reoclo proxy

reoclo proxy reconcile <server>
reoclo proxy allowlist <server> [--allow <cidr>]... [--cloudflare | --no-cloudflare] [--clear]

Each server runs a managed proxy that routes traffic to your applications and domains. The proxy re-syncs its configuration on a regular schedule. The proxy commands act on that proxy directly.

reconcile <server>

Asks the managed proxy on a server to reconcile now, instead of waiting for the next scheduled reconcile. Pass the server by name, slug, or id.

$ reoclo proxy reconcile reoclo-production
✓ proxy reconcile triggered for reoclo-production

The command returns once the reconcile has been requested. With -o json, it prints the API’s response.

allowlist <server>

Shows or changes the server’s default IP allowlist: the source IP addresses allowed to reach the domains on this server. Domains that inherit follow this default. A domain with its own rules keeps them. See reoclo domains access. Pass the server by name, slug, or id.

The server must run the managed proxy. On any other server the API answers 409 and the command exits with 1.

With no flags, the command prints the current default and changes nothing.

$ reoclo proxy allowlist reoclo-production
reoclo-production
access: cloudflare
  preset: cloudflare

Flag	Meaning
--allow <cidr>	Allow this IP address or CIDR range. Repeat the flag for more than one (up to 100). Replaces the custom ranges. A bare address becomes a single-address range.
--cloudflare	Allow Cloudflare’s published edge ranges. The platform keeps them current.
--no-cloudflare	Stop allowing Cloudflare’s edge ranges.
--clear	Remove the default allowlist.

$ reoclo proxy allowlist reoclo-production --cloudflare --allow 203.0.113.0/24
✓ reoclo-production default access: cloudflare+1

$ reoclo proxy allowlist reoclo-production --clear
✓ reoclo-production default access: cleared

The command reads the server first and merges your flags into the current default. --allow alone keeps the current preset, and --cloudflare or --no-cloudflare alone keeps the current custom ranges. --clear cannot be combined with --allow or the Cloudflare flags. The command exits with 2 when a merge would leave no ranges at all. Use --clear to remove the default instead.

With -o json or -o yaml, the command prints the server’s proxy configuration, or server and ip_allowlist when it only shows the current default.

Needs CLI 0.89.0 or newer.

Exit codes

Code	Meaning
0	Reconcile requested
1	Server-side error, or the server does not run the managed proxy (allowlist)
2	Wrong flags, for example —clear with —allow
3	Authentication failure
4	Permission denied (authenticated, but not allowed)
5	Server not found
7	Control plane unreachable: DNS, connection refused, or timeout

Related

• reoclo servers: list and inspect servers
• reoclo domains: register domains and publish their DNS records