serve

Start the web UI server.

Usage

clonit serve [flags]

Flags

Flag	Type	Default	Description
--host	string	127.0.0.1	Host to bind to
--port	int	8484	Port to listen on

Description

Starts an HTTP server that serves the Clonit web UI and REST API. The web UI provides a browser-based interface for the full Clonit workflow – managing targets, building and loading snapshots, running sanitization analysis, connecting to Clonit Cloud, and more.

The server binds to 127.0.0.1:8484 by default. Use --host and --port to override, or set server.host and server.port in your config file.

The server handles graceful shutdown on SIGINT and SIGTERM.

Web UI Features

The web UI at http://127.0.0.1:8484 includes the following pages:

Dashboard

Overview of your Clonit instance with local target, snapshot, and storage profile counts, total snapshot size, and a table of recent snapshots. When connected to Clonit Cloud, a compact strip shows the connection status, your organization, and the registered agent count.

Targets

Create, edit, and delete database targets. New Target is a guided page: paste one connection URL (the database type is detected from the scheme — postgres://, postgresql://, or mysql://), then choose between password auth and keyless AWS RDS IAM auth. Keyless prefills host, port, database, user, and region from the URL (an RDS hostname also fills the region), starts the AWS profile from the agent-wide value saved in Settings → AWS, ignores any password in the URL, and generates destination databases as <db>_snap/<db>_san — every field stays editable, and the classic full form remains one click away for advanced options and editing. Targets using RDS IAM show an “RDS IAM (keyless)” badge on their detail page. When connected to Clonit Cloud, cloud targets are merged into the same list (with origin and access badges) — localize a cloud-only target to this agent or delete it from the cloud right from the list. Each target detail page provides:

• Connection verification – test source, destination, and sanitization database connectivity
• Tool status – detect local tool versions (pg_dump, pg_restore, psql), query server versions, and check compatibility
• Snapshots – list snapshots with local/remote sync status indicators
• Build – trigger a snapshot build directly from the UI
• Sanitization analysis – run AI-powered column sensitivity analysis using an LLM to detect PII and generate sanitization SQL
• Query editor – view, edit, and create sanitization queries
• Ephemeral sanitize – run the full sanitize pipeline in a Docker container with real-time step-by-step progress

Snapshots

A flat catalog of every snapshot — local ones on this agent and, when connected to Clonit Cloud, cloud snapshots merged into the same list:

• Filters – All, Local, Cloud, and Shared views of the catalog
• Origin badges – each row shows whether it is local, synced, or cloud-only
• Pull – download a cloud snapshot to this agent (if its target isn’t local yet, Clonit creates it first)
• Sharing – toggle org-wide sharing of a cloud snapshot from the row
• Details – open a local snapshot for size, checksum, and creation date, push it to remote storage, or delete it

Storage Profiles

Create, edit, delete, and verify S3/R2 storage profiles. When connected to Clonit Cloud, cloud storage profiles appear alongside local ones with keyless/static badges and Edit and Verify actions on each row. Cloud profiles can be created and edited right from this page (Add Cloud Profile), including keyless (AssumeRole) profiles: after saving a keyless profile, an onboarding dialog runs Verify automatically and surfaces the trust and permission policies plus the ExternalId with copy buttons, with a Re-verify button to retry once the trust policy is attached.

Settings

Configure the agent and your Clonit Cloud connection in four sections (Cloud, AWS, Organization, and Account). If your sign-in and this agent’s registration are in different organizations, each section shows a warning banner naming both orgs and how to realign them:

• Cloud configuration (Settings → Cloud) – set the cloud URL, sign in and out, and (under Advanced) set an API key or register the agent
• AWS credentials (Settings → AWS) – see which AWS identity the agent resolves to, and set the agent-wide AWS profile used for keyless database and storage access — saved to the agent’s config, effective immediately, and prefilled into new keyless targets
• Organization (Settings → Organization) – view org details (name, slug, plan)
• AI Analysis (Settings → Organization) – manage the org’s Anthropic key for cloud-side sanitization analysis (set, replace, or clear the key; admin/owner only)
• API keys (Settings → Organization) – create and delete API keys with secure display of newly created keys
• Registered agents (Settings → Organization) – view and manage agent registrations
• SSO status (Settings → Organization) – view OIDC/Okta SSO configuration status for your organization
• Account (Settings → Account) – see who is signed in (email, org, role, session), open your account settings and personal settings in the identity service, and sign out

