "all=-l -B"
+    flags:
+      - -v
+      - -trimpath
     ldflags:
       - "-X 'main.Commit={{ .Commit }}'"
       - "-X 'main.Version={{ .Version }}'"

AUTHORS.md

@@ -4,14 +4,23 @@
 > please do add yourself! This is a community project, let's show some 💞
 
 - 3wordchant
+- ammaratef45
+- apfelwurm
+- basebuilder
 - cassowary
+- chasqui
 - codegod100
+- cyrnel
 - decentral1se
 - fauno
 - frando
+- iexos
+- jade
 - kawaiipunk
 - knoflook
+- mayel
 - moritz
+- namnatulco
 - p4u1
 - rix
 - roxxers

Dockerfile

@@ -1,5 +1,5 @@
 # Build image
-FROM golang:1.22-alpine AS build
+FROM golang:1.27-alpine AS build
 
 ENV GOPRIVATE=coopcloud.tech
 
@@ -15,8 +15,7 @@ WORKDIR /app
 
 RUN CGO_ENABLED=0 make build
 
-# Release image ("slim")
-FROM alpine:3.19.1
+FROM alpine:3.24
 
 RUN apk add --no-cache \
   ca-certificates \

Makefile

@@ -1,48 +1,36 @@
 ABRA         := ./cmd/abra
-KADABRA      := ./cmd/kadabra
+XGETTEXT     := go run git.coopcloud.tech/toolshed/xgettext-go@latest
 COMMIT       := $(shell git rev-list -1 HEAD)
 GOPATH       := $(shell go env GOPATH)
-GOVERSION    := 1.22
+GOVERSION    := 1.26
 LDFLAGS      := "-X 'main.Commit=$(COMMIT)'"
 DIST_LDFLAGS := $(LDFLAGS)" -s -w"
+BFLAGS       := -v -trimpath
 GCFLAGS      := "all=-l -B"
+DOMAIN       := abra
+POFILES      := $(wildcard pkg/i18n/locales/*.po)
+MOFILES      := $(patsubst %.po,%.mo,$(POFILES))
+LINGUAS      := $(basename $(POFILES))
 
 export GOPRIVATE=coopcloud.tech
 
-# NOTE(d1): default `make` optimised for Abra hacking
-all: format check build-abra test
+all: format check build
 
-run-abra:
+run:
 	@go run -gcflags=$(GCFLAGS) -ldflags=$(LDFLAGS) $(ABRA)
 
-run-kadabra:
-	@go run -gcflags=$(GCFLAGS) -ldflags=$(LDFLAGS) $(KADABRA)
-
-install-abra:
+install:
 	@go install -gcflags=$(GCFLAGS) -ldflags=$(LDFLAGS) $(ABRA)
 
-install-kadabra:
-	@go install -gcflags=$(GCFLAGS) -ldflags=$(LDFLAGS) $(KADABRA)
+build:
+	@go build $(BFLAGS) -gcflags=$(GCFLAGS) -ldflags=$(DIST_LDFLAGS) $(ABRA)
 
-install: install-abra install-kadabra
-
-build-abra:
-	@go build -v -gcflags=$(GCFLAGS) -ldflags=$(DIST_LDFLAGS) $(ABRA)
-
-build-kadabra:
-	@go build -v -gcflags=$(GCFLAGS) -ldflags=$(DIST_LDFLAGS) $(KADABRA)
-
-build: build-abra build-kadabra
-
-build-docker-abra:
+build-docker:
 	@docker run -it -v $(PWD):/abra golang:$(GOVERSION) \
 		bash -c 'cd /abra; ./scripts/docker/build.sh'
 
-build-docker: build-docker-abra
-
 clean:
 	@rm '$(GOPATH)/bin/abra'
-	@rm '$(GOPATH)/bin/kadabra'
 
 format:
 	@gofmt -s -w $$(find . -type f -name '*.go' | grep -v "/vendor/")
@@ -52,10 +40,47 @@ check:
 	(echo "gofmt: formatting issue - run 'make format' to resolve" && exit 1)
 
 test:
-	@go test ./... -cover -v
+	@go test ./... -cover -v -p 1
+
+find-tests:
+	@find . -name "*_test.go"
 
 loc:
 	@find . -name "*.go" | xargs wc -l
 
 deps:
 	@go get -t -u ./...
+
+.PHONY: i18n
+i18n: update-pot update-pot-po-metadata update-po build-mo
+
+.PHONY: update-po
+update-po:
+	@set -eu; \
+	for lang in $(LINGUAS); do \
+		msgmerge --backup=none -U $$lang.po pkg/i18n/locales/$(DOMAIN).pot; \
+	done
+
+.PHONY: update-pot
+update-pot:
+	@$(XGETTEXT) \
+		-o pkg/i18n/locales/$(DOMAIN).pot \
+		--keyword=i18n.G \
+		--keyword-ctx=i18n.GC \
+		--sort-output \
+		--add-comments-tag="translators" \
+		$$(find . -name "*.go" -not -path "*vendor*" | sort)
+
+.PHONY: update-pot-po-metadata
+update-pot-po-metadata:
+	@sed -i "s/charset=CHARSET/charset=UTF-8/g" pkg/i18n/locales/*.po pkg/i18n/locales/*.pot
+
+.PHONY: build-mo
+build-mo:
+	@set -eu; \
+	for lang in $(POFILES); do \
+		msgfmt $$lang -o $$(echo $$lang | sed 's/.po/.mo/g') --statistics; \
+	done
+
+release:
+	@goreleaser release --clean

README.md

@@ -3,6 +3,7 @@
 [![Build Status](https://build.coopcloud.tech/api/badges/toolshed/abra/status.svg?ref=refs/heads/main)](https://build.coopcloud.tech/toolshed/abra)
 [![Go Report Card](https://goreportcard.com/badge/git.coopcloud.tech/toolshed/abra)](https://goreportcard.com/report/git.coopcloud.tech/toolshed/abra)
 [![Go Reference](https://pkg.go.dev/badge/coopcloud.tech/abra.svg)](https://pkg.go.dev/coopcloud.tech/abra)
+[![Translation status](https://translate.coopcloud.tech/widget/co-op-cloud/svg-badge.svg)](https://translate.coopcloud.tech/engage/co-op-cloud/)
 
 The Co-op Cloud utility belt 🎩🐇
 

cli/app/app.go

@@ -1,11 +1,20 @@
 package app
 
 import (
+	"strings"
+
+	"coopcloud.tech/abra/pkg/i18n"
 	"github.com/spf13/cobra"
 )
 
+// translators: `abra app` aliases. use a comma separated list of aliases with
+// no spaces in between
+var appAliases = i18n.GC("a", "abra app")
+
 var AppCommand = &cobra.Command{
-	Use:     "app [cmd] [args] [flags]",
-	Aliases: []string{"a"},
-	Short:   "Manage apps",
+	// translators: `app` command group
+	Use:     i18n.G("app [cmd] [args] [flags]"),
+	Aliases: strings.Split(appAliases, ","),
+	// translators: Short description for `app` command group
+	Short: i18n.G("Manage apps"),
 }

cli/app/backup.go

@@ -2,19 +2,27 @@ package app
 
 import (
 	"fmt"
+	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
+	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
 	"github.com/spf13/cobra"
 )
 
+// translators: `abra app backup list` aliases. use a comma separated list of aliases with
+// no spaces in between
+var appBackupListAliases = i18n.G("ls")
+
 var AppBackupListCommand = &cobra.Command{
-	Use:     "list <domain> [flags]",
-	Aliases: []string{"ls"},
-	Short:   "List the contents of a snapshot",
-	Args:    cobra.ExactArgs(1),
+	// translators: `app backup list` command
+	Use:     i18n.G("list <domain> [flags]"),
+	Aliases: strings.Split(appBackupListAliases, ","),
+	// translators: Short description for `app backup list` command
+	Short: i18n.G("List the contents of a snapshot"),
+	Args:  cobra.ExactArgs(1),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
@@ -40,17 +48,17 @@ var AppBackupListCommand = &cobra.Command{
 		}
 
 		if snapshot != "" {
-			log.Debugf("including SNAPSHOT=%s in backupbot exec invocation", snapshot)
+			log.Debug(i18n.G("including SNAPSHOT=%s in backupbot exec invocation", snapshot))
 			execEnv = append(execEnv, fmt.Sprintf("SNAPSHOT=%s", snapshot))
 		}
 
 		if showAllPaths {
-			log.Debugf("including SHOW_ALL=%v in backupbot exec invocation", showAllPaths)
+			log.Debug(i18n.G("including SHOW_ALL=%v in backupbot exec invocation", showAllPaths))
 			execEnv = append(execEnv, fmt.Sprintf("SHOW_ALL=%v", showAllPaths))
 		}
 
 		if timestamps {
-			log.Debugf("including TIMESTAMPS=%v in backupbot exec invocation", timestamps)
+			log.Debug(i18n.G("including TIMESTAMPS=%v in backupbot exec invocation", timestamps))
 			execEnv = append(execEnv, fmt.Sprintf("TIMESTAMPS=%v", timestamps))
 		}
 
@@ -60,14 +68,20 @@ var AppBackupListCommand = &cobra.Command{
 	},
 }
 
+// translators: `abra app backup download` aliases. use a comma separated list of aliases with
+// no spaces in between
+var appBackupDownloadAliases = i18n.G("d")
+
 var AppBackupDownloadCommand = &cobra.Command{
-	Use:     "download <domain> [flags]",
-	Aliases: []string{"d"},
-	Short:   "Download a snapshot",
-	Long: `Downloads a backup.tar.gz to the current working directory.
+	// translators: `app backup download` command
+	Use:     i18n.G("download <domain> [flags]"),
+	Aliases: strings.Split(appBackupDownloadAliases, ","),
+	// translators: Short description for `app backup download` command
+	Short: i18n.G("Download a snapshot"),
+	Long: i18n.G(`Downloads a backup.tar.gz to the current working directory.
 
