Docs changelog

What changed in this documentation, newest first. Each entry links the affected pages. The log starts at the public launch of the new docs site alongside BOA-5.88.8 Continuity Edition — earlier drafting predates the public site and is not listed.

2026-09-09

• Changed: six residual items of the launcher-window and nightly class closed in one pass: dcysetup puts websh back on /bin/sh after its dependency install (Backups); the barracuda strict block stages its websh copy and renames it (Strict binary permissions); a new lshell release ends only the lshell group's sessions (lshell + manage_ltd_users); the platform ownership script refuses a tree without sites/ for every Drupal generation (a Drupal 7 tree used to slip through, Task failures); autoupboa keeps an apt drop-in that bounds every transfer attempt at 30 s of silence (apt's own value, pinned) with three retries (_APT_ACQUIRE_POLICY, Essential settings); and the nightly runs one at a time with every per-account pass bounded by _NIGHT_ACCOUNT_MAX (default six hours; a stopped pass or a skipped nightly is logged and mailed, barracuda.cnf, variables).

• Changed: every csf.allow provider range is now allowed on both web ports. The crawler and WAF providers (Googlebot, Google's special-case crawlers, Bingbot, Imperva, Sucuri, Auth0, Site24x7) were port-80-only, so a csf.deny hit on one of their addresses blocked its https traffic while http stayed open; they join Cloudflare and the two uptime monitors on 80 and 443, and the membership test is exact-line, so a manual entry with the same address never blocks a provider's own line. Found on the way and fixed: the csf.allow diff-guard compared the raw files, and since the pass re-appends its three resolver lines at the end, any operator line appended after a daily pass made the guard roll the whole provider refresh back, silently, on every pass from then on (NO … diff1 in /var/backups/dragon/t/csf.log); it now compares sorted copies, so only a changed or missing operator line counts — and a rollback is no longer silent: it goes to the incident log and to _MY_EMAIL as an ALERT naming the rejected copy, the snapshot and the diff. Documented on Ban pipeline.

• Fixed: a firewall disabled with csf -x stayed disabled. The per-minute watchdog's only remedy was service lfd start, which CSF refuses while its disable marker exists (and exits 0, so the log claimed a start that never happened, every pass). The watchdog now re-enables CSF once the marker is ten minutes old, unless a BOA pass is in flight, verifies lfd came up before logging the start, and sends an ALERT naming how long the firewall was off; the grace is _CSF_DISABLE_GRACE_SECS. Documented on CSF firewall and Auto-healing.

• Changed: the read-only orphan report (autosymlink report, updatesymlinks --orphan-report) now says per orphan what the nightly sweep would do with it: left in place when a share control file names it or a registered site still reads it through its own files/private link, archived otherwise; the reuse-time archive raises an [ALERT] when a registered site still reads the stale store it moves (that reader's link dangles until its unshare is re-run). Documented on Orphans archiving.

• Changed: the barracuda and octopus launcher wrappers put websh back on /bin/sh as the last thing they do, completed or aborted. Until now a pass left the box on plain dash until the next quiet ltd worker or agent tick — minutes after every pass, longer through back-to-back passes — with shell accounts running without the per-account PHP-CLI pin and websh's Drush option refusals, and lfd's hourly integrity check catching the box mid-flip. Documented on Strict binary permissions and lshell + manage_ltd_users, which also states that a legacy lshell 0.10 box runs the same per-command LD_PRELOAD= prefix through websh (measured on the legacy tarball).

• Added: UptimeRobot's monitoring addresses join the daily csf.allow provider refresh next to Pingdom — the IPv4 hosts allowed on both web ports, the IPv6 hosts mirrored into the nginx-native allow store — with the A/AAAA records of ip.uptimerobot.com as the fallback source; UptimeRobot's checks, like Pingdom's, are exempt from the one-hour bot page-cache expiry so a monitor sees the live backend. In the same pass every fetched provider refresh (Cloudflare, Pingdom, Bingbot, Imperva, Auth0, Site24x7, joining the two Google refreshes) now fetches before it clears its own tagged lines and keeps the existing entries when the list comes back empty, and Pingdom's probes are allowed on 443 as well as 80. Two defects found in review are fixed in the same pass: the resolver lines the pass keeps for its own DNS egress were matched by a wildcard that also fit a live Cloudflare range, a Pingdom probe and a dozen Site24x7 hosts (re-added by the next refresh until now, so never noticed), and the IPv4 validator accepted a /0 prefix — the floor is now /8. Documented on Ban pipeline; the .whitelist.dont.cleanup.cnf and .extended.firewall.exceptions.cnf rows of the control-file reference and the control files overview follow.

• Fixed: the account's Drush 8 ini (~/.drush/php.ini) no longer carries open_basedir, and websh hands it to Drush 8 and Composer for shell accounts and sub-accounts only; the instance user and the Ægir master stay on the global php.ini. Since the 8 September change every Drush 8 and Composer websh started ran under the file's open_basedir, which turns PHP's realpath cache off and checks every file operation against every listed tree uncached: a tenant's minimal Drush 8 start took eight times longer, and every instance user's per-minute queue runners (hosting-tasks, hosting-cron, hosting-civicrm_cron) took a hundred seconds instead of three (3.5 million stats), piled up, and every server, the small ones visibly, sat at high load for a day. open_basedir was never meant for the CLI; the worker removes it from the inis already on disk. The web tier is untouched. Documented on lshell + manage_ltd_users.

2026-09-08

• Install BOA: a new "If the install is interrupted" section. An install that stops before the Ægir master exists has two ways forward on the same box, no wipe: barracuda up-<tree> system continues it (the launcher seeds the install's own hostname, e-mail and PHP set again from the record it wrote at the start), or the recorded install command run again after touch /root/.force.reinstall.cnf — and the refusal an operator meets without that control file now names the recorded command and both ways forward.

• Your files storage + files-symlinking overview: a rename sets the old-name store aside at once (RENAME/STORE/ARCHIVED), the same way a delete does. Later the same day the operating pages caught up: the files-symlinking overview event table (the Migrate / rename row says the task sets the old-name store aside, and a new Delete row describes the Delete task's own archive), orphans & archiving (a task-time archiving section for delete and rename, and the opt-out switch's hold on it) and the site cloning Migrate / rename bullet no longer say the old-name store waits for the nightly sweep; the chapter page, the configuration and control files rows for the opt-out switch (it holds the rename's archive too), your files storage and task failures (the section now covers the rename) followed. New behaviour documented with it: a store some live site still reads through its own files/private link — a clone whose unshare was refused for disk space, a renamed site whose re-home did not complete — is never moved into the archive, by the delete, the rename or the nightly sweep; the task says …/STORE/LEFT and autosymlink.log names the link.

• Changed: on Ægir to BOA and migrating from vanilla Ægir: the three aegir2boa tools are now fetched to every BOA server with the other BOA tools and kept current under /opt/local/bin, so the BOA target end of a migration is always ready. The vanilla source still takes its own copies (from the target, or the mirror as before), check and pre-mig say so when the two stage-2 copies differ, and stage 1 refuses to run on a BOA server.

• Added: on branches and editions: a staged build tree of another tree is never reused — _download_boa_code reads the tree name baked into the staged libs and drops /opt/tmp/boa with a NOTE: when it differs from the running tree. A switch at the same release number used to run the old tree's code while logging the new one.

• Your files storage + task failures: a Migrate under a new name sets the old-name store aside the way a delete does (RENAME/STORE/ARCHIVED); the task queue folds a second queued task of a kind for a node into the waiting one, and a site or platform Delete cancels the node's remaining queued tasks.

• Changed: on Ægir to BOA and migrating from vanilla Ægir, the tool download snippet no longer names a mirror tree: it reads versions/${_TREE}/ with _TREE=lts set one line above, and the text says to set _TREE to the tree your BOA server runs. Why: the same snippet lives in the runbook shipped inside every BOA tree, and a tree-neutral line keeps those copies identical.

• Added: on serial & fetch pipeline: the agent pass now removes a stray Drush tree at /drush (and its rotated copies under /backups/system) and dates each repair in /var/log/boa/stray-drush.incident.log. An earlier master Drush refresh, run without its root, had copied the tree to the filesystem root; Drush 10/11 search <root>/drush with an empty root, so on such a box every tenant's modern Drush died in preflight once lshell's Landlock domain refused the read. Only the tree BOA itself copied is removed: the fork's own marker files rule out an operator's /drush.

• Corrected: on the files-symlinking overview, the chapter page and the configuration reference: the clone is not the only task which breaks a deliberate file share — every copying task does (a clone, a migrate or rename, both Backdrop upgrade tasks), and restoring a backup which carried the files ends a share in practice, since that archive followed the link when it was taken. Why: the code passes --force-unshare on every copying task; the pages had named the clone alone.

• Your files storage + Task failures: the Delete task sets the site's per-account static store aside under static/files/.archived/ itself (DELETE/STORE/ARCHIVED; LEFT as a warning when a share control file names the store, KEPT under the orphan-archiving switch) and deletes a never-verified site's read-only (0555) directory cleanly; the nightly sweep stays as the safety net.

• Provision backend + Task failures: the deploy updatedb is addressed by --root/--uri (never by the site's Drush 10+ alias), the Drush 10+ alias store refresh runs on the backend's own interpreter and php.ini, and both failing are warnings (DRUSH/TEN/ALIASES/FAIL, DEPLOY9/LOCAL/DRUSH/FAIL); the provision-backend page's stale "chmod-only exec window" bullet replaced by the real unlock/re-lock window.

• Changed: on provision backend: the D11+ site-install and its user:login, pm:list and pm:uninstall calls run the site-local Drush in the same exec form as the deploy path (the backend's own PHP first, on its own php.ini, then the interpreter options, then the launcher), so the line survives whichever /bin/sh the box has during the task and never inherits the account's Drush 8 ini, which a modern Drush refuses.

• Changed: on your files & storage, two new sections: what a restore does to a site's files (the archive's files land in the site's own store, the previous content is set aside, a database-only archive leaves the current uploads alone, a deliberate share is never forced open by the restore task though restoring a files-carrying archive ends one in practice) and what a delete does (the leftover store is never deleted; the nightly maintenance on the servers we host sets it aside into the dated archive, an opt-in elsewhere, pruning is the operator's call, and a reused name archives the leftover at task time on every box). On the files-symlinking overview, the event table now lists the two Backdrop upgrade tasks, which re-home the copy into its own store with --force-unshare (before the Backdrop conversion on the D7 task; right after the deploy's own D6 → D7 updatedb on the D6 hop). Why: the customer page named the Backdrop upgrade among the copying tasks while the operating table did not, and neither page said what a restore does to the files.

• Changed: on hostmaster upgrade, serial pipeline and staged setup: every archive fetch (boa.tar.gz, backend.tar.gz and the rest through _get_dev_ext) now carries a per-call query, so a CDN edge that still holds the previous archive can no longer decide which backend an upgrade installs; _DL_NOCACHE=NO is the only opt-out. Why: measured on a test box, one colo served the old backend archive for some forty minutes after the purge and a forced instance upgrade installed it.

• Changed: on task failures, the D10/D11 section: the container and cache rebuild of a Drupal 10+ site is now done by Drupal core itself in a Drush-free subprocess (REBUILD/CORE/CMD, DONE, OK; a rebuild that did not happen is a REBUILD/CORE/FAIL warning with the reason), and a clone, migrate, rename or restore runs updatedb inside a real platform unlock and re-lock (DEPLOY2/LOCAL/DRUSH/UNLOCK ... DEPLOY10/LOCAL/DRUSH/LOCK), with that core rebuild as the last container write. Why: a locked D10/D11 platform runs no site-local Drush at all under PHP 8, so the previous chmod-only windows opened the exec bits and every drush cr, --version and updatedb in them died at class load unseen — no D10+ Verify rebuilt anything and no D10+ deploy ran its schema updates. The page says what the old log looks like, so a box still on the old backend can be recognised. The same mechanism is named on the command line, provision backend and hosting module suite pages.

• Changed: on lshell + manage_ltd_users: websh routes a shell line by its leading word, so grep -c drush file, grep -c "drush make" file and drush8 status | grep -i "drush version" work for shell accounts (they were routed through Drush and refused or mangled), drush8 status sa is a status filter and not the alias list, and a Drush line's arguments reach Drush as typed, single quotes included. The forbidden Drush commands (php-eval, php-script, core-cli, site-install, ...) are refused by their command word wherever the @alias or the options or a redirection sit, in either spelling (php-eval, php:eval) and in every pipeline segment (This drush command is not available (E)): drush8 @site scr file.php ran a shell account's own file as PHP through the real login chain. An environment word of the account's own in front of Drush, Composer or PHP (PHPRC=…) is refused as well ((F)). A Drush behind a pipe runs on the box default PHP, not the account's pin.

