targets add

Add a new database target.

Usage

clonit targets add --src-url <url> [flags]

Flags

Flag	Type	Default	Description	Required
`--name`	string	(derived from src-url)	Target name	No
`--db-type`	string	`postgres`	Database type (`postgres`, `mysql`)	No
`--src-url`	string		Source database URL	Yes
`--dst-url`	string		Destination database URL	No
`--sanitize-dst-url`	string		Sanitize destination database URL	No
`--sanitize-query-file`	string		Path to sanitization SQL query file	No
`--storage-profile`	string		Storage profile name	No
`--dump-jobs`	int	`0`	Number of parallel dump jobs (0 = use default)	No
`--restore-jobs`	int	`0`	Number of parallel restore jobs (0 = use default)	No
`--src-schema-include`	string[]		Schemas to include in dump (glob patterns)	No
`--src-schema-exclude`	string[]		Schemas to exclude from dump (glob patterns)	No
`--dst-schema-include`	string[]		Schemas to include in restore (glob patterns)	No
`--dst-schema-exclude`	string[]		Schemas to exclude from restore (glob patterns)	No
`--db-auth-mode`	string	`password`	Database auth mode: `password` or `rds_iam` (keyless AWS RDS IAM token auth)	No
`--db-region`	string		AWS region used to sign RDS IAM tokens (`--db-auth-mode rds_iam`); derived from an RDS hostname when omitted	No
`--aws-profile`	string		Named AWS profile (`~/.aws`) used to sign RDS IAM tokens for this target (`--db-auth-mode rds_iam`); overrides the agent-wide `aws.profile` config	No
`--no-verify`	bool	`false`	Skip URL connectivity verification	No
`--read-only`	bool	`false`	Mark target as read-only	No

Description

Creates a new database target with the specified configuration. At minimum, a source database URL is required. If --name is omitted, the target name is derived from the database name in the source URL.

By default, the command verifies connectivity to all provided database URLs before saving the target. Use --no-verify to skip this check.

Examples

Add a target with minimal configuration (name derived from database name):

clonit targets add --src-url "postgresql://user:pass@localhost:5432/mydb"

Add a target with all options:

clonit targets add \
  --name production-snap \
  --db-type postgres \
  --src-url "postgresql://user:pass@prod-host:5432/appdb" \
  --dst-url "postgresql://user:pass@localhost:5432/appdb_restore" \
  --sanitize-dst-url "postgresql://user:pass@localhost:5432/appdb_sanitize" \
  --sanitize-query-file /path/to/sanitize.sql \
  --storage-profile my-s3 \
  --dump-jobs 4 \
  --restore-jobs 4

Add a target with schema filtering (include only public and tenant_* schemas):

clonit targets add \
  --src-url "postgresql://user:pass@prod-host:5432/appdb" \
  --src-schema-include public,tenant_*

Exclude temporary schemas from dump:

clonit targets add \
  --src-url "postgresql://user:pass@prod-host:5432/appdb" \
  --src-schema-exclude temp_*,pg_temp_*

Add a target without verifying connectivity:

clonit targets add \
  --src-url "postgresql://user:pass@remote-host:5432/mydb" \
  --no-verify

Add a keyless AWS RDS IAM target (no stored password — the agent mints a short-lived IAM token per connection):

clonit targets add \
  --src-url "postgres://appuser@db.abc123.us-east-1.rds.amazonaws.com:5432/app" \
  --db-auth-mode rds_iam
  # --db-region us-east-1   (optional; derived from the RDS hostname when omitted)

Keyless RDS IAM auth (`--db-auth-mode rds_iam`)

With --db-auth-mode rds_iam the target stores no database password. The agent mints a short-lived AWS RDS IAM token from its own AWS credential chain (instance/task role in AWS, or env keys / a shared profile outside AWS) and uses it as the password over certificate-verified TLS. Use --aws-profile to sign the tokens with a specific shared AWS profile for this target; otherwise the agent-wide aws.profile config applies, then the ambient credential chain. This requires an RDS CA bundle — set rds_ca_bundle_path (see Configuration); with no CA bundle the connection fails closed. Any password in --src-url/--dst-url is ignored. Create-time URL verification is skipped for rds_iam targets; check connectivity with targets verify instead. See Keyless credentials for the full setup.

Schema Filtering

Schema filter flags accept comma-separated glob patterns. These control which PostgreSQL schemas are included or excluded during dump and restore operations.

--src-schema-include / --src-schema-exclude apply to pg_dump (build)
--dst-schema-include / --dst-schema-exclude apply to pg_restore (load)

Include and exclude are mutually exclusive for the same direction (src or dst). If both are set, include takes precedence.

Glob patterns support * as a wildcard. For example, tenant_* matches tenant_1, tenant_abc, etc.