 "--volumes/-v" includes data contained in volumes alongide paths specified in
-"backupbot.backup.path" labels.`,
+"backupbot.backup.path" labels.`),
 	Args: cobra.ExactArgs(1),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
@@ -98,22 +112,22 @@ var AppBackupDownloadCommand = &cobra.Command{
 		}
 
 		if snapshot != "" {
-			log.Debugf("including SNAPSHOT=%s in backupbot exec invocation", snapshot)
+			log.Debug(i18n.G("including SNAPSHOT=%s in backupbot exec invocation", snapshot))
 			execEnv = append(execEnv, fmt.Sprintf("SNAPSHOT=%s", snapshot))
 		}
 
 		if includePath != "" {
-			log.Debugf("including INCLUDE_PATH=%s in backupbot exec invocation", includePath)
+			log.Debug(i18n.G("including INCLUDE_PATH=%s in backupbot exec invocation", includePath))
 			execEnv = append(execEnv, fmt.Sprintf("INCLUDE_PATH=%s", includePath))
 		}
 
 		if includeSecrets {
-			log.Debugf("including SECRETS=%v in backupbot exec invocation", includeSecrets)
+			log.Debug(i18n.G("including SECRETS=%v in backupbot exec invocation", includeSecrets))
 			execEnv = append(execEnv, fmt.Sprintf("SECRETS=%v", includeSecrets))
 		}
 
 		if includeVolumes {
-			log.Debugf("including VOLUMES=%v in backupbot exec invocation", includeVolumes)
+			log.Debug(i18n.G("including VOLUMES=%v in backupbot exec invocation", includeVolumes))
 			execEnv = append(execEnv, fmt.Sprintf("VOLUMES=%v", includeVolumes))
 		}
 
@@ -129,11 +143,17 @@ var AppBackupDownloadCommand = &cobra.Command{
 	},
 }
 
+// translators: `abra app backup create` aliases. use a comma separated list of aliases with
+// no spaces in between
+var appBackupCreateAliases = i18n.G("c")
+
 var AppBackupCreateCommand = &cobra.Command{
-	Use:     "create <domain> [flags]",
-	Aliases: []string{"c"},
-	Short:   "Create a new snapshot",
-	Args:    cobra.ExactArgs(1),
+	// translators: `app backup create` command
+	Use:     i18n.G("create <domain> [flags]"),
+	Aliases: strings.Split(appBackupCreateAliases, ","),
+	// translators: Short description for `app backup create` command
+	Short: i18n.G("Create a new snapshot"),
+	Args:  cobra.ExactArgs(1),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
@@ -163,7 +183,7 @@ var AppBackupCreateCommand = &cobra.Command{
 		}
 
 		if retries != "" {
-			log.Debugf("including RETRIES=%s in backupbot exec invocation", retries)
+			log.Debug(i18n.G("including RETRIES=%s in backupbot exec invocation", retries))
 			execEnv = append(execEnv, fmt.Sprintf("RETRIES=%s", retries))
 		}
 
@@ -173,11 +193,17 @@ var AppBackupCreateCommand = &cobra.Command{
 	},
 }
 
+// translators: `abra app backup snapshots` aliases. use a comma separated list of aliases with
+// no spaces in between
+var appBackupSnapshotsAliases = i18n.G("s")
+
 var AppBackupSnapshotsCommand = &cobra.Command{
-	Use:     "snapshots <domain> [flags]",
-	Aliases: []string{"s"},
-	Short:   "List all snapshots",
-	Args:    cobra.ExactArgs(1),
+	// translators: `app backup snapshots` command
+	Use:     i18n.G("snapshots <domain> [flags]"),
+	Aliases: strings.Split(appBackupSnapshotsAliases, ","),
+	// translators: Short description for `app backup snapshots` command
+	Short: i18n.G("List all snapshots"),
+	Args:  cobra.ExactArgs(1),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
@@ -208,10 +234,16 @@ var AppBackupSnapshotsCommand = &cobra.Command{
 	},
 }
 
+// translators: `abra app backup` aliases. use a comma separated list of aliases with
+// no spaces in between
+var appBackupAliases = i18n.G("b")
+
 var AppBackupCommand = &cobra.Command{
-	Use:     "backup [cmd] [args] [flags]",
-	Aliases: []string{"b"},
-	Short:   "Manage app backups",
+	// translators: `app backup` command group
+	Use:     i18n.G("backup [cmd] [args] [flags]"),
+	Aliases: strings.Split(appBackupAliases, ","),
+	// translators: Short description for `app backup` command group
+	Short: i18n.G("Manage app backups"),
 }
 
 var (
@@ -227,81 +259,81 @@ var (
 func init() {
 	AppBackupListCommand.Flags().StringVarP(
 		&snapshot,
-		"snapshot",
-		"s",
+		i18n.G("snapshot"),
+		i18n.G("s"),
 		"",
-		"list specific snapshot",
+		i18n.G("list specific snapshot"),
 	)
 
 	AppBackupListCommand.Flags().BoolVarP(
 		&showAllPaths,
-		"all",
-		"a",
+		i18n.G("all"),
+		i18n.GC("a", "app backup list"),
 		false,
-		"show all paths",
+		i18n.G("show all paths"),
 	)
 
 	AppBackupListCommand.Flags().BoolVarP(
 		&timestamps,
-		"timestamps",
-		"t",
+		i18n.G("timestamps"),
+		i18n.G("t"),
 		false,
-		"include timestamps",
+		i18n.G("include timestamps"),
 	)
 
 	AppBackupDownloadCommand.Flags().StringVarP(
 		&snapshot,
-		"snapshot",
-		"s",
+		i18n.G("snapshot"),
+		i18n.G("s"),
 		"",
-		"list specific snapshot",
+		i18n.G("list specific snapshot"),
 	)
 
 	AppBackupDownloadCommand.Flags().StringVarP(
 		&includePath,
-		"path",
-		"p",
+		i18n.G("path"),
+		i18n.G("p"),
 		"",
-		"volumes path",
+		i18n.G("volumes path"),
 	)
 
 	AppBackupDownloadCommand.Flags().BoolVarP(
 		&includeSecrets,
-		"secrets",
-		"S",
+		i18n.G("secrets"),
+		i18n.G("S"),
 		false,
-		"include secrets",
+		i18n.G("include secrets"),
 	)
 
 	AppBackupDownloadCommand.Flags().BoolVarP(
 		&includeVolumes,
-		"volumes",
-		"v",
+		i18n.G("volumes"),
+		i18n.G("v"),
 		false,
-		"include volumes",
+		i18n.G("include volumes"),
 	)
 
 	AppBackupDownloadCommand.Flags().BoolVarP(
 		&internal.Chaos,
-		"chaos",
-		"C",
+		i18n.G("chaos"),
+		i18n.G("C"),
 		false,
-		"ignore uncommitted recipes changes",
+		i18n.G("ignore uncommitted recipes changes"),
 	)
 
 	AppBackupCreateCommand.Flags().StringVarP(
 		&retries,
-		"retries",
-		"r",
+		i18n.G("retries"),
+		i18n.G("r"),
 		"1",
-		"number of retry attempts",
+		i18n.G("number of retry attempts"),
 	)
 
 	AppBackupCreateCommand.Flags().BoolVarP(
 		&internal.Chaos,
-		"chaos",
-		"C",
+		i18n.G("chaos"),
+		i18n.G("C"),
 		false,
-		"ignore uncommitted recipes changes",
+		i18n.G("ignore uncommitted recipes changes"),
 	)
 }

cli/app/check.go

@@ -2,21 +2,29 @@ package app
 
 import (
 	"fmt"
+	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
 	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/formatter"
+	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
 	"github.com/charmbracelet/lipgloss"
 	"github.com/spf13/cobra"
 )
 
+// translators: `abra app check` aliases. use a comma separated list of aliases with
+// no spaces in between
+var appCheckAliases = i18n.G("chk")
+
 var AppCheckCommand = &cobra.Command{
-	Use:     "check <domain> [flags]",
-	Aliases: []string{"chk"},
-	Short:   "Ensure an app is well configured",
-	Long: `Compare env vars in both the app ".env" and recipe ".env.sample" file.
+	// translators: `app check` command
+	Use:     i18n.G("check <domain> [flags]"),
+	Aliases: strings.Split(appCheckAliases, ","),
+	// translators: Short description for `app check` command
+	Short: i18n.G("Ensure an app is well configured"),
+	Long: i18n.G(`Compare env vars in both the app ".env" and recipe ".env.sample" file.
 
