sealup.yml

sealup reads sealup.yml (or sealup.yaml) from the folder it runs in, then from parent folders up to the repo root. sealup help config prints the same keys in short.

Two forms

With one target, its keys sit at the top level of the file:

server: sftp://deploy@ssh.example.com/home/site/www
password: ${SEALUP_PASSWORD}
hostKey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH4R/D1Ip9CHKXPz6VH9sx…
upload: dist

With several targets, each one has its keys under targets:, and what to send can stay at the top level for all of them:

upload: dist
targets:
  staging:
    server: sftp://deploy@ssh.example.com/home/site/staging
    password: ${STAGING_PASSWORD}
  production:
    server: sftp://deploy@ssh.example.com/home/site/www
    password: ${PRODUCTION_PASSWORD}

Variables

${VAR} reads a variable, ${VAR:?message} stops with your message when it is not set, and $$ writes a plain $. Variables come from the environment, and on your machine from sealup.env (or the file given to --env-file). A password is always a variable: sealup stops on a password written in the file.

A public repository

A public repository can keep the server and its host key out of the file too: sealup init writes this form when you say the repository is public. To switch a project by hand, move each value to sealup.env and to your CI secrets, under the variable’s name, and pass each one in the workflow’s env::

server: ${SEALUP_SERVER}
password: ${SEALUP_PASSWORD}
hostKey: ${SEALUP_HOST_KEY}
upload: dist

Over FTPS with a pinned certificate, the pin takes the third variable: tlsFingerprint: ${SEALUP_TLS_FINGERPRINT}. In GitHub Actions, a server or key read from a variable is masked like a password. What this protects, and what it does not: A public repository.

Keys

server

Sftp|ssh|ftps|ftp://user@host[:port]/folder (/~/… is in the login folder).

• Value: text
• Where: top level (one target); in a target (targets.<name>)
• Required: top level (one target); in a target (targets.<name>)

password

A variable only, like ${SEALUP_PASSWORD}; or privateKey.

• Value: text
• Where: top level (one target); in a target (targets.<name>)

privateKey

A variable holding the key file, like ${DEPLOY_KEY}; or password.

• Value: text
• Where: top level (one target); in a target (targets.<name>)

passphrase

A variable only, like ${KEY_PASSPHRASE}, for an encrypted key.

• Value: text
• Where: top level (one target); in a target (targets.<name>)

hostKey

The OpenSSH public key line keyscan writes.

• Value: text
• Where: top level (one target); in a target (targets.<name>)

tlsFingerprint

Ftps only: the certificate’s SHA-256 (AA:BB:…, 32 pairs) that keyscan writes; it replaces the CA and host name checks.

• Value: text
• Where: top level (one target); in a target (targets.<name>)

url

The site address, shown after a deploy.

• Value: text
• Where: top level (one target); in a target (targets.<name>)

allow

Safety nets to turn off for a target.

• Value: a list of values: empty-source, symlinks, root-folder
• Where: top level (one target); in a target (targets.<name>)

checkServer

Put back files changed on the server (default false).

• Value: true or false
• Where: top level (one target); in a target (targets.<name>)

parallel

SFTP requests in flight (default 64); FTP connections (default 4, at most 16).

• Value: a whole number
• Range: from 1 to 256
• Where: top level (one target); top level (several targets: for all of them); in a target (targets.<name>)

timeout

Per operation, like 30s or 2m (default 30s).

• Value: text
• Where: top level (one target); top level (several targets: for all of them); in a target (targets.<name>)

manifest

Manifest folder, from the login folder (default .sealup).

• Value: text
• Where: top level (one target); top level (several targets: for all of them); in a target (targets.<name>)

upload

A folder sent to the target folder, or local: server pairs (folders or single files).

• Value: text, or pairs, name: value
• Each value: Server folder (. is the target folder), or file path for a single file
• Where: top level (one target); top level (several targets: for all of them); in a target (targets.<name>)
• Required: top level (one target); top level (several targets: for all of them)

An entry may also be written with these keys:

Key	Value	Meaning
to	text	Server folder (. is the target folder), or file path for a single file (required)
mirror	true or false	Also delete server files sealup did not upload (minus excludes)

exclude

.gitignore patterns: never sent, never deleted.

• Value: a list of text
• Where: top level (one target); top level (several targets: for all of them); in a target (targets.<name>)

write

Server file: secret pairs, each file written from a secret, mode 0600.

• Value: pairs, name: value
• Each value: A variable only, like ${APP_ENV}
• Where: top level (one target); top level (several targets: for all of them); in a target (targets.<name>)
• Guide: Files written from a secret

An entry may also be written with these keys:

Key	Value	Meaning
from	text	A variable only, like ${APP_ENV} (required)
mode	text	File mode, quoted (default ‘0600’)
allowPublic	true or false	Write it even into a folder that looks public

pull

Server folder (or file): local folder pairs, for sealup pull.

• Value: pairs, name: value
• Each value: Local folder (or file), inside the folder of sealup.yml
• Where: top level (one target); top level (several targets: for all of them); in a target (targets.<name>)

targets

Named targets (then no server at the top level).

• Value: pairs, name: value
• Where: top level (several targets: for all of them)
• Required: top level (several targets: for all of them)

An entry may also be written with these keys:

Key	Value	Meaning
server	text	sftp|ssh|ftps|ftp://user@host[:port]/folder (/~/… is in the login folder) (required)
password	text	A variable only, like ${SEALUP_PASSWORD}; or privateKey
privateKey	text	A variable holding the key file, like ${DEPLOY_KEY}; or password
passphrase	text	A variable only, like ${KEY_PASSPHRASE}, for an encrypted key
hostKey	text	The OpenSSH public key line keyscan writes
tlsFingerprint	text	ftps only: the certificate’s SHA-256 (AA:BB:…, 32 pairs) that keyscan writes; it replaces the CA and host name checks
url	text	The site address, shown after a deploy
allow	a list of values: empty-source, symlinks, root-folder
checkServer	true or false	Put back files changed on the server (default false)
parallel	a whole number	SFTP requests in flight (default 64); FTP connections (default 4, at most 16)
timeout	text	Per operation, like 30s or 2m (default 30s)
manifest	text	Manifest folder, from the login folder (default .sealup)
upload	text, or pairs, name: value	A folder sent to the target folder, or local: server pairs (folders or single files)
exclude	a list of text
write	pairs, name: value	server file: secret pairs, each file written from a secret, mode 0600
pull	pairs, name: value	server folder (or file): local folder pairs, for sealup pull