feat: add service filter for uploads

Author: Shawiizz

cli/src/commands/deploy-phases.ts

@@ -85,7 +85,15 @@ export async function uploadFiles(ctx: DeployContext): Promise<UploadRollbackPla
 
   if (!uploads || uploads.length === 0) return plan;
 
+  const serviceFilter = ctx.options.services
+    ? new Set(ctx.options.services.split(',').map((s: string) => s.trim()))
+    : null;
+
   for (const upload of uploads) {
+    if (serviceFilter && upload.service) {
+      const uploadServices = Array.isArray(upload.service) ? upload.service : [upload.service];
+      if (!uploadServices.some(s => serviceFilter.has(s))) continue;
+    }
     const srcAbs = resolve(ctx.projectRoot, upload.src);
 
     if (!existsSync(srcAbs)) {

cli/src/schemas/config.schema.ts

@@ -302,6 +302,8 @@ export const UploadItemSchema = z.object({
   dest: z.string()
     .refine(v => v.startsWith('/'), { message: 'dest must be an absolute path (starting with /)' })
     .describe('Absolute destination path on the remote server'),
+  service: z.union([z.string(), z.array(z.string())]).optional()
+    .describe('Service(s) this upload belongs to. When --services is used, only uploads matching a targeted service are transferred.'),
 });
 
 /**

cli/src/utils/config.ts

@@ -138,6 +138,7 @@ export interface NotificationsConfig {
 export interface UploadItem {
   src: string;
   dest: string;
+  service?: string | string[];
 }
 
 export interface DockflowConfig {

docs/app/configuration/upload/page.mdx

@@ -29,6 +29,7 @@ services:
 |-------|------|-------------|---------|
 | `src` | `string` | Local path relative to the project root (file or directory) | Yes |
 | `dest` | `string` | Absolute destination path on the remote server | Yes |
+| `service` | `string \| string[]` | Service(s) this upload belongs to. When deploying with `--services`, only uploads matching a targeted service are transferred. Uploads without this field are always transferred. | No |
 
 `dest` must start with `/`. If `src` is a directory, `dest` is used as the destination directory and the relative structure is preserved.
 
@@ -80,6 +81,24 @@ upload:
   File permissions are not preserved (files are created with the server's default umask). If a service requires specific permissions (e.g., `640` for `mosquitto_passwd`), add a `post-deploy` hook that runs `chmod`.
 </Callout>
 
+## Scoping uploads to a service
+
+When using `--services` to deploy a single service, uploads without a `service` field still run. Use the `service` field to restrict an upload to specific services:
+
+```yaml
+upload:
+  - src: .dockflow/docker/mosquitto/
+    dest: /opt/dockflow/mqtt/
+    service: mqtt                    # only transferred when deploying the mqtt service
+
+  - src: .dockflow/docker/prometheus.yml
+    dest: /opt/dockflow/monitoring/prometheus.yml
+    service: [prometheus, grafana]   # transferred when either service is targeted
+
+  - src: .dockflow/shared.conf
+    dest: /opt/dockflow/shared.conf  # no service field → always transferred
+```
+
 ## Full example
 
 ```yaml
@@ -89,8 +108,10 @@ project_name: my-app
 upload:
   - src: .dockflow/docker/mosquitto/
     dest: /opt/dockflow/mqtt/
+    service: mqtt
   - src: .dockflow/docker/prometheus.yml
     dest: /opt/dockflow/monitoring/prometheus.yml
+    service: prometheus
 ```
 
 ```yaml