Upgrades, backups and logs

Upgrading the server

Copy the new server package to the server and run its installer, as for the first install:

tar xzf obsidian-remote-server-<version>-linux-x64.tar.gz
sudo obsidian-remote-server-<version>-linux-x64/deploy/install.sh obsidian-remote-server-<version>-linux-x64/server

It stops the service, replaces the program in /opt/obsidian-remote (keeping the previous version as /opt/obsidian-remote.old), and starts it again. Your configuration in /etc/obsidian-remote and your data in /var/lib/obsidian-remote are never touched. Changes to the database are applied automatically when the new version starts.

PCs reconnect by themselves after the short restart. Sessions in progress through the relay end and have to be started again.

Rolling back

Stop the service, put /opt/obsidian-remote.old back in place of /opt/obsidian-remote, and start it again. This is only safe if the newer version didn't change the database; the release notes say when it did.

Backups

Back up the data folder and the configuration:

File	Why it matters
`/var/lib/obsidian-remote/obsidian-remote.db`	Users, devices and the keys their IDs are tied to, groups, address books, policies, the audit log and settings.
`/var/lib/obsidian-remote/data.key`	Unlocks the passwords saved in personal address books. Lose it and those passwords are gone.
`/var/lib/obsidian-remote/cert.pem` and `key.pem`	The server's own certificate. A new one changes the server key, and every PC would need the new config string.
`/etc/obsidian-remote/server.json`	Your configuration.

For a consistent copy, stop the service, copy both folders, and start it again:

sudo systemctl stop obsidian-remote
sudo tar czf obsidian-remote-backup.tar.gz /var/lib/obsidian-remote /etc/obsidian-remote
sudo systemctl start obsidian-remote

Keep the backup safe: data.key and key.pem are secrets.

To restore, install the same or a newer version, put the files back (owned by the obsidian-remote user, with the data folder at mode 0750), and start the service.

Logs and health

journalctl -u obsidian-remote -f
journalctl -u obsidian-remote -n 50
curl -sk https://127.0.0.1:21114/healthz

The first follows the log live. The second shows the latest lines, including the server key and startup problems. The third answers ok when the server is running.

The log records PCs coming online (with their ID, name and address) and going offline, and relayed sessions. It never contains passwords, keys or sign-in tokens. Who did what is in the admin console's audit log (see The admin console).

Removing the server

sudo systemctl disable --now obsidian-remote
sudo rm /etc/systemd/system/obsidian-remote.service
sudo systemctl daemon-reload
sudo rm -rf /opt/obsidian-remote /opt/obsidian-remote.old

Only if you no longer need the data, also remove it and the service user:

sudo rm -rf /var/lib/obsidian-remote /etc/obsidian-remote
sudo userdel obsidian-remote