• Fixed: the arguments of a Drush launcher line (vendor/drush/drush/drush.php …, php …/drush.php …) and of a Composer line reach the command as typed. websh used to strip every single quote from such a line and re-split it on spaces, so a quoted multi-word value lost everything after its first word (a control-panel server verify saved the server's restart command as sudo alone, and nginx was never reloaded from that alias again) and a quoted * was expanded against the current directory. cd DIR && composer … now runs Composer in that directory on the account's PHP instead of failing with Command "cd" is not defined.

• Fixed: Drush 8 and Composer started by websh for a shell account or an instance now run on the account's own ~/.drush/php.ini — temp, upload and session paths under ~/.tmp, open_basedir on the account's trees — the file the Drush launcher already applied, handed to the interpreter as an option; a modern Drush and a plain php line stay on the global php.ini (modern Drush refuses open_basedir). websh looked for an older per-version layout nobody writes, so its launches ran on the global php.ini with /tmp as the temp directory; a /tmp that lost its permissions took Composer away from every shell account while their own ~/.tmp was fine. Documented on lshell + manage_ltd_users.

2026-09-07

• Corrected, same night: the new platform-level developer account section on extra accounts said the account reaches every qualifying platform read-write. It reaches them, but writes only where your main login writes: the site directories and platforms you deployed under ~/static/; platforms installed by the control panel stay read-only for everyone. The operator page says the same.

• Changed: on lshell + manage_ltd_users: Drush's file-loading options --config/-c, --early and --include/-i are refused for shell accounts (each loads a file as PHP, so it ran a tenant's own code as Drush past every forbidden token; measured through the real login chain), however spelled or quoted, and a grep -c behind a Drush pipe keeps its -c again.

• Added: on extra accounts a section on the platform-level developer account your host can enable: a second login per Client that reaches every platform where all the sites are that Client's, with Composer, Git and Drush, the same platforms over SFTP, and a 60-minute Drush unlock window opened by touching ~/.tmp/drush-window.request. The operator side is on lshell and ltd users, and the _LTD_PLATFORM_CLIENTS setting is on the octopus.cnf reference and the variables index.

• Changed: on the manual BOA upgrade page: the launcher's final line has a fourth form, ... WITH ERRORS -- review <log>; new kernel, run 'boa reboot' after the review, for a pass that both failed and installed a kernel — a failure no longer hides the reboot the new kernel still needs, and the alert mail's subject carries the same note; an interactive run is now judged the same way as a silent one (it still mails nothing); and the page says what the verdict counts: every OOPS: line is a failure, while anomalies the pass heals itself (a curl rebuilt after a codename hop, a mirror retried for build-essential, a regenerated sources.list) are NOTE: lines.

• Added: on serial & fetch pipeline: the agent pass now heals /tmp to 1777 root:root on every pass and dates each repair in /var/log/boa/tmp-perms.incident.log; a test box had it at 0700, which left every tenant's composer and PHP CLI without a temp directory and nothing in any log saying so.

• Changed: on lshell + manage_ltd_users: the noexec layer is back for every allowed command outside allowed_shell_escape, per pipeline segment. lshell 0.11 could not preload sudo_noexec.so on the shell the command runs through, so find -exec or GNU sed's e executed freely; lshell 0.11.8 writes the library into the line itself as an LD_PRELOAD= prefix on each such segment, so drush status | grep x still lets Drush run PHP while find … | true cannot exec anything. scp and myloader join the shell-escape list (their transport and wrapper must exec); setuid tools and the SFTP protocol binaries are never prefixed. Ruled the same day: mc, svn commit without -m, cvs and bzr stay confined (no spawned editor, viewer or shell pane), as under lshell 0.10.

• Corrected, same day: on developer sub-accounts: the entry below said the panel's cache-clear buttons are reserved for administrators. They are not: the aegir client role holds Flush all caches and Rebuild registry through BOA's own hostmaster settings feature (checked in a live control panel), so the page now says cache clears are done from your control-panel login, with Verify as the second route. On when something's wrong the symptom index now uses the same Drush route as the shell section (drush cc all on Drupal 7, vdrush @<site-alias> cr on Drupal 8 and newer). On shell extras scp now carries its Node-gate condition and the removal section follows the provisioning section: site ownership, not the Client's Users list, is what creates and removes a sub-account.

• Corrected: on developer sub-accounts: the page told you that everything on the shell page applied to an extra account including the same programs, and repeated it in the closing cross-reference, both contradicting the capability list directly above them. Only the SFTP and SSH-key parts are shared; the command list is the shorter one on that page. It also said cache clears are done from the sub-account's control-panel account, but the dedicated cache-clear buttons are granted to administrators only, so a client-role login has never been able to press one: Verify is the task that rebuilds a Drupal 8+ site's caches and compiled container, and the page now says so. scp is listed with the same condition its sibling page already carried, since it is stripped wherever the Node gate is off.

• Corrected: on when something's wrong: the page told Drupal 8+ users to run a bare drush cr from inside a site folder. Bare drush is the legacy Drush 8, which cannot bootstrap a modern site, so that advice could only fail. It now points at the site-local route on Drush basics.

• Changed: on the serial & fetch pipeline: a pass that fetched nothing now says so. Each silently discarded fetch is counted and reported once per pass, to the console and to /var/log/boa/mirror.incident.log, so a box stuck on an old tool can be told apart from a box that was already current. The mirror health check reads a small object inside the tree the box fetches from instead of the mirror's root, since a mirror can serve / while carrying no copy of that tree, and falls back to the publisher; the five-minute self-update fetches the meta installer to a file and checks its first line before running it.

• Changed: on PHP version, the control-files reference and the shell and drush cheat sheet: cli.info is an instant switch too — it applies to your next drush/composer/bee run, exactly like a phpNN.info marker, while the background helper still re-pins the account's Drush copy and the Ægir task runner within three minutes; a value naming a version that is not installed runs on the server default until the helper corrects the file; the markers are the temporary override of that lasting default.

• Changed: on xmass server move: the site-less test prep-target applies before purging a target-only account now reads three sources on the target (registered site aliases with the account's own panel set aside, the sites/ directory of every registered platform, and a site-directory sweep over every platform layout including the web/ and docroot/ docroots) and never treats an unreadable inventory as empty; the purge description lists the five trees boa cleanup purge removes and what it parks.

• Changed: on database credentials: the command-line recovery reads the drushrc.php values as the var_export() literals they are written as, so an adopted site's password with an apostrophe or a backslash arrives intact. On per-instance group: the limited shell's Landlock writable set is the account's own roots plus the stores BOA linked in as root; a link a tenant places never widens it.

2026-09-06

• Changed: on the hostmaster frontend page: eldir now ships its own maintenance-page.tpl.php, so a panel held in Drupal maintenance mode (the xoct/xmass panel hold, a disabled site) and the fatal-error fallback page render in the panel's own shell instead of core's stock template, which eldir's stylesheet turned into a broken-looking page; the section names the two paths and the theme-registry rebuild an in-place copy needs. On xoct account move, xmass server move and Ægir to BOA: the panel hold now flushes the panel's page cache in the same step — the variable change alone left the cached anonymous front page in place, so the hold stayed invisible to visitors until the next cache clear.
• Changed: on the per-instance group page: a first conversion also waits for the BOA release that carries the Octopus arm to stamp the box (/var/log/boa/instgrp-arm.ready.txt, shown by instgrp check as arm:), so tools published ahead of an upgrade cannot convert an account against the box's older libraries; an already converted account is unaffected.
• Changed: on xmass server move and xoct account move: prep-target now runs the target-silence gate before every account create, and xoct create counts an armed run-upgrade.pid as busy and requires two consecutive quiet polls — the third account of a whole-server move was launched into an "Another BOA installer is running" refusal by the pass the second account's seed had just armed. On the files symlinking tools reference: the per-tenant caller gate of fix-drupal-site-symlinks.sh and how the account's own control panel is recognised (by the uri in hostmaster.alias.drushrc.php) now that the <panel-fqdn> alias symlink it used to key on is purged. Later the same day, from the cutover of that rerun: the pre-freeze report of panel tasks travelling to the target counts current task revisions only (a naive count named years of finished verifies and deletes); xoct proxy converts an account that holds nothing but its control panel by definition instead of leaving it 503-gated; and xmass verify samples a client-domain site (direct and relayed) plus a box-subdomain site by its new name, skips the panel, and reads a matching 401/403 as a protected site rather than a breakage.
• Added: on xmass server move, "The replication transport is TLS": the stream now runs over TLS (a REQUIRE SSL replication user, SOURCE_SSL=1, proven from both sides once the replica runs, refused in the clear), the new xmass status transport line and the deliberate _XMASS_PLAIN_REPLICATION=YES opt-out.
• Added: on FPM capacity, the PHP CLI memory floor: _USE_CLI is now a quarter of installed RAM, capped at 1024 MB, whenever the RAM ladder derived less (a 4 GB box with the default 2 GB reserve derived 466 MB, which no Drupal 11 distribution install survives). On Task failures and the Provision backend page, the Drupal 11 site-install subprocess now runs with the same floor, its D11/INSTALL/MEM line shows the limit that applied, and a failed install logs D11/INSTALL/RC (exit status with a reading) and D11/INSTALL/PHPLOG (the tail of the child's own PHP error log, kept in ~/log/) instead of stopping silently after its last "module installed" line. The new per-account install-memory.info pin is in the control files reference and the control files cheat sheet.
• Changed: on the lshell + manage_ltd_users page (item 7) and on Security audit hardening: the lshell log directory /var/log/lsh is now root:lshellg 1770 (sticky) and the three-minute pass sweeps it — anything that is not a regular *.log, and a *.log owned by a user other than the one its name claims (a dead tenant's log on a recycled uid included), is removed; root's own chmod and the escape monitor's grep act on regular files only; fs.protected_fifos is level 2 for the same group-writable sticky case.
• Changed: on the manual BOA upgrade page, the launcher's final line has a third form: a pass whose only alert is the new-kernel notice ends with completed, REBOOT REQUIRED instead of WITH ERRORS.
• Added: on the xmass page, what the tools learned on the first live whole-server move: pre-mig gates every control panel's coherence fail-closed and reports the legacy panel alias symlink; three verbs wait for a silent target (_XMASS_TARGET_SILENT_MAX_WAIT, _XMASS_SKIP_TARGET_SILENCE); prep-target purges a site-less account the target carries but the source does not and refuses one with sites (_XMASS_ALLOW_TARGET_ONLY); init drops the target's pre-pass backup residue; cutover ends by opening every panel by its new name and verify repeats it; status names an unreadable replica.
• Changed: on the same page, the panel rewire always reconciles the panel's platform row and context with the on-disk platform, the migrated-in http-off gate is cleared before the renames, and the rename parks the old-name panel SSL-proxy include. On the xoct and cross-host migration pages: the proxy conversion never touches the control panels — they stay online on the old box in Drupal maintenance mode, master included — create waits for a quiet target and proves the install, and the migration notices are one paragraph per line.
• Added: on the Multi-Octopus page, "Cancelling and purging an instance": the log/CANCELLED marker plus boa cleanup detect|purge … noscreen is the whole procedure, with what the purge parks, proves and refuses; boa suspend and boa cleanup join the command reference.
• Added: on the lshell + manage_ltd_users page, pass 9: the legacy <panel-fqdn> alias symlink to the hostmaster alias is purged by shape on every box.
• Fixed: on the hostmaster upgrade internals page, websh dispatches absolute drush launchers ahead of its bare-verb branches, so provision's own cache-clear drush backend child reaches drush unchanged on a box whose /bin/sh is websh.
• Added: on the automated codename upgrades page, the chosen mirror's pool host is probed as well as its release files, since a mirror can serve one while the other's certificate has expired.