 The goal is to ensure that recipe ".env.sample" env vars are defined in your
 app ".env" file. Only env var definitions in the ".env.sample" which are
@@ -25,7 +33,7 @@ these env vars, then "check" will complain.
 
 Recipe maintainers may or may not provide defaults for env vars within their
 recipes regardless of commenting or not (e.g. through the use of
-${FOO:<default>} syntax). "check" does not confirm or deny this for you.`,
+${FOO:<default>} syntax). "check" does not confirm or deny this for you.`),
 	Args: cobra.ExactArgs(1),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
@@ -83,9 +91,9 @@ ${FOO:<default>} syntax). "check" does not confirm or deny this for you.`,
 func init() {
 	AppCheckCommand.Flags().BoolVarP(
 		&internal.Chaos,
-		"chaos",
-		"C",
+		i18n.G("chaos"),
+		i18n.G("C"),
 		false,
-		"ignore uncommitted recipes changes",
+		i18n.G("ignore uncommitted recipes changes"),
 	)
 }

cli/app/cmd.go

@@ -13,15 +13,22 @@ import (
 	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
+	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
 	"github.com/spf13/cobra"
 )
 
+// translators: `abra app cmd` aliases. use a comma separated list of aliases with
+// no spaces in between
+var appCmdAliases = i18n.G("cmd")
+
 var AppCmdCommand = &cobra.Command{
-	Use:     "command <domain> [service | --local] <cmd> [[args] [flags] | [flags] -- [args]]",
-	Aliases: []string{"cmd"},
-	Short:   "Run app commands",
-	Long: `Run an app specific command.
+	// translators: `app command` command
+	Use:     i18n.G("command <domain> [service | --local] <cmd> [[args] [flags] | [flags] -- [args]]"),
+	Aliases: strings.Split(appCmdAliases, ","),
+	// translators: Short description for `app cmd` command
+	Short: i18n.G("Run app commands"),
+	Long: i18n.G(`Run an app specific command.
 
 These commands are bash functions, defined in the abra.sh of the recipe itself.
 They can be run within the context of a service (e.g. app) or locally on your
@@ -30,24 +37,24 @@ work station by passing "--local/-l".
 N.B. If using the "--" style to pass arguments, flags (e.g. "--local/-l") must
 be passed *before* the "--". It is possible to pass arguments without the "--"
 as long as no dashes are present (i.e. "foo" works without "--", "-foo"
-does not).`,
-	Example: `  # pass <cmd> args/flags without "--"
+does not).`),
+	Example: i18n.G(`  # pass <cmd> args/flags without "--"
   abra app cmd 1312.net app my_cmd_arg foo --user bar
 
   # pass <cmd> args/flags with "--"
   abra app cmd 1312.net app my_cmd_args --user bar -- foo -vvv
 
   # drop the [service] arg if using "--local/-l"
-  abra app cmd 1312.net my_cmd --local`,
+  abra app cmd 1312.net my_cmd --local`),
 	Args: func(cmd *cobra.Command, args []string) error {
 		if local {
 			if !(len(args) >= 2) {
-				return errors.New("requires at least 2 arguments with --local/-l")
+				return errors.New(i18n.G("requires at least 2 arguments with --local/-l"))
 			}
 
 			if slices.Contains(os.Args, "--") {
 				if cmd.ArgsLenAtDash() > 2 {
-					return errors.New("accepts at most 2 args with --local/-l")
+					return errors.New(i18n.G("accepts at most 2 args with --local/-l"))
 				}
 			}
 
@@ -63,7 +70,7 @@ does not).`,
 		}
 
 		if !(len(args) >= 3) {
-			return errors.New("requires at least 3 arguments")
+			return errors.New(i18n.G("requires at least 3 arguments"))
 		}
 
 		return nil
@@ -97,14 +104,14 @@ does not).`,
 		}
 
 		if local && remoteUser != "" {
-			log.Fatal("cannot use --local & --user together")
+			log.Fatal(i18n.G("cannot use --local & --user together"))
 		}
 
 		hasCmdArgs, parsedCmdArgs := parseCmdArgs(args, local)
 
 		if _, err := os.Stat(app.Recipe.AbraShPath); err != nil {
 			if os.IsNotExist(err) {
-				log.Fatalf("%s does not exist for %s?", app.Recipe.AbraShPath, app.Name)
+				log.Fatal(i18n.G("%s does not exist for %s?", app.Recipe.AbraShPath, app.Name))
 			}
 			log.Fatal(err)
 		}
@@ -115,7 +122,7 @@ does not).`,
 				log.Fatal(err)
 			}
 
-			log.Debugf("--local detected, running %s on local work station", cmdName)
+			log.Debug(i18n.G("--local detected, running %s on local work station", cmdName))
 
 			var exportEnv string
 			for k, v := range app.Env {
@@ -124,16 +131,16 @@ does not).`,
 
 			var sourceAndExec string
 			if hasCmdArgs {
-				log.Debugf("parsed following command arguments: %s", parsedCmdArgs)
+				log.Debug(i18n.G("parsed following command arguments: %s", parsedCmdArgs))
 				sourceAndExec = fmt.Sprintf("TARGET=local; APP_NAME=%s; STACK_NAME=%s; %s . %s; %s %s", app.Name, app.StackName(), exportEnv, app.Recipe.AbraShPath, cmdName, parsedCmdArgs)
 			} else {
-				log.Debug("did not detect any command arguments")
+				log.Debug(i18n.G("did not detect any command arguments"))
 				sourceAndExec = fmt.Sprintf("TARGET=local; APP_NAME=%s; STACK_NAME=%s; %s . %s; %s", app.Name, app.StackName(), exportEnv, app.Recipe.AbraShPath, cmdName)
 			}
 
 			shell := "/bin/bash"
 			if _, err := os.Stat(shell); errors.Is(err, os.ErrNotExist) {
-				log.Debugf("%s does not exist locally, use /bin/sh as fallback", shell)
+				log.Debug(i18n.G("%s does not exist locally, use /bin/sh as fallback", shell))
 				shell = "/bin/sh"
 			}
 			cmd := exec.Command(shell, "-c", sourceAndExec)
@@ -164,15 +171,15 @@ does not).`,
 		}
 
 		if !matchingServiceName {
-			log.Fatalf("no service %s for %s?", targetServiceName, app.Name)
+			log.Fatal(i18n.G("no service %s for %s?", targetServiceName, app.Name))
 		}
 
-		log.Debugf("running command %s within the context of %s_%s", cmdName, app.StackName(), targetServiceName)
+		log.Debug(i18n.G("running command %s within the context of %s_%s", cmdName, app.StackName(), targetServiceName))
 
 		if hasCmdArgs {
-			log.Debugf("parsed following command arguments: %s", parsedCmdArgs)
+			log.Debug(i18n.G("parsed following command arguments: %s", parsedCmdArgs))
 		} else {
-			log.Debug("did not detect any command arguments")
+			log.Debug(i18n.G("did not detect any command arguments"))
 		}
 
 		cl, err := client.New(app.Server)
@@ -183,7 +190,7 @@ does not).`,
 		if err := internal.RunCmdRemote(
 			cl,
 			app,
-			requestTTY,
+			disableTTY,
 			app.Recipe.AbraShPath,
 			targetServiceName, cmdName, parsedCmdArgs, remoteUser); err != nil {
 			log.Fatal(err)
@@ -191,11 +198,17 @@ does not).`,
 	},
 }
 
