Repairing an installation
ohm install is not only the installer. Run it again on a host that is already installed and it
repairs whatever it finds: a lost key, a broken container, a changed hostname.
$ sudo ohm installIt prints what will happen to every secret - kept, created, or replaced - and then gets on with it. It asks nothing, unless the license agreement has changed since this server accepted it: run from a terminal, it then shows the new version and asks once. The environment is offline for the duration: every Odoo instance stops while the containers are recreated. Then it rewrites the units and the configuration files and recreates every container with fresh images.
A repair ignores the bootstrap document. Options and
ANTELAO_INSTALL_* variables given on the command line do apply.
What a repair keeps
Your credentials are kept. The agent keys, the console key, and the admin password and TOTP
all survive, so whatever signed in before the repair still signs in after it. A repair is run to fix
something; replacing working credentials at the same time turns one problem into two.
A repair also leaves the admin account's state alone: a locked or disabled account stays locked or
disabled, because the lockout is what holds off someone guessing the password, and every update runs
this same command. When the account is locked or disabled, the hand-off says so and names the
command that opens it:
$ ohm user unlock adminA password set with --admin-password-file, or the new one --rotate-secrets prints, is a reset,
and that does open the account.
A repair never touches the master database, the instances, the backups, the license, the certificates, or the key rings the stored secrets are encrypted under. The one exception is a rename, below: the old management certificate does not cover the new name, so it is replaced.
Replacing the credentials
Add --rotate-secrets to replace them instead: new agent keys, a new console key, a new admin
password printed in the hand-off, and the TOTP cleared. That is how you get back in when the second
factor is the thing that is lost, and how you retire a credential that has leaked.
$ sudo ohm install --rotate-secretsGoing back to an older release
A repair never takes the server back to an older release by itself. When Update in the console has moved the server ahead of the installed package, a repair with that older package keeps the newer release and says so.
To go back on purpose, install the older release's package and repair with --move-pin-down:
$ sudo ohm install --move-pin-downIt is refused, and nothing is changed, when the master database was already written by the newer release: no release moves a database back to an older schema. Restore a database from before the newer release first, or stay on it.
Renaming the server
Renaming the server is the same repair, made explicit - a repair never asks for the name. Rename on the bootstrap agent's Configuration page, or on the host:
$ sudo ohm server rename new.example.comsudo ANTELAO_INSTALL_HOSTNAME=new.example.com ohm install
Either requests a certificate for the new name in the configured mode. The plan the repair prints says what the rename does before it starts:
Hostname: REPLACED - old-name -> new.example.com; the console, the agent and the API answer to the new name
Management certificate: REPLACED - a new certificate for new.example.com from the same root CA; ...
The console gets a self-signed certificate for the new name from the same root CA first, so machines that already trust that root keep trusting it. In Let's Encrypt or Custom mode the request follows; if it does not take effect, the self-signed one stays and the run says why. The hand-off at the end repeats the outcome in one line. See Renaming the server.
The tool and the installation are separate. A newer ohm sits on a host whose containers, units and
configuration are still the ones the previous version wrote. Every local command says so when the
binary is newer than the recorded install, and names both versions. The warning is never fatal and
never a prompt; the command you asked for still runs. ohm install is what closes the gap. See
Updates.