2026-09-05

• Added: on the automated codename upgrades page, what a driver does when a barracuda pass ends without its finale marker (one retry after 60 s, then two ERROR lines and how to resume) and the state of Chimaera's security suite since Debian 11 left LTS; on the Debian to Devuan page, how autoinit seeds an empty grub-pc boot-device answer itself, lists packages dpkg leaves unconfigured after a hop and stops before the install when any remain; on both pages, how a hop survives a security pool the mirror no longer serves.
• Changed: on the branches and editions page, the key-free hostname classes now pass the licence check with a NOTE when the key server cannot be reached; every other hostname still ends the run.
• Changed: on the per-instance group page, instgrp reclaim now skips an account frozen for a migration exactly as convert does (exit 4, --force overrides).
• Changed: on the serial & fetch pipeline page, the weekly PHP 7.4 intl self-heal now states that a weekly line carrying php-max never enters it: every PHP version stays installed there by policy, so the wrapper neither idles the versions no site uses nor rebuilds the set twice, and logs one INFO line instead.
• Added: on the per-instance group page, what happens when a new account's group name is already held by another identity: born on the box-wide group with a NOTE, no conversion attempt in that run, and every later upgrade alarms until the name is freed.
• Added: on the automated codename upgrades page, what every driver run does about cloud-init (removed when classic networking is provably self-sufficient, kept otherwise, /root/.preserve.cloud.init.cnf keeps it regardless) and how each hop picks a package mirror now that Debian 11 and, next, Devuan Chimaera move to the archives; the self-hosting upgrade guide carries the plain-language version.
• Corrected: the Debian to Devuan page said cloud-init is removed only in full mode; it is removed by default when the networking probe passes, and full mode only skips the probe. The .preserve.cloud.init.cnf opt-out joins the control-file reference.

2026-09-04

• Added: on the Ægir-to-BOA migration page, check now grades the Drupal 6 native-auth prerequisite per site from what the target server advertises, so a non-native target is named before anything is paused.
• Added: on Percona 8 readiness, what naming the plugin in authentication_policy implies for new database users (native by default; an explicit caching_sha2_password first factor is refused by the server).
• Corrected: BOA writes the native-auth policy (authentication_policy=mysql_native_password,,) on Percona 8.0 as well as 8.4, so the my.cnf lifecycle table, Percona 8 readiness, Percona setup and tuning and the Ægir-to-BOA migration page no longer say "8.4 only" or tell an 8.0 target to set default_authentication_plugin by hand. The Ægir-to-BOA page also says to re-run the preflight after the stage-1 flip (check reads the newest report's http service type) and gained the matching troubleshooting row.
• Corrected: the same-day time-and-staffing additions on the Drupal 7 exit pages, after review: the rename figure on the Drupal CMS migration guide and its self-hosting twin now matches the cloning page (a few seconds to a few minutes, by site size) and the unserved span runs from the first rename's start to the second's end; forms are checked on the target's own screens; the extra checks sit after the artifact list; on Upgrading from Drupal 7 the editors' pause lasts until the cutover completes, the final run is preceded by deleting the proven copy, the first ground rule includes the database updates, and the unsupported Panels/Context/Display Suite sentence is gone; Leaving Drupal 7 scopes the panel tasks to you (host only for the Backdrop upgrade task), makes the unserved window route-neutral and staffs contrib ports; Importing an existing site drops the propagation promise.
• Added: time and staffing across the Drupal 7 exit pages. Leaving Drupal 7 gains What this costs in time and Who is needed, and when; the Drupal CMS migration guide and its self-hosting twin gain the parity counts, forms, roles and integrations checks, editors on the rehearsal copy, a readiness test, the cutover-day clock and the edit-pause mechanism, the old-URL test and the watch period; Upgrading from Drupal 7 gains the editors' pass, the rehearsal loop with cutover day as a list, How long it takes, the layout-system cases and a Where to go next; Importing an existing site gains When you point the domain here.
• Updated: Per-instance group — opting a new account out: create /root/.oN.octopus.cnf before boa in-octopus holding just _USER="oN" and _INSTANCE_GROUP=NO; the install completes the file and keeps the seeded lines. Never copy another account's cnf for that — it carries the other account's _DOMAIN (the install now puts the derived name back, with a NOTE).
• Added: AI crawlers and assistants on your sites — a new section, What about robots.txt?: what the stock Backdrop and Drupal files actually say (one wildcard block, Crawl-delay only on Backdrop and Drupal 6/7, no AI agent named), how unevenly the vendors honour the file, why it cannot pace or single out unnamed agents, and that the policy is enforced by the web server regardless; your own robots.txt is left as it is.
• Corrected: Before you install — a guest that cannot report its manufacturer is supported, and the page now says so. Xen paravirtualized domains, containers and some OpenStack-backed images carry no SMBIOS/DMI table, so dmidecode -s system-manufacturer prints nothing on them; BOA reads that field only to spot Amazon EC2, and the virtualisation check is what decides whether a machine is supported.
• Corrected: Before you install — Chimaera and Beowulf were listed as supported releases while Devuan OS upgrades calls them deprecated and untested. Both are hops on the way to Daedalus, not a base for a new server.
• Corrected: Install BOA — the paragraph explaining the 3 in the completion check said it was "not a fixed number in the code" and that "three lines of boa info mention Percona". The first was wrong and the second holds only right after a fresh install: the threshold is a constant BOA tests itself, and the count is completed Barracuda passes, capped at five, so an upgraded server shows up to five. Rewritten to match the FAQ, with the launch timing of the last pass reconciled (it starts within minutes and takes a while); the advice not to change the 3 stands.
• Corrected: the Percona completion marker reads 3 or more, not exactly 3. One line is appended per completed Barracuda pass and boa info shows the last five, so the count is how many passes have completed, capped at five, and a long-running server settles at 5. Updated on Percona setup & tuning and Devuan OS upgrades.
• Added: FAQ — "What if it stops at 2?", with the one command that finishes an install whose background phase never ran, linked from Install BOA.

2026-09-03

• Updated: Per-instance group — round two, synced with the code: an account is born converted only when the box is ready for it; files written during the walk are re-walked and any residue reported as DRIFT and finished by the next pass, never rolled back; a skipped or refused account is named in the upgrade report; status counts root and foreign named groups and treats a foreign group as DRIFT; the new reclaim verb (the file half only) is what root-run restores, the migration destinations and the nightly run; revert writes _INSTANCE_GROUP=NO and keeps the group while any path carries it; the conversion marker never travels with a copy; purge hands leftovers to root; the opt-out route for a new account.
• Fixed: Ægir vs BOA — the "Staying on Drupal 7 safely" row now names the shipped D7ES core, Drupal 7.105.2 +Extra core (it said 7.105.1).
• Updated: Branches, editions & licensing — the licence check is described as it runs (_verify_boa_keys on the pro and dev trees in every entry point, a hostname hash compared with the mirror), with the two hostname classes that pass without a key: the fleet domains on both licensed trees and, new, *.sslip.io test hostnames on the dev tree, so end-to-end tests run against dev on throwaway boxes without a per-box key while pro stays licensed; DUALLICENSE.md now names that testing exception under the DEV branch. Manual BOA upgrade, multiback operations and the serial pipeline carry the same note.
• Added: Per-instance group — instgrp — every Octopus account's identities (oN, oN.ftp, oN.<client>) get a private primary group named after the account and the account's files carry it, so another account's identity can no longer read this account's 0440 files (site credentials in drushrc.php, Drush aliases); users stays supplementary (it is the binary execute ACL), the FPM pool identities never join, shared codebases stay root:users by design. Applied per account by the octopus upgrade, born-in for new accounts; the root-only instgrp tool reports (status), converts and reverts; _INSTANCE_GROUP=NO in octopus.cnf opts an account out. DB credentials, fixrepo, the security model, the codebase lock, settings.php wiring, multiback operations and octopus.cnf follow the new model. The page also records the cross-box behaviour: a tree moved by xoct from a converted account carries the source box's marker and can land in an unassigned gid on the destination; xoct transfer re-groups it on the destination, instgrp status reads such a marker as stale and counts nogroup paths, instgrp convert claims them.
• Changed: Dumps with mydumper — BOA pins mydumper 1.0.5-1 on current codenames and every dump caller chunks large tables adaptively again on a 1.x binary (parallel dump and restore at the old fixed mode's speed); the --rows=-1 fallback from the day before now applies only while a pre-1.x build is still installed. The 0.21.3 adaptive chunker's silent chunk loss is described with the measured rates, and the myloader wrapper paragraph follows the new pin.
• mydumper pin delivered by the Skynet agent pass. BOA.sh.txt now brings a host's packaged mydumper to the pinned 1.0.5-1 on its regular pass (packaged layout only, one attempt per pin, never under a running dump, myloader path re-derived as the upgrade pass does), so the version-gated dump callers chunk in parallel minutes after the release instead of after the host's next full upgrade. Hosts with _SKYNET_MODE=OFF, source-built pairs and unmapped codenames wait for barracuda up-* as before.
• Dump chain review fold-in. The failure mail now recommends the plain run (basic mode cuts retention to three days), keeps the dump tool's own output beside a failed dump as <DB>.mydumper.log, and reports run-level aborts (disk above 90%, MySQLD unavailable) and archive failures through the same channel; the incident log is harvested with the others and backchain reads it back. The mydumper version is probed per dump, anchored on the banner. The agent-pass installer never acts during an install, a backup or a migration, proves the package's codename, retries a pass that changed nothing and records a completed attempt's outcome in its marker. Docs: the invocation block is valid shell again, the manual recipe warns about pre-1.x builds, the cross-line checksum warnings are explained, and the _MYQUICK_VRN_ONE line's permanent fallback is stated. Second review round: the disk check runs after the stand-down gates (no abort mail from a proxy, standby or replica box), failed dumps keep their debris and the tool's output in a <DB>.FAILED/ directory on both dump paths, the incident line names the run directory and the databases again, and the installer's busy gates honour a lock only while its owner is alive.

2026-09-03

• New: Attacks that never reach your site — the hosted-customer view of the web-tier defence: what is refused at the door (probes for other systems' admin pages, secret-file fishing, injection payloads, scrapers and forged identities, flood shapes), how offenders are blocked by behaviour with legitimate crawlers exempt, the per-site ceiling on anonymous renders that keeps a site standing during an unclassifiable swarm, what shows in your logs, what stays yours to decide, and what it does not cover. Listed on the Protecting your site chapter page.
• Added: a worked example on the Abuse Guard configuration page — protecting an expensive path of your own (a calendar's date space): which layers act before any change, how to put the path on the flood watch list (the override replaces the whole list), what the declaration and per-address gates mean in practice, and why a burst is banned for its next visit rather than mid-burst.

2026-09-02

• Added: Dumps with mydumper — the nightly chain now reports a failed dump instead of dropping it silently: debris kept as <DB>.FAILED, an ALRT line per database, one dated line in /var/log/boa/mysql.backup.incident.log and one e-mail to _MY_EMAIL per run naming the missing databases (_INCIDENT_REPORT=OFF silences the mail).

• Fixed: the nightly's verbose drush8 gate (_DEBUG_DAILY=YES or /root/.debug_daily.info) printed its timestamped line on stdout, and the user-registration protection check parsed that line as the user_register value, so with the gate on its default arm never closed an open registration setting (the strict arm does not read the value) (omega8cc/boa#1939). The line now goes to stderr and reaches the same night log, now also from the calls whose stdout the nightly captures; the three values parsed from drush output keep only their own variable's line. Nightly worker internals, Control files.

• Changed: Dumps with mydumper — the nightly dump chain, the cluster variant, the xoct/xcopy exports and the per-site MyQuick dump now pass --rows=-1 (integer chunking off, one file per table) instead of --rows=50000. A fixed --rows=N walks the whole primary-key range in steps of N key values, and a sparse bigint key made the nightly write empty chunk files until the box ran out of inodes (omega8cc/boa#1940); mydumper's flag-less adaptive mode was measured to drop a whole chunk of a sparse-keyed table in 8 dumps out of 100 on Percona 8.4 (8 of 30 on 5.7) while exiting clean, so it is not used. The page and the database chapter also narrow the credentials claim: the per-site MyQuick dump (hostmaster backups, the safety copies ahead of Migrate and Delete) passes the instance's own DB credentials in argv, covered by the hidepid=2 mount.

• Updated: the aegir2boa validation status now records the 2026-08-25 matrix — both source families (Debian and Ubuntu) run against both Percona generations BOA ships, adopted where the pairing is supported and refused by check where it is not (a MySQL 8.0 source needs the 8.4 target), the whole-panel route with its two-box revert included — and the cell it exposed: a Drupal 6 site on a Percona 8.4 target needs the server to advertise mysql_native_password, which a current BOA sets and the import now verifies, pinning the site's database user and refusing the site when the server will not serve it. New prerequisite on Adopting vanilla Ægir, the same requirement and the widened proven surface on Migrating from vanilla Ægir.