+// translators: `abra app command list` aliases. use a comma separated list of
+// aliases with no spaces in between
+var appCmdListAliases = i18n.G("ls")
+
 var AppCmdListCommand = &cobra.Command{
-	Use:     "list <domain> [flags]",
-	Aliases: []string{"ls"},
-	Short:   "List all available commands",
-	Args:    cobra.MinimumNArgs(1),
+	// translators: `app cmd list` command
+	Use:     i18n.G("list <domain> [flags]"),
+	Aliases: strings.Split(appCmdListAliases, ","),
+	// translators: Short description for `app cmd list` command
+	Short: i18n.G("List all available commands"),
+	Args:  cobra.MinimumNArgs(1),
 	Run: func(cmd *cobra.Command, args []string) {
 		app := internal.ValidateApp(args)
 
@@ -238,39 +251,39 @@ func parseCmdArgs(args []string, isLocal bool) (bool, string) {
 var (
 	local      bool
 	remoteUser string
-	requestTTY bool
+	disableTTY bool
 )
 
 func init() {
 	AppCmdCommand.Flags().BoolVarP(
 		&local,
-		"local",
-		"l",
+		i18n.G("local"),
+		i18n.G("l"),
 		false,
-		"run command locally",
+		i18n.G("run command locally"),
 	)
 
 	AppCmdCommand.Flags().StringVarP(
 		&remoteUser,
-		"user",
-		"u",
+		i18n.G("user"),
+		i18n.G("u"),
 		"",
-		"request remote user",
+		i18n.G("request remote user"),
 	)
 
 	AppCmdCommand.Flags().BoolVarP(
-		&requestTTY,
-		"tty",
-		"t",
+		&disableTTY,
+		i18n.G("tty"),
+		i18n.G("T"),
 		false,
-		"request remote TTY",
+		i18n.G("disable remote TTY"),
 	)
 
 	AppCmdCommand.Flags().BoolVarP(
 		&internal.Chaos,
-		"chaos",
-		"C",
+		i18n.G("chaos"),
+		i18n.G("C"),
 		false,
-		"ignore uncommitted recipes changes",
+		i18n.G("ignore uncommitted recipes changes"),
 	)
 }

cli/app/config.go

@@ -3,19 +3,27 @@ package app
 import (
 	"os"
 	"os/exec"
+	"strings"
 
 	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/autocomplete"
+	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/spf13/cobra"
 )
 
+// translators: `abra app config` aliases. use a comma separated list of
+// aliases with no spaces in between
+var appConfigAliases = i18n.G("cfg")
+
 var AppConfigCommand = &cobra.Command{
-	Use:     "config <domain> [flags]",
-	Aliases: []string{"cfg"},
-	Short:   "Edit app config",
-	Example: "  abra config 1312.net",
+	// translators: `app config` command
+	Use:     i18n.G("config <domain> [flags]"),
+	Aliases: strings.Split(appConfigAliases, ","),
+	// translators: Short description for `app config` command
+	Short:   i18n.G("Edit app config"),
+	Example: i18n.G("  abra config 1312.net"),
 	Args:    cobra.ExactArgs(1),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
@@ -32,13 +40,13 @@ var AppConfigCommand = &cobra.Command{
 		appName := args[0]
 		appFile, exists := files[appName]
 		if !exists {
-			log.Fatalf("cannot find app with name %s", appName)
+			log.Fatal(i18n.G("cannot find app with name %s", appName))
 		}
 
 		ed, ok := os.LookupEnv("EDITOR")
 		if !ok {
 			edPrompt := &survey.Select{
-				Message: "which editor do you wish to use?",
+				Message: i18n.G("which editor do you wish to use?"),
 				Options: []string{"vi", "vim", "nvim", "nano", "pico", "emacs"},
 			}
 			if err := survey.AskOne(edPrompt, &ed); err != nil {

cli/app/cp.go

@@ -3,7 +3,6 @@ package app
 import (
 	"context"
 	"errors"
-	"fmt"
 	"io"
 	"os"
 	"path"
@@ -15,25 +14,32 @@ import (
 	"coopcloud.tech/abra/pkg/client"
 	containerPkg "coopcloud.tech/abra/pkg/container"
 	"coopcloud.tech/abra/pkg/formatter"
+	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/upstream/container"
 	"github.com/docker/cli/cli/command"
-	"github.com/docker/docker/api/types"
+	containertypes "github.com/docker/docker/api/types/container"
 	dockerClient "github.com/docker/docker/client"
 	"github.com/docker/docker/errdefs"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/spf13/cobra"
 )
 
+// translators: `abra app cp` aliases. use a comma separated list of aliases with
+// no spaces in between
+var appCpAliases = i18n.G("c")
+
 var AppCpCommand = &cobra.Command{
-	Use:     "cp <domain> <src> <dst> [flags]",
-	Aliases: []string{"c"},
-	Short:   "Copy files to/from a deployed app service",
-	Example: `  # copy myfile.txt to the root of the app service
+	// translators: `app cp` command
+	Use:     i18n.G("cp <domain> <src> <dst> [flags]"),
+	Aliases: strings.Split(appCpAliases, ","),
+	// translators: Short description for `app cp` command
+	Short: i18n.G("Copy files to/from a deployed app service"),
+	Example: i18n.G(`  # copy myfile.txt to the root of the app service
   abra app cp 1312.net myfile.txt app:/
 
   # copy that file back to your current working directory locally
-  abra app cp 1312.net app:/myfile.txt`,
+  abra app cp 1312.net app:/myfile.txt ./`),
 	Args: cobra.ExactArgs(3),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
@@ -69,7 +75,7 @@ var AppCpCommand = &cobra.Command{
 		if err != nil {
 			log.Fatal(err)
 		}
-		log.Debugf("retrieved %s as target container on %s", formatter.ShortenID(container.ID), app.Server)
+		log.Debug(i18n.G("retrieved %s as target container on %s", formatter.ShortenID(container.ID), app.Server))
 
 		if toContainer {
 			err = CopyToContainer(cl, container.ID, srcPath, dstPath)
@@ -82,7 +88,7 @@ var AppCpCommand = &cobra.Command{
 	},
 }
 
-var errServiceMissing = errors.New("one of <src>/<dest> arguments must take $SERVICE:$PATH form")
+var errServiceMissing = errors.New(i18n.G("one of <src>/<dest> arguments must take $SERVICE:$PATH form"))
 
 // parseSrcAndDst parses src and dest string. One of src or dst must be of the form $SERVICE:$PATH
 func parseSrcAndDst(src, dst string) (srcPath string, dstPath string, service string, toContainer bool, err error) {
@@ -105,7 +111,7 @@ func parseSrcAndDst(src, dst string) (srcPath string, dstPath string, service st
 func CopyToContainer(cl *dockerClient.Client, containerID, srcPath, dstPath string) error {
 	srcStat, err := os.Stat(srcPath)
 	if err != nil {
-		return fmt.Errorf("local %s ", err)
+		return errors.New(i18n.G("local %s ", err))
 	}
 
 	dstStat, err := cl.ContainerStatPath(context.Background(), containerID, dstPath)
@@ -114,7 +120,7 @@ func CopyToContainer(cl *dockerClient.Client, containerID, srcPath, dstPath stri
 		if errdefs.IsNotFound(err) {
 			dstExists = false
 		} else {
-			return fmt.Errorf("remote path: %s", err)
+			return errors.New(i18n.G("remote path: %s", err))
 		}
 	}
 
@@ -134,7 +140,7 @@ func CopyToContainer(cl *dockerClient.Client, containerID, srcPath, dstPath stri
 		if err != nil {
 			return err
 		}
-		if _, err := container.RunExec(dcli, cl, containerID, &types.ExecConfig{
+		if _, err := container.RunExec(dcli, cl, containerID, &containertypes.ExecOptions{
 			AttachStderr: true,
 			AttachStdin:  true,
 			AttachStdout: true,
@@ -142,7 +148,7 @@ func CopyToContainer(cl *dockerClient.Client, containerID, srcPath, dstPath stri
 			Detach:       false,
 			Tty:          true,
 		}); err != nil {
-			return fmt.Errorf("create remote directory: %s", err)
+			return errors.New(i18n.G("create remote directory: %s", err))
 		}
 	case CopyModeFileToFile:
 		// Remove the file component from the path, since docker can only copy
@@ -161,8 +167,8 @@ func CopyToContainer(cl *dockerClient.Client, containerID, srcPath, dstPath stri
 		return err
 	}
 