Account menu

When you are signed in to Clonit Cloud, an account menu appears in the top-right corner of every page showing your email and org role. It gives one-click access to your account settings and personal settings (hosted by the identity service), your organization settings, the Cloud settings section, and sign out. The menu (and the whole top bar) is hidden when no cloud is configured.

Examples

Start the web UI with default settings:

clonit serve

Start on a custom port:

clonit serve --port 9090

Bind to all interfaces:

clonit serve --host 0.0.0.0

REST API

The web UI communicates with the backend via a REST API at /api/v1. Key endpoints include:

Method	Path	Description
GET	/api/v1/health	Health check
GET	/api/v1/stats	Dashboard statistics
GET	/api/v1/analysis-capability	Whether AI analysis is available (and why not)
GET	/api/v1/aws-identity	Agent AWS identity for keyless setup surfaces (?profile= checks a named ~/.aws profile)
GET	/api/v1/config/aws	The agent-wide AWS profile setting (aws.profile)
PUT	/api/v1/config/aws	Save the agent-wide AWS profile (empty clears it back to the ambient chain)
POST	/api/v1/rds-ca-bundle	Download the AWS global RDS CA bundle to the agent (keyless wizard)
GET	/api/v1/targets	List targets
POST	/api/v1/targets	Create target
PUT	/api/v1/targets/{id}	Update target
DELETE	/api/v1/targets/{id}	Delete target
POST	/api/v1/targets/{id}/duplicate	Duplicate target (config and active sanitize query)
POST	/api/v1/targets/{id}/build	Build snapshot
POST	/api/v1/targets/{id}/verify	Verify connectivity
GET	/api/v1/targets/{id}/rds-setup	Parsed connection + keyless setup info for the guided RDS setup wizard
POST	/api/v1/targets/{id}/rds-setup/grant	Execute the keyless IAM-grant SQL over a one-time admin connection (PostgreSQL; never stored)
GET	/api/v1/targets/{id}/tool-status	Tool/server version status
POST	/api/v1/targets/{id}/analyze	Trigger sanitization analysis
POST	/api/v1/targets/{id}/ephemeral-sanitize	Start ephemeral sanitize
GET	/api/v1/snapshots/{id}	Get snapshot
POST	/api/v1/snapshots/{id}/push	Push snapshot to storage
GET	/api/v1/storage-profiles	List storage profiles
POST	/api/v1/storage-profiles/{id}/duplicate	Duplicate storage profile (including stored credentials)
GET	/api/v1/cloud/status	Cloud connection status
GET	/api/v1/cloud/org	Organization info
GET	/api/v1/cloud/api-keys	List API keys
GET	/api/v1/cloud/sso/config	SSO configuration status

Development Workflow

For frontend development with hot module replacement (HMR), run the Go backend and Bun dev server in parallel:

# Terminal 1: Start the Go API server
go run . serve

# Terminal 2: Start the Bun dev server (proxies /api/* to :8484)
cd ui && bun dev

The Bun dev server runs on port 3000 and proxies API requests to the Go backend on port 8484.

Configuration

The server settings can also be configured in <config-dir>/config.yaml:

server:
  host: "127.0.0.1"
  port: 8484

Environment variables are also supported via the CLONIT_ prefix:

CLONIT_SERVER_HOST=0.0.0.0 CLONIT_SERVER_PORT=9090 clonit serve

See Also

• Quick Start – Getting started with Clonit
• How Clonit Works – The agent, web UI, and optional cloud
• Cloud Integration – Connect to Clonit Cloud
• Sanitization Analysis – AI-powered sanitization