• Fixed and clarified: drush10/drush11 from the shell need PHP 8.1 or newer (the Drush trees BOA builds say so); an account whose cli.info or marker pointed lower got a misleading "create php74.info" prompt and then composer's platform error. The shell now runs them on the highest installed PHP that clears the floor and says so. Choosing your PHP version.

• Clarified: Devuan Chimaera and Beowulf are deprecated — hops on the way up, not tested in any context; Daedalus (recommended) and Excalibur (latest) are the supported, tested hosts. Upgrades & OS lifecycle and Devuan OS upgrades say so. Daedalus is now listed first in every codename list, Excalibur second.

• Changed: per-Client shell sub-accounts are for files and themes, not code, on Drupal and Backdrop sites only. They no longer get composer, bee or any drush (vdrush, drush, drush8, drush10, drush11), nor the database clients and dump tools, mybackup, s4cmd, outbound ssh, openssl, the Grav CLI, svn/bzr/cvs or the Node toolchain, interactively or over one-shot SSH; Grav and Textpattern sites are never linked into a sub-account; cache clears and other site operations go through the Client's control-panel account. Developer sub-accounts, Shell extras and lshell + manage_ltd_users say so; the main oN.ftp account is unchanged.

• Corrected: In-place upgrades said the sites/ skeleton staying with the backend user "does not affect composer or git". It affected composer: Drupal's scaffold plugin refreshes its files under sites/ on every composer run and could not write there, so a composer require by the shell user stopped with Failed to make the directory containing [web-root]/sites/development.services.yml writable (omega8cc/boa#1936). BOA now keeps the two scaffold directories of a codebase you own writable for your shell user and no longer deletes the scaffolded development.services.yml; the page says so. The codebase lock and Shared codebase permissions now state the sites/ modes as the two cases they are (built-in platform versus tenant Composer codebase), and the codebase lock page no longer calls an unregistered platform "entirely manual" (a platform Verify still applies the map). Discontinued features no longer claims BOA "actively prevents" composer on a deployed platform: it is unsupported, not blocked.

• Corrected: The codebase lock described the lock as stopping a leaked SFTP credential from rewriting code; the code trees are group-writable for the shell pair by design, so the lock guards the hardening and git's ownership trust, not writes. The same page and Shared codebase permissions now say what actually separates tenants, and name drupal/core-recommended as the composer shape the nightly whole-tree pass recognises (drupal/recommended-project and Drupal CMS never require the bare drupal/core, so the pass had been covering only the docroot). The codebase lock page also records that hostmaster trees take no group write at all: the platform permission script had been widening them to the tenant-codebase map although no shell user is ever meant to reach them, and that built-in platforms under ~/distro keep group write only on the documented sites/all code dirs; Developing your site now says core is read-only for your shell user rather than "root-owned".

• Added: Running Drush gains a troubleshooting entry for that composer error, and says plainly that Unlock Local Drush only unlocks the bundled Drush.

• Changed: Drupal CMS and Search (Solr) no longer read as an invitation to run composer on a registered platform: it works, but a platform with live sites is treated as immutable, so the supported shape is a fresh build plus a migration.

2026-09-01

• Corrected: the attack and health archive page listed eleven subsystem incident logs; the crashed-task reaper's own log is now registered with the archive too, so its reap records survive the weekly rotation, making twelve. Attack and health archive

• Corrected: five pages said a dev.-prefixed name keeps "crawlers and bots" (or "search engines and bots") served a 404; the gate is keyed on the visitor's own User-Agent, so the accurate word is self-identifying crawlers and bots — a crawler that hides its identity is not caught, and Cloning and moving a site always said so precisely ("anything identifying itself as a search-engine crawler or bot"). Now aligned: Migrating from Drupal 7, Migrating to Drupal CMS, Upgrading from Drupal 7, Backdrop CMS on your server and Leaving Drupal 7.

• Updated: the shared Backdrop contrib bundle now also delivers the Webform port to every Backdrop platform — the first curated member beyond the cache module, verified arriving through the normal upgrade pass on published code. Adding modules and Backdrop CMS on your server reflect it; the port-gap routine there notes that for Webform specifically the download step is no longer needed on a current platform.

• Changed: a hand-uploaded /llms.txt policy file is now durable. The nightly refresher used to treat files/llms.txt as its own cache — weekly expiry, self-refetch, and a heading gate that could remove a plain-text policy — which contradicted the upload promise on AI crawlers and assistants. It now refreshes only copies it fetched itself, tracked by a provenance marker, so an uploaded file stays exactly as uploaded; the hardening notes on Security audit hardening describe the rule. Sites that relied on the module-route re-fetch keep it: delete the static file once and the refresh cycle resumes.

• Corrected: Security model — the AI bot policy summary described the predecessor $is_ai_crawler handling as allow-by-default. It was the opposite: a hard deny (444) keyed on bare vendor-name substrings, which also caught the vendors' search and assistant fetchers — the over-blocking the per-class policy replaced. The bullet now states the real history and the per-site train-allow opt-in. Two drifted ai_policy.sh line citations on AI crawler policy were also refreshed to the current source. The BOA-5.10.1 release page carried the same misdescription in its evasive-class bullet and is corrected likewise: the Perplexity-User fan-out reached the origin by evading the old hard deny, not because of an allow.

• New: Adding modules to your Backdrop site — the page that answers what the upgrade report's "needs the Backdrop contrib port" actually asks of you. Where contrib code goes (your site's own modules/ folder — the one place that works, and it wins the scan), the three ways to get it there (bee download, SFTP, Backdrop's UI), and the fact that unlike Drupal, sites/all/modules does not exist for Backdrop — the folder is there and even shows up in package listings, but Backdrop never loads code from it. Includes the proven port-gap routine after a Drupal 7 upgrade: delete the carried Drupal 7 copy, download the port, enable, run bee updb — and the kept tables convert from their Drupal 7 schema (worked example: Webform, data updated from schema 7431 to current). Plus the warning that earns its bold: bee enable doesn't check compatibility, so replace the code before enabling. The upgrade guide links the routine, Modules BOA manages now says plainly that none of its enforcement applies to Backdrop, and Backdrop CMS on your server gains the operator's view of the shared contrib bundle and platform-root code.

• New: the Drupal CMS migration guides now answer three more questions from a live migration run rather than assumption, on both Migrating from Drupal 7 and Migrating to Drupal CMS. Multilingual: the Comment rule covers languages too — enable Language and Content Translation before migrating, or no language migrations are derived at all; a Drupal 7 translation pair then arrives as one content item with a translation per language. Roles: users cross with their roles, and permissions carry for every module enabled at migration time — with the ordering rule and the command-line refresh (migrate:rollback / migrate:import upgrade_d7_user_role) for counterparts enabled late. Media: files stay file and image fields with references and alt text intact; nothing becomes a Media entity by itself. Plus one sharp edge found live: installing modules on Drupal CMS can re-create starter content, so re-check the content list right before the run — a resurrected item's ID collides like the originals did.

• New: the Backdrop upgrade pages now answer the theme question, from a live conversion run rather than assumption. On Upgrading from Drupal 7 (new section Your theme on the copy) and Backdrop CMS on your server: the conversion carries a site-local theme and keeps the site's theme choice — the copy is not silently re-dressed — while recording a Drupal 7 theme as disabled (it declares no Backdrop compatibility) even as it serves; simple stylesheet-driven themes can render as-is, themes built on Drupal 7's page template and regions meet Backdrop's layout system and need a port. The same verification run also proved the saved-views claim end to end: a database-stored Drupal 7 view crossed the conversion and serves at its own path as a Backdrop core view, with the site-local Views module moved aside to the quarantine directory exactly as documented.

• New: Leaving Drupal 7: choosing your exit — the decision page for Drupal 7's two paved exits. The Backdrop upgrade (continuity: the whole database converts, saved views included) and the Drupal CMS migration (modern toolset: content crosses, the front end is a fresh start) weighed side by side — along with what stops existing here whichever you pick: the staging estate, the every-URL redirect map, freeze windows and delta syncs, the DNS cutover, the written rollback plan. And since both exits rehearse on disposable copies beside the live site, running one rehearsal of each is a legitimate way to decide.

• Updated: both Drupal CMS migration guides — Migrating from Drupal 7 and Migrating to Drupal CMS — now say plainly that Drupal 7 views don't migrate (core ships no Views migration; the review list gains the symptom and the fix), and both gain an after-the-swap SEO once-over: why the rename cutover means no every-URL redirect map, the short list of paths that do change, sitemap resubmission and title/description spot-checks.

• Updated: the Backdrop upgrade pages — Upgrading from Drupal 7 and Backdrop CMS on your server — now recommend a dev.-prefixed test-copy name (crawlers served a 404 for the whole review period), state that saved views convert with the database and keep working, and document the copy's point-in-time nature with the habit that closes the gap: re-run the cheap upgrade fresh right before cutover, and cut the newest copy over.

2026-08-31

• New: your server now tells you when its off-site backups have stopped, instead of leaving that news buried in per-run failure mail. Once a scheduled service has gone too long without a successful run, the box raises one Backup FRESHNESS Alert for it and repeats daily until a run completes — distinguishing runs that happen and fail from runs that stopped altogether, and staying silent while a backup pass is actually in flight. If one stream stays stuck for four cycles, a separate Backup STALLED Alert names it rather than reporting every entry queued behind it. Documented under Email notifications in multiback operations.

• Changed: database credential cloaking is now on by default, and a site's settings.php no longer holds a real password. It reads $_SERVER['db_*'] values the vhost supplies per request instead, with a command-line pre-block recovering them from the sibling drushrc.php so Drush, site-local Drush and vdrush keep working. The reason is the shared pool: one PHP-FPM pool per Octopus instance serves every site in that instance and its Ægir panel, so settings.php has to be readable by the shared web user — while the files that do carry the literal values are group users, which that user is not in. New page: Database credentials — where the credentials live, the web and command-line paths, why backups deliberately keep real ones, the per-command override, and that Textpattern and Grav sites do not participate.

• Corrected: the pages that had this backwards, and the reader lane the change quietly broke. Both upgrade guides — Migrating from Drupal 7 and Migrating to Drupal CMS — walked you through grepping settings.php for credentials to type into an upgrade form; that now yields $_SERVER[...] placeholders and nothing usable, so both read drushrc.php instead. Database GUI said both files carry the real password. On the internals side, settings.php wiring had its whole cloaking section inverted, and the vhost generator called the fastcgi_param db_* lines an unused Ægir carry-over when they are the web path's credential store — it also gains two operational notes: its 0600 oN:users mode is load-bearing now that the file holds the credentials, and a site that reaches the empty-credential fallback connects as none@localhost rather than merely rendering oddly. The security model, entity model, command line, database GUI tools, exporting your site and disaster-proof restore pages were brought in line with the same fact.

• Changed: that platform instruction again, simplified to the terms the cheat sheet BOA ships to every instance already uses. ~/static/control/README.txt states the procedure plainly — put the symbols in platforms.info, then run the Octopus upgrade — so the force argument has been dropped from the pages: it is only needed when driving octopus by hand against an instance that is already current, and the tenant's own route supplies it automatically. Two facts from that cheat sheet came in instead: platforms.info replaces the default list, so pinned symbols mean the instance skips distributions added in future releases while the keyword ALL never skips anything, and the account owner can start the same upgrade without root by touching ~/static/control/run-upgrade.pid. Applied to Backdrop CMS, to Migrating to Drupal CMS — whose Step 1 now seeds the Drupal 7 symbol alongside CMS, because replacing the list would otherwise drop the platforms the source site sits on — and to octopus.cnf.

• Corrected: how you add a platform to an existing instance. Four pages told you to add the platform's symbol to _PLATFORMS_LIST in /root/.<user>.octopus.cnf and run an upgrade. That never worked: every octopus up-dev/up-pro/up-lts run rewrites that line to _PLATFORMS_LIST=none before the build stage, so the config value is read at install time only — the upgrade enabled everything else and quietly built no platform. An existing instance takes its platform symbols from its own control file, /data/disk/<user>/static/control/platforms.info, which overrides the config value on every run and logs NOTE! Custom Platforms List: … when it is picked up; an instance that is already current also needs the force argument before it rebuilds anything. Fixed on Backdrop CMS, which additionally claimed the ALL wildcard was the shipped default — the list ships empty — on Migrating to Drupal CMS, whose Step 1 also gained the missing force, on octopus.cnf, where the install-time-only rule is now stated next to the variable, and on the staged setup engine, which described the control file as an optional override rather than the only route after install.

