senddock-cli — admin and ops CLI bundled in the Docker image

[JuansesDev]

Problem

Self-hosters in production hit several scenarios where the web UI is the wrong tool:

• The admin lost their password and registration is disabled → no way back in
• A new server bootstraps in a CI / Ansible / Terraform pipeline and needs an admin account created non-interactively
• An operator wants to export all subscribers from a project for backup or audit, without clicking through a UI
• The license key needs to be re-applied after a SENDDOCK_LICENSE_KEY env change without restarting
• A subscriber needs to be wiped completely (GDPR erasure request) and the operator wants to verify it via CLI, not trust the UI

The roadmap mentions this in Phase 13 ("CLI tool for admin tasks") but there's no issue tracking it.

Proposal

A senddock-cli binary that ships in the same container image as the server and talks to the database directly (read/write) using the same migrations and sqlc-generated queries — no HTTP round-trips, no auth needed (it runs server-side on a trusted host).

Commands

senddock-cli admin create --email <e> --password <p>
senddock-cli admin reset-password --email <e>             # prompts for new password
senddock-cli admin list
senddock-cli admin disable --email <e>

senddock-cli project list
senddock-cli project export --id <id> --format=csv|json   # subscribers + custom fields

senddock-cli subscriber delete --project <id> --email <e> # GDPR erasure: removes from subs, logs, suppressions
senddock-cli subscriber list --project <id> [--status=active|pending|unsubscribed]

senddock-cli license activate --key <k>
senddock-cli license status

senddock-cli migrate up | down | status                    # wraps goose
senddock-cli health                                        # checks DB, Redis, SMTP-test if configured

senddock-cli version

Distribution

• Build alongside the server: cmd/senddock-cli/main.go → senddock-cli binary
• Bundled into the Docker image at /usr/local/bin/senddock-cli so users can docker compose exec senddock senddock-cli admin reset-password --email me@x.com out of the box
• Reads DATABASE_URL from the same env the server uses; refuses to run if the env is missing

UX rules

• All destructive commands prompt for confirmation unless --yes is passed (for scripting)
• Passwords are read from stdin if not provided as flag (avoids history leak)
• Output is human-readable by default and machine-parseable with --json
• Exit codes follow convention: 0 ok, 1 user error, 2 system error

Acceptance criteria

• cmd/senddock-cli/ builds a standalone binary
• All commands above implemented and tested
• Binary shipped in the official Docker image
• Documentation page at docs.senddock.dev/self-hosting/cli with a recipe for each command
• README mentions it in the Self-hosting section
• docker compose exec senddock senddock-cli --help works on a default deployment

Tier

Core — operational sanity for self-hosters. Locking ops tooling behind Pro would be hostile to the people running their own infrastructure.