-	log.Debugf("copy %s from local to %s on container", srcPath, dstPath)
-	copyOpts := types.CopyToContainerOptions{AllowOverwriteDirWithFile: false, CopyUIDGID: false}
+	log.Debug(i18n.G("copy %s from local to %s on container", srcPath, dstPath))
+	copyOpts := containertypes.CopyToContainerOptions{AllowOverwriteDirWithFile: false, CopyUIDGID: false}
 	if err := cl.CopyToContainer(context.Background(), containerID, dstPath, content, copyOpts); err != nil {
 		return err
 	}
@@ -173,7 +179,7 @@ func CopyToContainer(cl *dockerClient.Client, containerID, srcPath, dstPath stri
 		if err != nil {
 			return err
 		}
-		if _, err := container.RunExec(dcli, cl, containerID, &types.ExecConfig{
+		if _, err := container.RunExec(dcli, cl, containerID, &containertypes.ExecOptions{
 			AttachStderr: true,
 			AttachStdin:  true,
 			AttachStdout: true,
@@ -181,7 +187,7 @@ func CopyToContainer(cl *dockerClient.Client, containerID, srcPath, dstPath stri
 			Detach:       false,
 			Tty:          true,
 		}); err != nil {
-			return fmt.Errorf("create remote directory: %s", err)
+			return errors.New(i18n.G("create remote directory: %s", err))
 		}
 	}
 
@@ -194,9 +200,9 @@ func CopyFromContainer(cl *dockerClient.Client, containerID, srcPath, dstPath st
 	srcStat, err := cl.ContainerStatPath(context.Background(), containerID, srcPath)
 	if err != nil {
 		if errdefs.IsNotFound(err) {
-			return fmt.Errorf("remote: %s does not exist", srcPath)
+			return errors.New(i18n.G("remote: %s does not exist", srcPath))
 		} else {
-			return fmt.Errorf("remote path: %s", err)
+			return errors.New(i18n.G("remote path: %s", err))
 		}
 	}
 
@@ -207,7 +213,7 @@ func CopyFromContainer(cl *dockerClient.Client, containerID, srcPath, dstPath st
 		if os.IsNotExist(err) {
 			dstExists = false
 		} else {
-			return fmt.Errorf("remote path: %s", err)
+			return errors.New(i18n.G("remote path: %s", err))
 		}
 	} else {
 		dstMode = dstStat.Mode()
@@ -242,7 +248,7 @@ func CopyFromContainer(cl *dockerClient.Client, containerID, srcPath, dstPath st
 
 	content, _, err := cl.CopyFromContainer(context.Background(), containerID, srcPath)
 	if err != nil {
-		return fmt.Errorf("copy: %s", err)
+		return errors.New(i18n.G("copy: %s", err))
 	}
 	defer content.Close()
 	if err := archive.Untar(content, dstPath, &archive.TarOptions{
@@ -250,7 +256,7 @@ func CopyFromContainer(cl *dockerClient.Client, containerID, srcPath, dstPath st
 		Compression:          archive.Gzip,
 		NoLchown:             true,
 	}); err != nil {
-		return fmt.Errorf("untar: %s", err)
+		return errors.New(i18n.G("untar: %s", err))
 	}
 
 	if moveDstFile != "" {
@@ -269,8 +275,8 @@ func CopyFromContainer(cl *dockerClient.Client, containerID, srcPath, dstPath st
 }
 
 var (
-	ErrCopyDirToFile  = fmt.Errorf("can't copy dir to file")
-	ErrDstDirNotExist = fmt.Errorf("destination directory does not exist")
+	ErrCopyDirToFile  = errors.New(i18n.G("can't copy dir to file"))
+	ErrDstDirNotExist = errors.New(i18n.G("destination directory does not exist"))
 )
 
 type CopyMode int
@@ -375,9 +381,9 @@ func moveFile(sourcePath, destPath string) error {
 func init() {
 	AppCpCommand.Flags().BoolVarP(
 		&internal.Chaos,
-		"chaos",
-		"C",
+		i18n.G("chaos"),
+		i18n.G("C"),
 		false,
-		"ignore uncommitted recipes changes",
+		i18n.G("ignore uncommitted recipes changes"),
 	)
 }

cli/app/deploy.go

@@ -2,19 +2,22 @@ package app
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
-	"coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/config"
-	"coopcloud.tech/abra/pkg/envfile"
 	"coopcloud.tech/abra/pkg/secret"
+	"coopcloud.tech/tagcmp"
 
 	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/client"
+	"coopcloud.tech/abra/pkg/deploy"
 	"coopcloud.tech/abra/pkg/dns"
 	"coopcloud.tech/abra/pkg/formatter"
+	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/lint"
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/upstream/stack"
@@ -22,16 +25,22 @@ import (
 	"github.com/spf13/cobra"
 )
 
+// translators: `abra app deploy` aliases. use a comma separated list of aliases with
+// no spaces in between
+var appDeployAliases = i18n.G("d")
+
 var AppDeployCommand = &cobra.Command{
-	Use:     "deploy <domain> [version] [flags]",
-	Aliases: []string{"d"},
-	Short:   "Deploy an app",
-	Long: `Deploy an app.
+	// translators: `app deploy` command
+	Use:     i18n.G("deploy <domain> [version] [flags]"),
+	Aliases: strings.Split(appDeployAliases, ","),
+	// translators: Short description for `app deploy` command
+	Short: i18n.G("Deploy an app"),
+	Long: i18n.G(`Deploy an app.
 
 This command supports chaos operations. Use "--chaos/-C" to deploy your recipe
 checkout as-is. Recipe commit hashes are also supported as values for
-"[version]". Please note, "upgrade"/"rollback" do not support chaos operations.`,
-	Example: `  # standard deployment
+"[version]". Please note, "upgrade"/"rollback" do not support chaos operations.`),
+	Example: i18n.G(`  # standard deployment
   abra app deploy 1312.net
 
   # chaos deployment
@@ -41,19 +50,20 @@ checkout as-is. Recipe commit hashes are also supported as values for
   abra app deploy 1312.net 2.0.0+1.2.3
 
   # deploy a specific git hash
-  abra app deploy 1312.net 886db76d`,
+  abra app deploy 1312.net 886db76d`),
 	Args: cobra.RangeArgs(1, 2),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
-		toComplete string) ([]string, cobra.ShellCompDirective) {
+		toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		switch l := len(args); l {
 		case 0:
 			return autocomplete.AppNameComplete()
 		case 1:
 			app, err := appPkg.Get(args[0])
 			if err != nil {
-				errMsg := fmt.Sprintf("autocomplete failed: %s", err)
+				errMsg := i18n.G("autocomplete failed: %s", err)
 				return []string{errMsg}, cobra.ShellCompDirectiveError
 			}
 			return autocomplete.RecipeVersionComplete(app.Recipe.Name)
@@ -63,10 +73,8 @@ checkout as-is. Recipe commit hashes are also supported as values for
 	},
 	Run: func(cmd *cobra.Command, args []string) {
 		var (
-			deployWarnMessages   []string
-			toDeployVersion      string
-			isChaosCommit        bool
-			toDeployChaosVersion = config.CHAOS_DEFAULT
+			deployWarnMessages []string
+			toDeployVersion    string
 		)
 
 		app := internal.ValidateApp(args)
@@ -79,16 +87,12 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			log.Fatal(err)
 		}
 
-		if err := lint.LintForErrors(app.Recipe); err != nil {
-			log.Fatal(err)
-		}
-
 		cl, err := client.New(app.Server)
 		if err != nil {
 			log.Fatal(err)
 		}
 
-		log.Debugf("checking whether %s is already deployed", app.StackName())
+		log.Debug(i18n.G("checking whether %s is already deployed", app.StackName()))
 
 		deployMeta, err := stack.IsDeployed(context.Background(), cl, app.StackName())
 		if err != nil {
@@ -96,48 +100,39 @@ checkout as-is. Recipe commit hashes are also supported as values for
 		}
 
 		if deployMeta.IsDeployed && !(internal.Force || internal.Chaos) {
-			log.Fatalf("%s is already deployed", app.Name)
+			log.Fatal(i18n.G("%s is already deployed", app.Name))
 		}
 
-		if len(args) == 2 && args[1] != "" {
-			toDeployVersion = args[1]
+		toDeployVersion, err = getDeployVersion(args, deployMeta, app)
+		if err != nil {
+			log.Fatal(err)
 		}
 
-		if !deployMeta.IsDeployed &&
-			toDeployVersion == "" &&
-			app.Recipe.EnvVersion != "" && !internal.IgnoreEnvVersion {
-			log.Debugf("new deployment, choosing .env version: %s", app.Recipe.EnvVersion)
-			toDeployVersion = app.Recipe.EnvVersion
+		isChaosCommit, err := app.Recipe.IsChaosCommit(toDeployVersion)
+		if err != nil {
+			log.Fatal(i18n.G("unable to determine if %s is a chaos commit: %s", toDeployVersion, err))
 		}
 