2026-08-30

• Added: GoAccess coverage for standalone vhosts and operator-IP exclusion — the new _GOACCESS_VHOSTS toggle (one nightly report per server_name in /etc/nginx/sites-enabled, plus a box-wide ALL aggregate) and _GOACCESS_EXCLUDE_IPS (visitor IPs/ranges left out of every report), documented on barracuda-cnf, the nightly owl run and nightly worker internals, with the _GOACCESS_ALL variable now listed in the reference as well.

2026-08-27

• Added: the BOA-5.88.855 — Kraken Edition release page — 294 commits: a replication standby that provably adds nothing of its own with xmass autosync keeping its files minutes behind the live database, off-site backups restorable on your own workstation with boa-restore, the new Migration source task, a self-healing task queue, exact-name database grants with zero residual access, a root layer that never follows a tenant-planted symlink, and OpenSSL 3.5.8 LTS with every bundled PHP from 7.4 to 8.5 rebuilt against it. The releases archive renumbered newest-first (URLs unchanged).

2026-08-26

• Added: the xmass server move and failover scenarios pages now document xmass autosync — the automated file-sync cadence for a standing mirror. The database half of a mirror always replicated live; files travelled only on demand. The new verb arms a per-pair cadence on the active (after the first manual DRY + --live cycle) that repeats the live sync legs every N minutes, defers behind any other xmass verb or a running upgrade, re-proves the mirror's standby marker at every leg boundary, never re-creates that marker (its absence is the promotion signal), and disarms itself at cutover. The failover page's mirror-rebuild sequence now ends with arming it, and its marker-restore claim is scoped to manual syncs only.

2026-08-25

• Added: the Percona setup, my.cnf lifecycle and Percona 8 readiness pages now document the legacy-PHP auth pair BOA writes on Percona 8.4 — mysql_native_password=ON plus authentication_policy=mysql_native_password,, — and why: a PHP 5.6 client cannot answer the caching_sha2 handshake greeting an unconfigured 8.x server sends, whatever the user's own plugin. The readiness page also states the two boundaries: Drupal-6 code compatibility itself comes from the d6lts/Pressflow 6.51+ line, and the client lane is 8.x-only — MySQL 9.x removes mysql_native_password, so php56-pool sites are tied to Percona 8.4 hosts.

2026-08-23

• Corrected: a full documentation sync against every code change shipped since BOA-5.88.844 — 96 verified corrections across 48 pages, each claim checked against the code before the edit. The ones worth knowing about:

  • Install internals. The hostmaster-upgrade step now signals in its own per-user state directory with a positive completion stamp, and the parent fails closed on a missing stamp; the staged-setup and architecture pages describe the root-owned marker tree the installer uses, and the queue drains pass --strict=0 next to --fork=0.
  • Auto-healing. The database restart helper still leaves Nginx and PHP-FPM to the watchdogs and to the install flow's own webserver up — an early-restore change published the same night was reverted as a design misread. The task_guard.sh, java.sh (xmass Solr hold enforcer) and sqlprobe.sh (needs ledger, Valkey demand window) rows were completed, and the in-tree monitor reference with them.
  • Task queue and failures. A task whose worker died is marked Failed automatically within about a quarter of an hour (frontend reaper plus the box-side watchdog); deleting a site clears its object-cache namespace and installing or deploying the replacement clears it again; the two stored spellings of a site's grant on its own database are explained.
  • Backups. The safety-copy contract is scoped correctly (the pre-restore copy is the full, restorable one; pre-clone, pre-migration and pre-delete copies are registered backups), Restore of a fast-method archive is files-only rather than impossible, duobackboa backup waits up to two hours for a busy slot, the Duplicity 3.1.0 / Python 3.14.6 pins and the bash-prefixed multiback cron line are right, and mybackup is documented as ignoring the heavy-tasks pause.
  • Migration tools. Both halves of the xmass Percona version requirement (the series gate and the fail-closed server-side patch gate with _XMASS_ALLOW_PATCH_SKEW), the durable Solr hold and xmass restore-solr, the real step-15 order at cutover, the /root/.standby.cnf role marker in the control-file reference, the nightly worker prologue gate and the 90-global-post.sh roster, the full mysql_backup.sh stand-down set.
  • Ægir to BOA. The operator runbook gains the supported source OS family, the check database-generation parity gate with its refusals, the Ubuntu drill in the validation status, series-matched FPM selection in the live flip, and the vhost half of --revert-db-import.
  • Migration source. The proof of possession connects to the box's own server only; the task's kill switch joins the control-file reference; the Hosting module suite map counts sixteen modules with hosting_migrate_source in its own row; the hostmaster installer's enable list is complete.
  • Solr. Core teardown is described per version — Solr 9 through the Core Admin API, with a populated core archived under /var/backups/solr-archive/ first and a reseeded site INI never tearing down in the same pass.
  • Release model. The serial pipeline page states the 60-minute revalidation window, the byte-drift re-fetch, the local-tree read on mirror boxes and the stamp invalidation after a tools deploy; the run guard matches genuine executions only.
  • Prebuilt builder. Pure-FTPd joins the component list, gated by the FTP xtra, with the builder-box invariant that follows from it.
  • Drupal 7 to Drupal CMS. The pathauto credentials-step refusal and the build-level correction that current Drupal CMS platforms carry.
  • Smaller corrections on the my.cnf lifecycle, Percona tuning and FAQ log table, staticbuild PHP matrix, ban pipeline fail-safe scope, Let's Encrypt Verify outcomes, the security-audit page's planted-symlink sweep, and the Redis/Valkey, managing-sites and cache-tuning customer pages.

• Corrected (same night): the xmass server-move page no longer teaches the retired cron-down-TARGET model — a standby's cron stays armed and its passivity comes from the per-job gates, so a running cron during the sync window is healthy (the source-side park at cutover is unchanged and still described); and the migration-source page now states the verify path's real scope — only sites this feature has wired converge their grants on verify, the nightly sweep reclaims stale grants elsewhere — matching the latch that shipped minutes after the sync.

• Corrected (re-evaluation of the pre-release sync): seven passages re-checked against the code at HEAD and the reviewers' own evidence. The fast-method page and the backup-failures page no longer say a dump-less archive restores "gracefully" — the restore fails at the database step after the files half; the SSL-operations page describes the three-file readability gate (cert.pem, privkey.pem, fullchain.pem, CSR exempt) and its real log line; the xmass server-move page regains the delete-task-purge and Solr-hold bullets that the same-night cron-model fix had deleted by accident (the purge now refuses outright when a delete cannot be cleared); the migration-source page states the kill-switch's once-only hand-back correctly and that both sweep directions require loopback + exactly SELECT; the Solr core-management page gives the hold marker its real lifetime and the archive its new shape (cores moved, not tarred; a reseeded placeholder never tears down); the auto-healing page describes the demand window's peak as a re-anchored live high-water mark.

• Corrected: the rewrites-and-locations page now lists location @cache among the static-serving locations that re-state the nosniff / SAMEORIGIN pair (it serves a static Boost file with no application in the loop); only location = /index.php and the ESI microcache location remain the deliberate application-handler exceptions.

2026-08-22

• Corrected: the small content defects the review pass surfaced are now fixed — 26 of them across 22 pages, each checked against BOA's source code (or against the sibling page that genuinely holds the truth) before deciding which of two disagreeing spots was the wrong one. The ones worth knowing about:

  • Backups. Backing up & restoring said the classic single-file mysqldump archive was the only Backup Mode the Restore task accepts, and framed BOA's fast per-table database dumps as something you had switched on. Both were wrong: every Backup Mode is restorable — the preselected Site files with classic mysqldump DB brings a site back whole, while the database-only and files-only modes each bring back exactly the half they hold — and the fast dumps are your account's default, with MyClassic.info as the opt-out. The Sites & platforms cheat sheet named the wrong option as the Backup task's default and wrongly marked it un-restorable.
  • Failover. Failover & recovery scenarios still carried three leftovers of the retired design in which a standby mirror was held passive by stopping its cron. One of them told operators to confirm cron was down on a healthy mirror and to stop it by hand — which on current BOA would silently disable that box's backups, intrusion detection, watchdogs and tool updates while doing nothing for its passivity. A mirror keeps its cron armed; individual jobs stand themselves down on the standby role marker.
  • Abuse Guard. The path-exemption variable _NGINX_DOS_IGNORE_PATHS was still described as exempting a request from "all three detectors" on both Configuration and Operations + tuning — a count left over from when there were three. It exempts all six, plus the Tier-B translation-flood tally; the two passes that do not read the request log (the FPM-saturation trigger and the harvest pass) are now named as the exceptions. The ordering diagram on Request guards also listed the print no-referer gate as returning 444 where the page — and the shipped nginx template — say 404.
  • Counts and names. Process guards and Cron cadence & idle-load throttle both said the process-control pass iterates 12 service guards; it iterates 11, the twelfth having retired with the daemon it watched. BOA-5.88.811 summarised itself as 36 commits where its own table counts 40. And Solr 9 modules dropped three unexplained proper nouns on the reader — they are Devuan release codenames, and the page now says so, along with why those three releases are the entire Solr 9 fleet.
  • Pointers and typos. A forward reference on Shell and SFTP access pointed at the wrong section in the wrong direction; a duplicated hand-off on Reading another site's database is gone; Drush aliases and contributed commands no longer claims the two Drush versions accept identical alias names (they differ for multi-dot site names) and its examples now use the right cache command for each; Debian to Devuan promised to show you the log line that means the conversion finished and never printed it. Smaller slips were cleared on Is BOA for me?, Module matrix, DB GUI tools, Backups internals & operations, Nightly automation, Provision API, Hosting API, settings.php wiring and Nightly worker internals.

• Updated: Task failures — destroying a site's database now also revokes the table, column and routine level grants an account holds on it, each re-issued exactly as SHOW GRANTS reports it, so an account whose only remaining hold on the database was such a grant is released instead of kept. Clearing them is a notice; the warning now names the case it always meant — a row that could not be parsed or whose revoke the server refused, where the account and its grants stay put.

• Review pass complete: every page of this documentation has now been through its editorial review — the 259 pages still carrying the internal draft marker (the pages themselves were always visible) were read in full and moved to published status, so the whole corpus is now in reviewed state. Two release pages regained the published marker they had lost to bookkeeping slips along the way: BOA-5.88.844 Certainty Edition and BOA-5.88.811 Cadence Edition. No page content changed in this pass; the small content defects the review surfaced are queued as ordinary follow-up fixes.

• Corrected: Migration source wiring — a follow-up verification pass against the delivered code tightened seven details: the former-names record's three sources and the restore-vs-migrate recording moments (restore records after, migrate before its task dispatches); the by-hand cleanup query made spelling-agnostic (mysql.db stores the escaped site\_0 spelling, so a plain match finds nothing on collision-suffixed names) with a keep-shared-users safety check before any DROP USER; the reclaim-on-restore scoped to sites whose user carries the database's own name; which self-queued verifies skip on an outstanding verify versus delete only; the nightly runner's five-minute per-instance cap and its pause-held-elsewhere skip; and what the pass summary's counters do and do not include.

• Updated: the migration-source sweep is now scheduled nightly on BOA, inside a box-wide task-queue pause (grace, drain, skip-if-busy), which removes the sweep-versus-verify revocation race by construction; the feature's own hosting queue drops to a daily default and serves as the fallback scheduler for plain Ægir, switched off per instance on BOA boxes by the night runner. Migration source wiring and The task queue describe the new scheduling.

• New: site deletion's database semantics are now documented — Delete removes the site's database and only that database's grants; a MySQL account shared across several databases (imported sites) survives until its last database goes; and hand-made table, column or routine grants inside the destroyed database are left in place with a task warning naming the account. Creating and managing a site carries the user-level note, Ægir task failures the operator entry for the warning line.

2026-08-21

• Changed: Migration source wiring, Reading another site's database, Migrating to Drupal CMS and Task queue — the Migration source feature is now enabled automatically by every Octopus install and upgrade (fresh installs via the Hostmaster profile, upgrades via hosting_custom_settings and the installer), with the drushrc regeneration handled by the same pass; the enable-then-verify pair is now documented as the fallback for instances that predate the automatic path, and the migrate_source queue is no longer described as optional.

