Operations
This section is for the people who run an instance: its superusers and whoever has root on its servers.
- Updates: new versions of services, the node agent and the CLI, with rollbacks.
- Backups and restores: destinations, plans, drills, and bringing the whole instance back.
- Nodes: adding servers for apps, edge and relay, quotas, moving and removing nodes.
- People, teams and limits: inviting users, superusers, plans, recovery.
- Look and branding: the instance's name, colours, logo and background; white-label builds.
- Security: what to protect, where secrets live, hardening the servers.
- Troubleshooting: symptoms, where to look, and the commands that tell you.
Before you change production
- Identify the service, app, node and data an action touches, and look at their current state first.
- Back up before migrations, restores or deleting anything you can't recreate.
- An image rollback is not a data rollback: a schema migration stays when the old code comes back.
- Keep the previous live release until its replacement is healthy.
- Don't paste logs with credentials into tickets: env files, database URLs, OAuth callbacks, registry
tokens and sealing keys are not diagnostic output.
Where things run
| Server |
Runs |
| control plane |
PostgreSQL, Caddy, xvii-node, every platform service (xvii-<service>.service) |
| nodes |
xvii-node as an agent, Docker, the team networks and app containers |
| name servers |
xvii-node dns answering on port 53 (any two servers) |
| mail edge |
xvii-node edge relaying mail ports (optional) |
The control plane's state lives in PostgreSQL (one database per service) and under /etc/xvii and
/var/lib/xvii. See Configuration for the layout.
Everyday commands on the control plane
xvii-node status # services, versions, health
xvii-node logs pages 200 # a service's journal
xvii-node install pages # install or update from the store
xvii-node recover alice # a sign-in link for someone locked out
systemctl status xvii-node
journalctl -u xvii-apps -n 50 --no-pager