-		if !internal.Chaos && toDeployVersion == "" {
-			if err := getLatestVersionOrCommit(app, &toDeployVersion); err != nil {
-				log.Fatal(err)
-			}
-		}
-
-		if internal.Chaos {
-			if err := getChaosVersion(app, &toDeployVersion, &toDeployChaosVersion); err != nil {
-				log.Fatal(err)
-			}
+		if !isChaosCommit && !tagcmp.IsParsable(toDeployVersion) {
+			log.Fatal(i18n.G("unable to parse deploy version: %s", toDeployVersion))
 		}
 
 		if !internal.Chaos {
-			isChaosCommit, err = app.Recipe.EnsureVersion(toDeployVersion)
+			isChaosCommit, err := app.Recipe.EnsureVersion(toDeployVersion)
 			if err != nil {
-				log.Fatal(err)
+				log.Fatal(i18n.G("ensure recipe: %s", err))
 			}
-
 			if isChaosCommit {
-				log.Debugf("assuming chaos commit: %s", toDeployVersion)
-
+				log.Warnf(i18n.G("version '%s' appears to be a chaos commit, but --chaos/-C was not provided", toDeployVersion))
 				internal.Chaos = true
-				toDeployChaosVersion = toDeployVersion
+			}
+		}
 
-				toDeployVersion, err = app.Recipe.GetVersionLabelLocal()
-				if err != nil {
-					log.Fatal(err)
-				}
+		if err := lint.LintForErrors(app.Recipe); err != nil {
+			if internal.Chaos {
+				log.Warn(err)
+			} else {
+				log.Fatal(err)
 			}
 		}
 
@@ -145,13 +140,9 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			log.Fatal(err)
 		}
 
-		abraShEnv, err := envfile.ReadAbraShEnvVars(app.Recipe.AbraShPath)
-		if err != nil {
+		if err := deploy.MergeAbraShEnv(app.Recipe, app.Env); err != nil {
 			log.Fatal(err)
 		}
-		for k, v := range abraShEnv {
-			app.Env[k] = v
-		}
 
 		composeFiles, err := app.Recipe.GetComposeFiles(app.Env)
 		if err != nil {
@@ -160,27 +151,38 @@ checkout as-is. Recipe commit hashes are also supported as values for
 
 		stackName := app.StackName()
 		deployOpts := stack.Deploy{
-			Composefiles: composeFiles,
-			Namespace:    stackName,
-			Prune:        false,
-			ResolveImage: stack.ResolveImageAlways,
-			Detach:       false,
+			Composefiles:     composeFiles,
+			Namespace:        stackName,
+			Prune:            false,
+			ResolveImage:     stack.ResolveImageAlways,
+			Detach:           false,
+			SendRegistryAuth: true,
 		}
 		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
 		if err != nil {
 			log.Fatal(err)
 		}
 
-		toDeployChaosVersionLabel := toDeployChaosVersion
-		if app.Recipe.Dirty {
-			toDeployChaosVersionLabel = formatter.AddDirtyMarker(toDeployChaosVersionLabel)
-		}
-
-		appPkg.ExposeAllEnv(stackName, compose, app.Env)
 		appPkg.SetRecipeLabel(compose, stackName, app.Recipe.Name)
 		appPkg.SetChaosLabel(compose, stackName, internal.Chaos)
-		appPkg.SetChaosVersionLabel(compose, stackName, toDeployChaosVersionLabel)
-		appPkg.SetUpdateLabel(compose, stackName, app.Env)
+		if internal.Chaos {
+			appPkg.SetChaosVersionLabel(compose, stackName, toDeployVersion)
+		}
+
+		versionLabel := toDeployVersion
+		if internal.Chaos {
+			for _, service := range compose.Services {
+				if service.Name == "app" {
+					labelKey := fmt.Sprintf("coop-cloud.%s.version", stackName)
+					// NOTE(d1): keep non-chaos version labbeling when doing chaos ops
+					versionLabel = service.Deploy.Labels[labelKey]
+				}
+			}
+		}
+		appPkg.SetVersionLabel(compose, stackName, versionLabel)
+
+		newRecipeWithDeployVersion := fmt.Sprintf("%s:%s", app.Recipe.Name, toDeployVersion)
+		appPkg.ExposeAllEnv(stackName, compose, app.Env, newRecipeWithDeployVersion)
 
 		envVars, err := appPkg.CheckEnv(app)
 		if err != nil {
@@ -190,7 +192,7 @@ checkout as-is. Recipe commit hashes are also supported as values for
 		for _, envVar := range envVars {
 			if !envVar.Present {
 				deployWarnMessages = append(deployWarnMessages,
-					fmt.Sprintf("%s missing from %s.env", envVar.Name, app.Domain),
+					i18n.G("%s missing from %s.env", envVar.Name, app.Domain),
 				)
 			}
 		}
@@ -201,30 +203,48 @@ checkout as-is. Recipe commit hashes are also supported as values for
 					log.Fatal(err)
 				}
 			} else {
-				log.Debug("skipping domain checks, no DOMAIN=... configured")
+				log.Debug(i18n.G("skipping domain checks, no DOMAIN=... configured"))
 			}
 		} else {
-			log.Debug("skipping domain checks")
+			log.Debug(i18n.G("skipping domain checks"))
 		}
 
-		deployedVersion := config.NO_VERSION_DEFAULT
+		deployedVersion := config.MISSING_DEFAULT
 		if deployMeta.IsDeployed {
 			deployedVersion = deployMeta.Version
+			if deployMeta.IsChaos {
+				deployedVersion = deployMeta.ChaosVersion
+			}
 		}
 
-		toWriteVersion := toDeployVersion
-		if internal.Chaos || isChaosCommit {
-			toWriteVersion = toDeployChaosVersion
+		// Gather secrets
+		secretInfo, err := deploy.GatherSecretsForDeploy(cl, app, internal.ShowUnchanged)
+		if err != nil {
+			log.Fatal(err)
 		}
 
+		// Gather configs
+		configInfo, err := deploy.GatherConfigsForDeploy(cl, app, compose, app.Env, internal.ShowUnchanged)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		// Gather images
+		imageInfo, err := deploy.GatherImagesForDeploy(cl, app, compose, internal.ShowUnchanged)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		// Show deploy overview
 		if err := internal.DeployOverview(
 			app,
-			deployWarnMessages,
 			deployedVersion,
-			deployMeta.ChaosVersion,
 			toDeployVersion,
-			toDeployChaosVersion,
-			toWriteVersion,
+			"",
+			deployWarnMessages,
+			secretInfo,
+			configInfo,
+			imageInfo,
 		); err != nil {
 			log.Fatal(err)
 		}
@@ -234,79 +254,97 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			log.Fatal(err)
 		}
 
-		log.Debugf("set waiting timeout to %d second(s)", stack.WaitTimeout)
+		serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+		if err != nil {
+			log.Fatal(err)
+		}
 
-		if err := stack.RunDeploy(cl, deployOpts, compose, app.Name, internal.DontWaitConverge); err != nil {
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if err := stack.RunDeploy(
+			cl,
+			deployOpts,
+			compose,
+			app.Name,
+			app.Server,
+			internal.DontWaitConverge,
+			internal.NoInput,
+			f,
+		); err != nil {
 			log.Fatal(err)
 		}
 
 		postDeployCmds, ok := app.Env["POST_DEPLOY_CMDS"]
 		if ok && !internal.DontWaitConverge {
-			log.Debugf("run the following post-deploy commands: %s", postDeployCmds)
+			log.Debug(i18n.G("run the following post-deploy commands: %s", postDeployCmds))
 			if err := internal.PostCmds(cl, app, postDeployCmds); err != nil {
-				log.Fatalf("attempting to run post deploy commands, saw: %s", err)
+				log.Fatal(i18n.G("attempting to run post deploy commands, saw: %s", err))
 			}
 		}
 
-		if err := app.WriteRecipeVersion(toWriteVersion, false); err != nil {
-			log.Fatalf("writing recipe version failed: %s", err)
+		if err := app.WriteRecipeVersion(toDeployVersion, false); err != nil {
+			log.Fatal(i18n.G("writing recipe version failed: %s", err))
 		}
 	},
 }
 
-func getChaosVersion(app app.App, toDeployVersion, toDeployChaosVersion *string) error {
-	var err error
-	*toDeployChaosVersion, err = app.Recipe.ChaosVersion()
+func getLatestVersionOrCommit(app appPkg.App) (string, error) {
+	recipeVersions, warnings, err := app.Recipe.GetRecipeVersions()
 	if err != nil {
-		return err
+		return "", err
 	}
 
-	*toDeployVersion, err = app.Recipe.GetVersionLabelLocal()
-	if err != nil {
-		return err
+	for _, warning := range warnings {
+		log.Warn(warning)
 	}
 