• Corrected: Ghost cleanup and Auto-healing — the cleanup interlock is no longer described as a bare pgrep -f provision, and .skip_cleanup.cnf is no longer described as ORed with a single /run/boa_run.pid test: the daily pass now gates on the same seven signals owl.sh uses, because the chained install's octopus leg and the setup children were invisible to the old test. The generated control-file reference was rebuilt.

• Corrected: Nightly worker internals — the master cleanup interlock is no longer described as pgrep -f provision. That bare form matched any command line merely mentioning a provision path, so a checksum or an ssh probe silently skipped a night's cleanups; it now matches genuine task executions, and the page records both that and the conservative fallback each worker defines for the window where its library is older than itself.

• Corrected: Percona setup & tuning — the .instant.busy.mysql.action.cnf description no longer says the marker can fire during a Provision task, and no longer describes its hand-off to the restart path. The arm now stands down while a task is in flight, and instead of a restart it could never perform — the trigger reply proves the server is answering, so the restart path always returned without acting — it relieves the saturation directly with flush-hosts and the long-query sweep. The auto-generated control-file reference was rebuilt from the corrected frontmatter.

• Updated: the migration-source sweep now reclaims the two orphan classes the nine-verifier review found out of its reach — grants held by deleted targets' surviving users and by users a restore or migrate superseded — bounded by the instance's own record of former site database names, so monitoring and backup users stay untouchable by construction; candidate-selection drops (no recorded database name, invalid, duplicate) are counted in the pass summary and warned about; and the guard bypass is spelled --force-revokes, because the queue command's documented --force (queue-lock bypass) reached the same option and disarmed the max-revokes guard. Migration source wiring documents the new reclaim bounds, counters, flag and the empty-user leftover.

• Corrected: a nine-verifier adversarial pass over the migration-source pages against the shipped code fixed every claim that had drifted or overreached. Migration source wiring: the sweep is scheduled by its own hosting queue (hourly, tunable), not by operator cron; it reclaims the freed-name and crash orphan classes but not grants left on superseded or deleted sites' users, which are now documented as by-hand cleanup with the query to find them; Migrate rotates the site's database name and user (the page said "the same databases"); the emitted settings block is shown verbatim with its guard and blanked table prefix; the every-verify grant convergence, the --dry-run/--force interaction, the retry bound's exact mechanics, the loopback-only grant topology and the verifies the feature queues by itself are all now on the page. Reading another site's database: the shell examples now use vdrush with the platform-root and Unlock Local Drush ground rules (the previous bare drush form ran Drush 8 and could not work on a modern site), the Drupal 7 rationale no longer claims a sign-out (the derived value feeds one-time login links and open forms, not sessions), and the disabled-source form behaviour, database-server moves, disabled targets and account moves are covered.

• Verified: the migrate:upgrade --legacy-db-key=migrate lane is now proven end-to-end on a live instance — 61 migrations derived with row counts read through the wired connection — closing the one claim published ahead of its proof.

• Updated: Migrating to Drupal CMS — the self-hosting command-line lane now leads with the Migration source task and --legacy-db-key=migrate, matching its hosted-audience twin, and links the operator page for enabling the feature. Both twins' --legacy-db-url fallbacks now carry the host and port. The task queue documents the fourth registered queue the feature adds.

• Updated: Migrating a Drupal 7 site to Drupal CMS — the command-line lane now leads with the Migration source task: the source database arrives as the named migrate connection, read-only and with no credentials collected or pasted, and the migrate:upgrade invocation uses --legacy-db-key=migrate. The hand-wired --legacy-db-url form stays as the fallback for instances without the task. Cross-links added both ways with Reading another site's database.

• Corrected: Migration source wiring — an adversarial review of the implementation found that a security property this page asserted does not hold, and both the code and the page have changed. The page said a manufactured node naming somebody else's database is refused because the client's site user holds nothing on that database. It is not: every provisioned database has a same-named user holding a grant on it, other accounts' databases included, so that check passes for a database the requester has no relationship to at all. Ownership is now established by proof of possession — before any grant, the source must open the database it claims using the credentials that site records for itself, and the grantee must prove itself the same way — while the older MySQL-shape checks are re-described honestly as sanity checks rather than boundaries. The reconciliation sweep section is rewritten to match: it enumerates from proven users rather than from recorded database names, which both keeps the destructive half structurally inside the instance and is the only way an orphaned grant on an already-dropped database can be seen at all; and it now abandons an association it can never satisfy after a few attempts, instead of re-queueing a full site verify on every pass forever.

• Added: Reading another site's database — an "if you set it and nothing happens" section for clients: the one-line check that proves whether the access arrived, the three things that usually explain it not arriving (including a source whose settings were hand-edited away from its own database, which now refuses), and the fact that the system stops retrying rather than trying forever, so clearing the source and setting it again is the way to start over.

2026-08-20

• New: the crashed-task reaper — task_guard.sh joined the auto-healing watchdog family: a hosting task whose runner is killed before it can report (a reboot, an interrupted upgrade, a stray signal) stays "processing" forever and silently freezes the instance's task queue for up to eight hours; the reaper marks such provably dead tasks failed — only when their instance user has no live task process at all — and the queue moves again within minutes. The cadence page notes its five-minute self-throttle, and the barracuda.cnf catalogue documents _USE_TASK_GUARD and its two companion knobs.
• New tool: boa-restore — a read-only helper that gives Disaster-proof access the mybackup feel on your own computer: one downloaded file, one config template (pasting the same credential lines as your server-side file), then check, list and restore commands with plain-language diagnostics. The page now leads with it; the manual Duplicity route stays as the under-the-hood reference.
• New page: Disaster-proof access to your off-site backups — how hosted and PRO accounts can read their encrypted off-site backups with no BOA server involved, written for readers who have never used Duplicity: obtaining the encryption passphrase from the host, installing standard Duplicity on a Mac, a Windows PC (via WSL) or Linux, per-provider target URLs, point-in-time restores, a troubleshooting list, and the fire drill worth running before it's ever needed. The Off-site backups & mybackup page, the chapter intro and Exporting your site now link to it, and the operator-side multiback operations page gained the matching passphrase hand-off procedure and a .secret.txt reference entry.
• Corrected: a follow-up verification pass over the Nginx internals, web-search internals and Abuse Guard internals pages fixed the deeper claims an adversarial recheck surfaced — among them: Nginx's FastCGI read timeout is a fixed 180 s and _PHP_FPM_TIMEOUT can only lower the FPM-side limit beneath it, never raise the 504 ceiling; the Master's Hostmaster root is /var/aegir/host_master/<N> (the FPM probe recipe previously used a path that exists on no host); the dont-overwrite immutable-cert marker is honoured by the octopus install/upgrade leg as well, so a custom frontend certificate now survives every renewal path; the LE Basic-Auth exemption shipped with BOA-5.7.11 and the renewal-failure reporting with BOA-5.88.8; the static set does carry one http-scope zone file (nginx_limit_req_zones.conf); the search-flood gates carry no anonymity predicate; the old broad $is_ai_crawler map was a hard deny, not an allow; and the guard-404 and document-harvest detectors joined the cross-run state and hot-loop-gate rosters, alongside refreshed line ranges throughout.
• New: Reading another site's database — the Migration source task, which gives one of your sites read-only access to another of your own sites' database so Drupal's migration tooling can read the old site from inside the new one. Covers what the access does and does not include, that it serves the command-line migration path rather than the browser upgrade form, and the behaviours that surprise people: disabling the source does not remove access, cloning does not carry it, renaming and restoring keep it.
• New: Migration source wiring — the operator view: exactly what is granted, the four independent checks that bound which database may be named, the enable-then-verify requirement (skipping the verify fails silently), the reconciliation sweep and its two safety properties, and how the wiring behaves across clone, migrate, restore and disable.

2026-08-19

• Corrected: Dynamic vhost generator — precise description of the Barracuda-side satellite template fixup loop: it runs in _nginx_config_update_fix() within the heavy-rebuilds chain (not in the install entry point), covers both the .drush/sys/provision and the older .drush/provision layout, only enters an Octopus instance whose provision clone still carries a legacy drush_make marker, and rewrites the pre-2013 $ip_address = !empty(...) assignment to a hard wildcard — current-layout instances are untouched.
• Corrected: SSL operations — the automatic Let's Encrypt renewal window is 69 days before expiry, not 30: BOA's bundled dehydrated ships RENEW_DAYS="69" as its built-in default, so a fresh 90-day certificate re-issues about three weeks after it was obtained. Also updated: disabling Encryption now removes the site's auto-managed per-site LE control files so a re-enable or same-name rename starts clean (only the dont-overwrite immutable marker is never touched), and the page's source references were re-verified line by line.
• Updated: Custom rewrites & location blocks — the nosniff/SAMEORIGIN header pair is no longer described as emitted unconditionally: it is set at server scope and re-stated inside every static-serving location that declares its own add_header (nginx's inheritance rule would otherwise silently drop the pair exactly there); the application handlers (/index.php, @cache, ESI) deliberately leave document-response security headers to the application layer.
• Updated: a reference-freshness sweep across the Nginx internals, web-search internals and Abuse Guard internals pages re-verified every cited source line against current code — some 150 drifted references renumbered, and several claims tightened along the way: the high-load crawler roster's bare bot token, the loopback-exempt per-IP limit key, the guard-404 and referrer-harvest REPORT-first detectors, the realip-first access-log format, and the KTLS operator opt-out.
• The Drupal 7 → Drupal CMS crossing gains its command-line lane. Both migration pages — Migrating a Drupal 7 site to Drupal CMS (Using) and Drupal 7 → Drupal CMS (Self-Hosting) — now document driving the whole crossing from the shell with the site's own Drush: the Drupal CMS platform ships migrate_plus, migrate_tools and migrate_upgrade in its codebase (switched off), so migrate:upgrade --configure-only → migrate:status → migrate:import --continue-on-failure works with no Composer step. The sections carry the lane's two look-like-breakage behaviours with their fixes — a missing destination counterpart (Comment being the classic) aborting the group mid-run and leaving a migration stuck at Importing (migrate:reset-status, re-derive, re-import), and by-design partial counts on actions/blocks/theme settings — plus the lane's advantage over the wizard: it re-runs. The Drupal CMS platform page now names the bundled pipeline. Every command was proven end to end on a test server against a real Drupal 7 site before publication.
• Migrating a Drupal 7 site to Drupal CMS — the complete workflow, for both audiences. A new Using-area page, Migrating a Drupal 7 site to Drupal CMS, and its Self-Hosting counterpart, Drupal 7 → Drupal CMS, walk the whole crossing with both ends on one server: enable the CMS platform, task-install a disposable dev.-named target, clear its starter content, run core's /upgrade wizard against the source site's database and files, iterate on fresh targets (the wizard runs once per site — the pages document the delete-and-redo rehearsal loop), and cut over by rename. Both pages carry the Ægir-specific preparation step the wizard silently depends on — mirroring file_public_path into the source database so uploaded files actually cross — plus honest expectations for the deprecated-modules confirmation, the ID-conflict acknowledgement, the module report, and the classic post-migration review items (front page, unpublished pages, block placements). Every step was proven end to end on a test server with a real Drupal 7 site before publication, and the Drupal CMS platform build was corrected in the same work-unit so the wizard's validation passes out of the box.
• Drupal CMS page refresh. The Drupal CMS page now names the install profile to pick (drupal_cms_installer), shows what a healthy fresh install's placeholder front page looks like (screenshot), and keeps the version wording current.
• Keep search engines off your login pages. The access control page gains a section on the stock Drupal robots.txt gap (only the slash-suffixed /user/... forms are disallowed) and the one-line site-side robots.txt override that stops crawlers walking /user into the bot guard; the request guards page records the same interaction from the operator side.
• Google's special-case crawler ranges join the IDS whitelists. The ban pipeline and scan_nginx scoring pages now cover the daily guest-water.sh refresh of Google's published special-crawlers ranges — the AdsBot / Mediapartners / SERP-favicon-fetcher family, which crawls from its own Google-owned proxies outside the Googlebot ranges — into csf.allow and the IPv6 allow store, and the crawler UA exemption list's new space-tokened "Google Favicon" entry. The control files reference counts the new refresh among the .whitelist.dont.cleanup.cnf call sites.

2026-08-17

• A replication mirror is now a working BOA box. The failover and recovery scenarios page reflects the new per-job standby design: cron stays armed on a mirror (backups, IDS, watchdogs and system upgrades all run), passivity comes from per-job gates on the standby role marker, Solr is held by a durable disarm the watchdog re-asserts, and a full barracuda up-* on a mirror is steered to its system flavor. The old re-quiesce verification (expect cron DOWN after a reboot) is retired — a rebooted mirror comes back as a working box and the checks now assert exactly that.

2026-08-16

• The original scripts (2009) now carries the proof. A directory listing of the mirrors' historical area showing the three scripts with their November 2009 timestamps and the exact byte sizes of the copies published on the page.

2026-08-15

• Unused Solr versions can now be taken off a box — and migrations scope Solr automatically. A hosted box's first full barracuda pass installs all three Solr versions whether or not any site uses them. Two new tool surfaces close that: solrtrim classifies each version's real use and removes the unused ones safely (deny-first, data archived before any forced removal, used and ambiguous-looking versions refused for an operator ruling), and xmass prep-target now gates a migration target's Solr set against what the source measurably uses, with --fix-solr reconciling denies, unparks and installs in the safe order — before the file sync can land a Solr data tree that would silently suppress BOA's own installer. Both pages document the timing rules that make the order matter (per-version denies park only after install; the blanket java pair is the only install-time opt-out). The command reference lists the new tool.
• New page: The original scripts (2009). Three shell scripts dated 20 November 2009 — the direct ancestors of Barracuda and Octopus, older than the public BOA repository itself — are now published byte-for-byte, with a guided tour: what each script did, what survived into today's stack (the /data/disk tree, the aegir user, Pressflow 6, the /dev/ delivery path), and the period details, from four version-control systems in three scripts to the 2009 distro menu. The maintainer overview intro links it.
• In-page section links now land on their headings. Two long-standing mismatches between the anchors written into these pages and the heading IDs the site actually generates are fixed: the heading-ID length limit was raised (long headings had truncated IDs, so full-length section links missed), and 20 section links across 15 pages used punctuation the ID generator collapses differently (double-hyphen em-dash anchors, dropped apostrophes and periods). Every section link is now checked against the real heading IDs by the pre-publish link audit, so a broken fragment can no longer ship.

2026-08-14

• New page: Failover & recovery scenarios. A scenario-first runbook for the proxy/active/mirror topology: what to do when the proxy box or the active server goes down, the drilled planned switch to a mirror, emergency promotion, failing back, rebuilding the mirror, expected downtime per operation, and how switching differs behind your own proxy box versus a CDN-only front. The chapter intro now also lists all pages through this one.

• Verbose installer output (debug mode) is documented on the operator path again. The one switch that stops install and upgrade runs from discarding most of their console output — touch /root/.debug-boa-installer.cnf — now has a canonical home in the troubleshooting FAQ, with pointers from the install, upgrade and recovery pages. The write-up is corrected against source, including three traps the old text never had: the barracuda-named sibling marker also skips the Drush toolchain on fresh installs (not just upgrades) plus the Master Ægir upgrade; a plain barracuda up-* run ignores the combined marker (set _DEBUG_MODE=YES in /root/.barracuda.cnf there); and verbosity persists until you set the variable back to NO yourself.

• Re-enabling IPv6 has a real procedure again — including the step that makes it stick. The security model now documents that BOA's IPv6-disable is a whole-file sysctl template replace re-applied on upgrades, the five-step at-your-own-risk re-enable, and the _NO_SYSCTL_UPDATE opt-out without which a hand re-enable silently reverts.

• A box rebuild no longer has to lock every tenant out. The SSH + SFTP page carries the host-key preservation procedure — back up /etc/ssh/ssh_host_* before the rebuild, restore before the first tenant connects — so nobody sees the "HOST IDENTIFICATION HAS CHANGED" refusal at all.

• New page: orphan database cleanup. The root-only sqlclean tool: its DRY/LIVE/LIVE-auto modes, the /root/.sqlclean.protect.cnf interlock every LIVE run requires (exact names only — patterns protect nothing), why Drush aliases and never vhosts are its source of truth, and the pre-migration moment where a source-side run pays for itself.

• New pages: Security on your box and the maintainer glossary. The first tells a self-hoster what BOA already hardens unasked and the short list that is genuinely theirs; the second defines the maintainer vocabulary (trees, serials, Satellite vs Master, the staged installers, markers) with links to the owning pages.

• A batch of operator levers lost in an earlier reorganisation is restored, each verified against source: the cache-truncate exception list (/root/.my.cache.exceptions.cnf) on dumps & backups; the Duplicity force-reinstall marker on the backup CLI reference; the one-shot distro-cURL escape hatch and the OpenSSL series markers on the host OS baseline; the --allow-downgrades one-shot on major OS upgrade; and the do-not-park-the-crontab caveat beside the supported pause on the task queue page.

• The anonymous page-render cap is documented. boa_perhost_anon — the per-vhost in-flight cap that sheds anonymous excess with 444 while never touching logged-in editors — joins the request guards, with its sizing rule on FPM capacity and an attribution caveat where its 444s can trip the i18n flood detector.

• Tenant pages answer more of the questions tenants actually hit: why all your sites can 502 when one is busy (the shared worker pool, on blocked or slow); turning Drupal's Automated Cron off and the 3-minute cron ceiling (site cron); SMTP port 587/465 pairing (outbound mail); publishing an AI policy at /llms.txt by uploading one file (AI crawlers); the plain-core platform keywords (platforms); the always-skipped .nodns. label (SSL); and the quarantine directories the Backdrop upgrades leave in your site tree on purpose.

• Wrong statements corrected. boa in-oct is not a plain alias of in-octopus — it pins the instance to local ProxySQL (multi-Octopus); _MY_OCTO_EMAIL is deliberately operator-editable after install (octopus.cnf), and the install page now says so where it explains admail=; the php-8.5/php-max install tokens work on public installs exactly as on local ones (install BOA); and the vhost's built-in security headers — and BOA's deliberate no-HSTS/no-CSP stance, with the add_header inheritance trap — are on rewrites & locations.

• Migration runbooks carry their own escape hatches and holds: the documented xmass overrides for the reverse-path proof, the screen/tmux refusal and the disk gate, plus the deliberate target-side Solr hold (xmass); Percona 5.7's parallel-apply adaptation (versions & verification); xoct's cron-stays-stopped window and soft release-match expectation (xoct); and the off-run/ path where xtrim parks a proxied account's dispatcher (PX0 proxy shrink).

2026-08-13

• The install internals pages describe the current scratch layout. BOA changed how install stages signal and where they may write: the /opt/tmp scratch root is now root-owned 0755 rather than sticky 1777, each stage signals inside its own /opt/tmp/state/<user> directory instead of at the top of /opt/tmp, nothing in the build tree is handed to the instance user, and signalling is fail-closed — a stage that exits without leaving its -OK marker is treated as failed rather than silently passed. Staged setup, the install internals overview and Security audit hardening are corrected accordingly, including the maintainer note for adding a new abort path, which described the previous fail-open behaviour.

• The Percona 5.7 safety net is described as insurance, not as a live outage. Prebuilt stack packages said the 5.7 apt repository "can no longer be relied on at install time". It is frozen but still served, and a fresh Devuan Daedalus install on the default _DB_SERIES=5.7 installs from it normally — verified end to end on a fresh box, where the archived-mirror fallback never engaged. The page now says what the mechanism is for: the day that stops being true, and any local reason apt delivers nothing at all.

• BOA names on these pages read as their real names again. Underscore-bearing identifiers were losing their underscores to italics: the auto-generated variables and control files appendices rendered _NGINX_DOS_* as NGINX DOS and _AWS_ as AWS, and Discontinued features showed nginx_sql_*.conf the same way. Parsedown pairs a _ across a whole block — even inside a code span — so the appendix builder now escapes emphasis in the cells it generates from harvested purpose: frontmatter, and every name survives the trip. Three web and search internals pages also had a wrapped line beginning with a plus sign, which Markdown reads as a bullet and which split the paragraph around it.

• The render-lint catches three more ways a page can break. parsedown_lint.php now also reports a definition list built by a wrapped line starting with a colon, a stray plus-sign bullet, and emphasis nobody asked for — the silent one, which leaves no trace in the HTML, so the check defuses the wildcard-shaped delimiters, renders a second time, and reports whichever emphasis disappears.

• Ubuntu joins the drilled aegir2boa surface — both source families now proven. Migrating from Ægir and Adopting vanilla Ægir now name Debian AND Ubuntu as supported, drilled source families: an Ubuntu estate on MySQL 8.0 was taken through the whole path end to end, and the check step's new database-pairing refusal (a MySQL 8.0 source needs a current-generation target) is documented on both pages. The stage-1 emergency fallback text no longer quotes a one-layout command — paste what the tool prints, which matches the server's own Apache layout. Only the very oldest servers (Ubuntu 12.04/14.04-era init, Apache 2.2) rely on detection that has not run against a real estate, and both pages say so.

• Drupal 6 joins the validated aegir2boa surface. The Adopting vanilla Ægir validation status now covers the 2026-08-12 drill: a mixed Drupal 6 + 7 estate (Drupal 6 on d6lts) adopted per-site, each D6 site registered with its own install profile, mapped to the target's PHP 5.6 pool, served publicly through the proxy window, and reverted — with the honest residue narrowed to the one leg still undrilled (a target with no php56 pool). The stale-copy warning now also names site-profile carry-over: older tool copies fail any site whose install profile is not standard, every Drupal 6 site included. The Migrating from vanilla Ægir limits list follows: the proven surface reads Drupal 6 through 9.

2026-08-12

• The security model's web-layer ban duration matches the code again: the Security model page said IPs showing DoS-like access patterns are temporarily blocked for 1 hour; the temporary ban the web layer actually issues is 900 seconds — 15 minutes — as the ban pipeline page already documented. The one-hour figures for failed-login (LFD) and port-scan blocks were verified against the shipped firewall configuration and stand unchanged.

• The aegir2boa validation status now reads as current state: the Adopting vanilla Ægir page opened its validation section with the earlier drill's scope — a bold "Drupal 7 only and HTTP only" — and then narrated the 2026-08-11 re-drill as a list of changes, leaving that first claim standing as if it still applied. The section now states what is validated today (the HTTPS + Drupal 9 composer estate drill on published tool bytes, both stage-2 routes, every revert path, the manual certificate-enable step) alongside the standing gaps (Drupal 6, pre-3.x sources, panel-domain continuity), and keeps the stale-copy warning as the operational rule it is: these tools never self-update, so re-download all three before a migration.

• New page: Load testing your site. A gap inherited from the legacy site's "How to run performance or load test?" article, now covered here: a load test fired from a single address measures the layered DoS protection (edge firewall, per-address connection caps, request-pattern monitors) instead of the site and gets blocked almost instantly; real numbers come from page-speed checkers for per-page questions and a distributed professional load-testing service — many addresses, realistic traffic — for pre-launch audits, coordinated with your host; and the test must target the production name, since dev/devel-labelled preview aliases run with caching off and skew every result.

• Cross-platform Clone documented as the shortcut it is: Cloning and moving a site now notes the Clone form can target a different platform — a Clone and a Migrate in a single step — and why the guide (and the form itself) steer to the two-step instead: a failed one-shot leaves half-built leftovers right next to production.

• The cloning guide now leads with the whole handbrake: the fresh-copy list on Cloning and moving a site gains two facts that used to surface only in the recovery section or not at all — a clone arrives with scheduled cron switched off (linking Scheduled cron for your sites to turn it back on), and the domain you pick decides real protections: on dev/test-labelled names, crawlers get a 404 and outside cron pings are ignored, while staging.example.com earns none of it — with the first-label form also keeping a real Let's Encrypt certificate under the placeholder rule. The worked example switches from staging.example.com to dev.example.com accordingly, and the rename section now states up front that promoting a copy to a taken name means freeing the name first — the sequencing the recovery walkthrough already relied on.

• The instant phpNN.info switch now covers platform builds: the marker used to steer only what the shell wrapper dispatches — your shell commands and the Drush runs behind Ægir tasks — while the platforms build read cli.info alone. BOA now resolves the markers itself at the start of every requested build, with the same highest-marked-and-installed rule, so one marker covers the whole older-PHP workflow. The PHP version guide gains the claim — plus the build's two carve-outs: it follows your choice even during the upgrade pause, and the path_alias_cache 5.6 pin outranks markers for builds — and step 1 of the older-PHP walkthrough collapses to the marker alone, with cli.info as the optional durable default.