-	return nil
-}
-
-func getLatestVersionOrCommit(app app.App, toDeployVersion *string) error {
-	versions, err := app.Recipe.Tags()
-	if err != nil {
-		return err
-	}
-
-	if len(versions) > 0 && !internal.Chaos {
-		*toDeployVersion = versions[len(versions)-1]
-
-		log.Debugf("choosing %s as version to deploy", *toDeployVersion)
-
-		if _, err := app.Recipe.EnsureVersion(*toDeployVersion); err != nil {
-			return err
+	if len(recipeVersions) > 0 && !internal.Chaos {
+		latest := recipeVersions[len(recipeVersions)-1]
+		for tag := range latest {
+			log.Debug(i18n.G("selected latest recipe version: %s (from %d available versions)", tag, len(recipeVersions)))
+			return tag, nil
 		}
-
-		return nil
 	}
 
 	head, err := app.Recipe.Head()
 	if err != nil {
-		return err
+		return "", err
 	}
 
-	*toDeployVersion = formatter.SmallSHA(head.String())
-
-	return nil
+	return formatter.SmallSHA(head.String()), nil
 }
 
 // validateArgsAndFlags ensures compatible args/flags.
 func validateArgsAndFlags(args []string) error {
 	if len(args) == 2 && args[1] != "" && internal.Chaos {
-		return fmt.Errorf("cannot use [version] and --chaos together")
+		return errors.New(i18n.G("cannot use [version] and --chaos together"))
+	}
+
+	if len(args) == 2 && args[1] != "" && internal.DeployLatest {
+		return errors.New(i18n.G("cannot use [version] and --latest together"))
+	}
+
+	if internal.DeployLatest && internal.Chaos {
+		return errors.New(i18n.G("cannot use --chaos and --latest together"))
 	}
 
 	return nil
 }
 
-func validateSecrets(cl *dockerClient.Client, app app.App) error {
+func validateSecrets(cl *dockerClient.Client, app appPkg.App) error {
+	composeFiles, err := app.Recipe.GetComposeFiles(app.Env)
+	if err != nil {
+		return err
+	}
+
+	secretsConfig, err := secret.ReadSecretsConfig(app.Path, composeFiles, app.StackName())
+	if err != nil {
+		return err
+	}
+
 	secStats, err := secret.PollSecretsStatus(cl, app)
 	if err != nil {
 		return err
@@ -314,43 +352,108 @@ func validateSecrets(cl *dockerClient.Client, app app.App) error {
 
 	for _, secStat := range secStats {
 		if !secStat.CreatedOnRemote {
-			return fmt.Errorf("secret not generated: %s", secStat.LocalName)
+			secretConfig := secretsConfig[secStat.LocalName]
+			if secretConfig.SkipGenerate {
+				return errors.New(i18n.G("secret not inserted (#generate=false): %s", secStat.LocalName))
+			}
+			return errors.New(i18n.G("secret not generated: %s", secStat.LocalName))
 		}
 	}
 
 	return nil
 }
 
+func getDeployVersion(cliArgs []string, deployMeta stack.DeployMeta, app appPkg.App) (string, error) {
+	// Chaos mode overrides everything
+	if internal.Chaos {
+		v, err := app.Recipe.ChaosVersion()
+		if err != nil {
+			return "", err
+		}
+		log.Debug(i18n.G("version: taking chaos version: %s", v))
+		return v, nil
+	}
+
+	// Check if the deploy version is set with a cli argument
+	if len(cliArgs) == 2 && cliArgs[1] != "" {
+		log.Debug(i18n.G("version: taking version from cli arg: %s", cliArgs[1]))
+		return cliArgs[1], nil
+	}
+
+	// Check if the recipe has a version in the .env file
+	if app.Recipe.EnvVersion != "" && !internal.DeployLatest {
+		if strings.HasSuffix(app.Recipe.EnvVersionRaw, "+U") {
+			// NOTE(d1): use double-line 5 spaces ("FATA ") trick to make a more
+			// informative error message. it's ugly but that's our logging situation
+			// atm
+			return "", errors.New(i18n.G(`cannot redeploy previous chaos version (%s), did you mean to use "--chaos"?
+     to return to a regular release, specify a release tag, commit SHA or use "--latest"`,
+				formatter.BoldDirtyDefault(app.Recipe.EnvVersionRaw)))
+		}
+		log.Debug(i18n.G("version: taking version from .env file: %s", app.Recipe.EnvVersion))
+		return app.Recipe.EnvVersion, nil
+	}
+
+	// Take deployed version
+	if deployMeta.IsDeployed && !internal.DeployLatest {
+		log.Debug(i18n.G("version: taking deployed version: %s", deployMeta.Version))
+		return deployMeta.Version, nil
+	}
+
+	v, err := getLatestVersionOrCommit(app)
+	log.Debug(i18n.G("version: taking new recipe version: %s", v))
+	if err != nil {
+		return "", err
+	}
+	return v, nil
+}
+
 func init() {
 	AppDeployCommand.Flags().BoolVarP(
 		&internal.Chaos,
-		"chaos",
-		"C",
+		i18n.G("chaos"),
+		i18n.G("C"),
 		false,
-		"ignore uncommitted recipes changes",
+		i18n.G("ignore uncommitted recipes changes"),
 	)
 
 	AppDeployCommand.Flags().BoolVarP(
 		&internal.Force,
-		"force",
-		"f",
+		i18n.G("force"),
+		i18n.G("f"),
 		false,
-		"perform action without further prompt",
+		i18n.G("perform action without further prompt"),
 	)
 
 	AppDeployCommand.Flags().BoolVarP(
 		&internal.NoDomainChecks,
-		"no-domain-checks",
-		"D",
+		i18n.G("no-domain-checks"),
+		i18n.G("D"),
 		false,
-		"disable public DNS checks",
+		i18n.G("disable public DNS checks"),
 	)
 
 	AppDeployCommand.Flags().BoolVarP(
 		&internal.DontWaitConverge,
-		"no-converge-checks",
-		"c",
+		i18n.G("no-converge-checks"),
+		i18n.G("c"),
 		false,
-		"disable converge logic checks",
+		i18n.G("disable converge logic checks"),
+	)
+
+	AppDeployCommand.PersistentFlags().BoolVarP(
+		&internal.DeployLatest,
+		i18n.G("latest"),
+		i18n.G("l"),
+		false,
+		i18n.G("deploy latest recipe version"),
+	)
+
+	AppDeployCommand.Flags().BoolVarP(
+		&internal.ShowUnchanged,
+		i18n.G("show-unchanged"),
+		i18n.G("U"),
+		false,
+		i18n.G("show all configs & images, including unchanged ones"),
 	)
 }

cli/app/env.go

@@ -1,20 +1,50 @@
 package app
 
 import (
+	"context"
 	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
 	"sort"
+	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
+	"coopcloud.tech/abra/pkg/app"
+	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/autocomplete"
+	"coopcloud.tech/abra/pkg/client"
+	"coopcloud.tech/abra/pkg/config"
+	containerPkg "coopcloud.tech/abra/pkg/container"
+	contextPkg "coopcloud.tech/abra/pkg/context"
 	"coopcloud.tech/abra/pkg/formatter"
+	"coopcloud.tech/abra/pkg/i18n"
+	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/upstream/stack"
+	"github.com/docker/docker/api/types/filters"
 	"github.com/spf13/cobra"
 )
 
-var AppEnvCommand = &cobra.Command{
-	Use:     "env <domain> [flags]",
-	Aliases: []string{"e"},
-	Short:   "Show app .env values",
-	Example: "  abra app env 1312.net",
+// translators: `abra app env` aliases. use a comma separated list of aliases
+// with no spaces in between
+var appEnvAliases = i18n.G("e")
+
+// translators: `abra app env list` aliases. use a comma separated list of
+// aliases with no spaces in between
+var appEnvListAliases = i18n.G("l,ls")
+
+// translators: `abra app env pull` aliases. use a comma separated list of
+// aliases with no spaces in between
+var appEnvPullAliases = i18n.G("pl,p")
+
+var AppEnvListCommand = &cobra.Command{
+	// translators: `app env list` command
+	Use:     i18n.G("list <domain> [flags]"),
+	Aliases: strings.Split(appEnvListAliases, ","),
+	// translators: Short description for `app env list` command
+	Short:   i18n.G("List all app environment values"),
+	Example: i18n.G("  abra app env list 1312.net"),
 	Args:    cobra.ExactArgs(1),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
@@ -37,7 +67,278 @@ var AppEnvCommand = &cobra.Command{
 			rows = append(rows, []string{k, app.Env[k]})
 		}
 
-		overview := formatter.CreateOverview("ENV OVERVIEW", rows)
+		overview := formatter.CreateOverview(i18n.G("ENV OVERVIEW"), rows)
 		fmt.Println(overview)
 	},
 }
+
+var AppEnvPullCommand = &cobra.Command{
+	// translators: `app pull` command
+	Use:     i18n.G("pull <domain> [flags]"),
+	Aliases: strings.Split(appEnvPullAliases, ","),
+	// translators: Short description for `app env pull` command
+	Short: i18n.G("Pull app environment values from a deployed app"),
+	Long: i18n.G(`Pull app environment values from a deploymed app.
+
+A convenient command for when you've lost your app environment file or want to
+synchronize your local app environment values with what is deployed live.`),
+	Example: i18n.G(`  # pull existing .env file and overwrite local values
+  abra app env pull 1312.net --force
+
+  # pull lost app .env file
+  abra app env pull my.gitea.net --server 1312.net`),
+	Args: cobra.MaximumNArgs(2),
+	ValidArgsFunction: func(
+		cmd *cobra.Command,
+		args []string,
+		toComplete string) ([]string, cobra.ShellCompDirective) {
+		return autocomplete.AppNameComplete()
+	},
+	Run: func(cmd *cobra.Command, args []string) {
+		appName := args[0]
+
+		appEnvPath := path.Join(config.ABRA_DIR, "servers", server, fmt.Sprintf("%s.env", appName))
+		if _, err := os.Stat(appEnvPath); !os.IsNotExist(err) {
+			log.Fatal(i18n.G("%s already exists?", appEnvPath))
+		}
+
+		if server == "" {
+			log.Fatal(i18n.G("unable to determine server of app %s, please pass --server/-s", appName))
+		}
+
+		serverDir := filepath.Join(config.SERVERS_DIR, server)
+		if _, err := os.Stat(serverDir); os.IsNotExist(err) {
+			log.Fatal(i18n.G("unknown server %s, run \"abra server add %s\"?", server, server))
+		}
+
+		store := contextPkg.NewDefaultDockerContextStore()
+		contexts, err := store.Store.List()
+		if err != nil {
+			log.Fatal(i18n.G("unable to look up server context for %s: %s", server, err))
+		}
+
+		var contextCreated bool
+		if server == "default" {
+			contextCreated = true
+		}
+
+		for _, context := range contexts {
+			if context.Name == server {
+				contextCreated = true
+			}
+		}
+
+		if !contextCreated {
+			log.Fatal(i18n.G("%s missing context, run \"abra server add %s\"?", server, server))
+		}
+
+		cl, err := client.New(server)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		deployMeta, err := stack.IsDeployed(context.Background(), cl, appPkg.StackName(appName))
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if !deployMeta.IsDeployed {
+			log.Fatal(i18n.G("%s is not deployed?", appName))
+		}
+
+		filters := filters.NewArgs()
+		filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(appName), "app"))
+		targetContainer, err := containerPkg.GetContainer(context.Background(), cl, filters, internal.NoInput)
+		if err != nil {
+			log.Fatal(i18n.G("unable to retrieve container for %s: %s", appName, err))
+		}
+
+		inspectResult, err := cl.ContainerInspect(context.Background(), targetContainer.ID)
+		if err != nil {
+			log.Fatal(i18n.G("unable to inspect container for %s: %s", appName, err))
+		}
+
+		deploymentEnv := make(map[string]string)
+		for _, envVar := range inspectResult.Config.Env {
+			split := strings.SplitN(envVar, "=", 2)
+			if len(split) != 2 {
+				log.Debug(i18n.G("no value attached to %s", envVar))
+				continue
+			}
+
+			key, val := split[0], split[1]
+			deploymentEnv[key] = val
+		}
+
+		log.Debug(i18n.G("pulled env values from %s deployment: %s", appName, deploymentEnv))
+
+		var (
+			recipeEnvVar string
+			recipeKey    string
+		)
+
+		if r, ok := deploymentEnv["TYPE"]; ok {
+			recipeKey = "TYPE"
+			recipeEnvVar = r
+		}
+
+		if r, ok := deploymentEnv["RECIPE"]; ok {
+			recipeKey = "RECIPE"
+			recipeEnvVar = r
+		}
+
+		if recipeEnvVar == "" {
+			log.Fatal(i18n.G("unable to determine recipe type from %s, env: %v", appName, inspectResult.Config.Env))
+		}
+
+		var recipeName = recipeEnvVar
+		if strings.Contains(recipeEnvVar, ":") {
+			split := strings.Split(recipeEnvVar, ":")
+			recipeName = split[0]
+		}
+
+		recipe := internal.ValidateRecipe(
+			[]string{recipeName},
+			cmd.Name(),
+		)
+
+		version := deployMeta.Version
+		if deployMeta.IsChaos {
+			version = deployMeta.ChaosVersion
+		}
+
+		if _, err := recipe.EnsureVersion(version); err != nil {
+			log.Fatal(err)
+		}
+
+		mergedEnv, err := recipe.SampleEnv()
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		log.Debug(i18n.G("retrieved env values from .env.sample of %s: %s", recipe.Name, mergedEnv))
+
+		for k, v := range deploymentEnv {
+			mergedEnv[k] = v
+		}
+
+		if !strings.Contains(recipeEnvVar, ":") {
+			mergedEnv[recipeKey] = fmt.Sprintf("%s:%s", mergedEnv[recipeKey], version)
+		}
+
+		log.Debug(i18n.G("final merged env values for %s are: %s", appName, mergedEnv))
+
+		envSample, err := os.ReadFile(recipe.SampleEnvPath)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		err = os.WriteFile(appEnvPath, envSample, 0o664)
+		if err != nil {
+			log.Fatal(i18n.G("unable to write new env %s: %s", appEnvPath, err))
+		}
+
+		read, err := os.ReadFile(appEnvPath)
+		if err != nil {
+			log.Fatal(i18n.G("unable to read new env %s: %s", appEnvPath, err))
+		}
+
+		sampleEnv, err := recipe.SampleEnv()
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		var composeFileUpdated bool
+		newContents := string(read)
+		for key, val := range mergedEnv {
+			if sampleEnv[key] == val {
+				continue
+			}
+
+			if key == "COMPOSE_FILE" {
+				composeFileUpdated = true
+				continue
+			}
+
+			if m, _ := regexp.MatchString(fmt.Sprintf(`#%s=`, key), newContents); m {
+				log.Debug(i18n.G("uncommenting %s", key))
+				re := regexp.MustCompile(fmt.Sprintf(`#%s=`, key))
+				newContents = re.ReplaceAllString(newContents, fmt.Sprintf("%s=", key))
+			}
+
+			if m, _ := regexp.MatchString(fmt.Sprintf(`# %s=`, key), newContents); m {
+				log.Debug(i18n.G("uncommenting %s", key))
+				re := regexp.MustCompile(fmt.Sprintf(`# %s=`, key))
+				newContents = re.ReplaceAllString(newContents, fmt.Sprintf("%s=", key))
+			}
+
+			if m, _ := regexp.MatchString(fmt.Sprintf(`%s=".*"`, key), newContents); m {
+				log.Debug(i18n.G(`inserting %s="%s" (double quotes)`, key, val))
+				re := regexp.MustCompile(fmt.Sprintf(`%s=".*"`, key))
+				newContents = re.ReplaceAllString(newContents, fmt.Sprintf(`%s="%s"`, key, val))
+				continue
+			}
+
+			if m, _ := regexp.MatchString(fmt.Sprintf(`%s='.*'`, key), newContents); m {
+				log.Debug(i18n.G(`inserting %s='%s' (single quotes)`, key, val))
+				re := regexp.MustCompile(fmt.Sprintf(`%s='.*'`, key))
+				newContents = re.ReplaceAllString(newContents, fmt.Sprintf(`%s='%s'`, key, val))
+				continue
+			}
+
+			if m, _ := regexp.MatchString(fmt.Sprintf("%s=.*", key), newContents); m {
+				log.Debug(i18n.G("inserting %s=%s (no quotes)", key, val))
+				re := regexp.MustCompile(fmt.Sprintf("%s=.*", key))
+				newContents = re.ReplaceAllString(newContents, fmt.Sprintf("%s=%s", key, val))
+			}
+		}
+
+		err = os.WriteFile(appEnvPath, []byte(newContents), 0)
+		if err != nil {
+			log.Fatal(i18n.G("unable to write new env %s: %s", appEnvPath, err))
+		}
+
+		log.Info(i18n.G("%s successfully created", appEnvPath))
+
+		if composeFileUpdated {
+			log.Warn(i18n.G("manual update required: COMPOSE_FILE=\"%s\"", mergedEnv["COMPOSE_FILE"]))
+		}
+	},
+}
+
+var AppEnvCommand = &cobra.Command{
+	// translators: `app env` command group
+	Use:     i18n.G("env [cmd] [args] [flags]"),
+	Aliases: strings.Split(appEnvAliases, ","),
+	// translators: Short description for `app env` command group
+	Short: i18n.G("Manage app environment values"),
+}
+
+var (
+	server string