• The distributions catalogue gains a PHP column: the catalogue table now names the newest PHP version each distribution is supported on, next to tightened Core and Notes columns (bare core versions like 11.4 or 7.x, and four short build labels — Built from upstream, Fixed by BOA, Pinned, Legacy — now explained up front in the "How distributions stay fresh" legend). A new section on the same page walks through running a distribution on an older PHP — the cli.info + instant phpNN.info command-line switch before the platform is requested, then the per-site multi-fpm.info pin — linking the full PHP version guide.

2026-08-11

• OpenFed joins the rebuilt class at 13.6.6 on Drupal 10.6: the platform is no longer a pinned 12.2 build — it is now rebuilt from upstream as BOA releases ship, tracking the version the project itself publishes (upstream keeps OpenFed 13.x on the Drupal 10 track). The OpenFed page drops its pinned-build framing, the catalogue row moves to core 10.6, the octopus.cnf symbol map moves OFD into the Drupal 10.6 group, and the staticbuild page gains the tenth distribution with its merge-plugin convergence quirk.

• Opigno LMS joins the rebuilt-from-upstream group: the OPG platform moves from a pinned Drupal 9 continuity build to the current Opigno 3.2 line on the Drupal 10.6 core, rebuilt as BOA releases ship — with the three install defects upstream itself ships (a missing H5P PHP library, an H5P interface drift, and a Twig front-page fatal, all open issues with no fixed release) corrected in the build. The Opigno page is rewritten for the new generation, the distributions catalogue row and rebuilt group move with it, the staticbuild page gains the opigno target with its full correction story (distribution count nine), and the octopus.cnf platform symbol map moves OPG to the Drupal 10.6 row.

• Varbase and EzContent get their own pages: the two catalogue rows that still lacked pages now link them — Varbase (VBX, rebuilt from upstream on the current core, docroot/ layout) and EzContent (EZC, a pinned build on the Drupal 10.3 line) — completing the distributions catalogue, whose rebuilt-from-upstream group now names Varbase too.

• The un-freeze reaches every Varbase surface: with VBX building again, the staticbuild page no longer describes a disabled builder — varbase joins the per-distribution quirks with its real build story (installs from upstream's shipped lock, fresh-tree retries, rebuilds non-reproducible by design, stable 10 line as the target), the distribution count returns to eight, and the batch-wide claims are scoped to the seven distros that really share them (varbase builds outside _composer_prepare and the older-core fallback). The same page also gains two things it had never covered: the catalogue audit subcommand and the redis_backdrop routing arm in distribute. The octopus.cnf platform symbol map moves VBX to the Drupal 11.4 row — and SOC Open Social to Drupal 10.6, matching the core the shipped build actually carries.

• The streamed xmass snapshot now bounds its lock wait too: the whole-server migration page no longer carries the operator caveat to schedule a streamed init away from long-running queries — the snapshot bounds its backup-lock wait (15 minutes, blocking queries killed after 60 s) regardless of transfer method.

• The per-site certificate switches are now all documented: HTTPS for your sites gains the three siblings of the long-documented dev-site override — ssl-no-san (main name only, for when one alias's DNS keeps failing the whole order), tls-legacy-enable (TLSv1.1 for one site's ancient clients) and wildcard-enable (a DNS-proven wildcard certificate, where the account's toolchain has the DNS hook) — each an empty control file named after the site's main domain, picked up on the next Verify. All three join the reference appendix.

• xmass cutover aborts handle the write freeze themselves: an abort after the durable write freeze but before the target promotion holds now unlocks source MySQL and thaws the freeze, handing the source back writable — a failed promotion command is judged by reading the target's replica state back, not by its exit code. A refusal at the target web-layer proof parks resumably at phase=rename-failed and prints the full source-restore recipe, led by the resume instruction and including the thaw line and when it is safe to use it; the proof now runs at the head of the cutover tail, so every resume re-proves the target's web layer and starts its nginx itself. The whole-server migration page recovery paths describe the self-thawing aborts and the resumable web-layer park. (The docs-sync entry below, published earlier the same day, noted that the thaw was missing from the printed recovery — this tool change supersedes that caveat.)

• Varbase is no longer frozen: upstream repaired their project template in July 2026, and the VBX platform returns to the rebuilt-from-upstream group on the current stable line — the distributions catalogue row moves from "frozen at its last working build" to Drupal 11.4, rebuilt as BOA releases ship. A fresh install built, registered and served end to end before the row changed.

• The whole-server cutover freezes writes durably, not with a database lock: xmass cutover no longer relies on FLUSH TABLES WITH READ LOCK — a session-scoped lock evaporates the moment its client disconnects, leaving the source writable mid-promotion and every later write silently lost. The cutover now appends a read-only flag to the box-wide global include (the previous file kept as .bak beside it) and refuses to cut over if the freeze does not take; after promotion the flag is lifted on the new host, never on the source. One consequence worth knowing before it bites: an abort after the freeze leaves the source read-only, and undoing that — restoring the include from its .bak — is not in the tool's printed recovery recipe. The xmass runbook and the overview both carry the new mechanism and the recovery step.

• The migration tools gained a battery of refusals that protect the pair: xmass prep-target refuses a migration between boxes on different BOA releases (no override — a target missing a newer release's shared nginx variable takes down every migrated site, and the fix is a full run on the older box); every state-mutating verb of xmass, xoct and xcopy is now single-flight per box behind a liveness-checked owner-PID lock, with the read-only verbs left unlocked; the cutover proves the target's nginx config and a real port-80 answer before converting the source into its proxy; a Solr index that does not fit on the target is a hard stop naming the account instead of a silent skip; and a mistyped --flag on the account verbs is a hard error rather than being consumed as the account-rename argument. The tools also force themselves current on both hosts at pre-mig/prep-target and arrange their own firewall openings — both CSF lists, since an allow alone still admits a mid-migration temp-deny. Details across the overview, xmass and xoct & xcopy pages.

• xoct exports and imports are now truthful per site: exported.pid means "this account's export is restorable" — every per-site dump must exit clean and leave its completion marker, and a failure writes a refusal latch that transfer and import both honour and that travels with the account, so a partial export cannot quietly become a partial production account (--force accepts one deliberately and loudly). The import skips hollow dump directories, counts failed loads, schedules no verify for a failed site, leaves a target-native site with a populated database alone instead of counting it a failure, and rebuilds the account's pinned PHP pools so a 7.4-pinned site does not silently serve on the box default. The HTTPS proxy conversion requires every certificate file its template references (a partial certificate directory used to fail the box-wide config test), backs up the real HTTPS vhost before overwriting it so a failed configtest restores TLS too, and parks the converted account's dispatcher so a single queue tick cannot regenerate the vhosts and undo the proxy. See xoct & xcopy.

• A hostname rename now carries whole host-derived sites, and proves they serve: a tenant site whose URI embeds the box hostname follows the box — directory, per-site Drush alias file, static files store and its symlinks, client symlink, the URI values inside settings.php (including the escaped trusted_host_patterns spelling behind the classic post-rename HTTP 400), and the site's per-site PHP pin row. A fail-closed gate refuses to run the task queue while any site directory still carries the old name (the queue would import it as a duplicate panel node), the pre-rename database dump must prove itself complete before any in-place rewrite, and the run ends by waiting for each renamed site to actually serve, with the box's catch-all page discriminated so an "Under Construction" 200 never passes. Proxy-mode resolution is also role-qualified now: an inbound record left by the migration that brought an account onto a box is never read as that box's own proxy mode on a chained move. See the rename section and the xmass runbook.

• PX0 shrinking got honest probes and an honest undo: the xtrim liveness gate no longer trusts a bare 200 — it fingerprints the target's catch-all answer and fails any site whose response matches it, and after a whole-server rename it re-probes retired host-derived names under the new box name (directly only) instead of failing them against a relay that never served them. restore refuses unknown accounts and missing quarantines, prints remedies for the two partial paths (a Solr core that needs its instance restarted; an nginx configtest failure that leaves the quiesced config running), and finalize keeps the MySQL data directory unless --drop-datadir is dry-run-approved with exactly that flag. The mirror probe behind every BOA fetch is bounded too: two seconds, one try, and never an empty answer — a silent mirror used to park box-wide guards for many minutes. See PX0 proxies & shrinking and the serial pipeline page.

• The Ægir adoption toolset's August changes are now documented: reachability is arranged by a dedicated peer verb that opens the firewall and authorises the key in the right order (the hand-edited CSF recipe is retired from both pages); a cutover is refused when the new server answers only with its catch-all page, and no flag can override that; proxy vhosts always carry the www. name so the default SAN certificate can be issued through the proxy window; proxy --refresh re-renders already-proxied vhosts in place from current templates; the certificate mirror refuses to report success while any proxied HTTPS site has no certificate on the new server; and the Apache-to-Nginx flip supports encrypted estates, gates on the SSL frontend module being present, and verifies HTTPS against its pre-flip baseline. The validation-status section now states the drilled reality — the HTTPS window, the db-import route and every revert path — instead of calling the proxy window an open gap. See Adopting vanilla Ægir and Migrating from vanilla Ægir.

• Two earlier corrections on the Ægir migration pages, recorded here for the record: the tool-acquisition step changed from "copy them from a box that has the BOA tree" — unreachable for a vanilla operator — to published download URLs with a warning that a wrong tree token returns a 200 placeholder rather than a 404 (both pages); and the certificate promise on Migrating from vanilla Ægir was reversed: the new server does not obtain certificates by itself — adopted sites arrive with Encryption off, you enable it and let Let's Encrypt issue through the proxy window before repointing DNS, and the tool refuses to report success otherwise.

• The command reference finally knows the migration family: xmass, xoct, xcopy, xtrim and renameaegirhost — shipped root tools all — had no rows in the reference appendix at all. Each now has a command entry on its owning page, so the generated tables cover the whole migration toolset.

2026-08-10

• mydumper and myloader are now kept together, and the old leftovers are cleaned up: the two have to come from the same build, and the pair that counts is /usr/local/bin/mydumper and /usr/local/bin/myloader. BOA now targets the myloader shipped beside the mydumper the callers actually run, instead of preferring whatever sits in /usr/bin — which is how an older packaged myloader came to be paired with a newer source-built mydumper, splitting the pair and failing imports. Leftovers of whichever build lost are removed on every upgrade rather than accumulating: the stale companions on a packaged host, the packaged binaries on a source-built one (only once its own pair is proven to run), and any dangling symlink at either path. A surviving disagreement is reported as MyQuick pair mismatch in the upgrade log. See Dumps with mydumper.

• Building mydumper from source is no longer something you choose: it was reachable two ways — the /root/.install.myquick.src.info marker and the _INSTALL_MYQUICK_SRC=YES key it was converted to on 31 July — and both are now retired and ignored. The source path is pinned to the older mydumper release, so forcing it on a host that has a packaged build held mydumper a version line back while myloader could still come from the package, and imports then failed on an option the two binaries no longer agreed about. A stale marker file is inert; the cnf key is deleted from /root/.barracuda.cnf on the next barracuda run, so it cannot be flipped back on. Source builds themselves are unchanged: a host on an OS codename BOA has no package for still gets one, automatically. See Dumps with mydumper.

• Open Social moves to the current major and is now rebuilt from upstream: the SOC platform was a pinned build of the 12.4 line on Drupal 10.2, a branch upstream no longer supports. It now tracks Open Social's own current release (the 13.0 line on Drupal 10.6) and is rebuilt as BOA releases ship, so it joins the rebuilt-from-upstream group in the distributions catalogue. The Open Social page gains one new prerequisite worth reading before you build on it: from 13.0 upstream standardised search on Solr, so a site on this platform expects a Solr core. The html/ docroot and the deliberately bare front page are unchanged.

• Added: the BOA-5.88.844 Certainty Edition release notes page — every backup route that does not name a mode now produces the restorable kind with the pre-restore safety copy included, imports refused unless the shared store can prove whose data it holds, truthful migration verdicts with the new xtrim shrink tool, a proven failover and failback round trip, and installs interlocked against the fleet's own housekeeping. Late fold, same day: Unbound 1.26.0 joins the release from the prebuilt package set (release page table updated).

• Backup-mode restore contract corrected on the fast clone & migrate page: Faster Clone & Migrate claimed only the full backup mode "produces an archive the Restore task can use" — since the per-mode restore contract, Restore brings back exactly what an archive contains and partial archives are labelled in the lists; the page (and the panel's own Backup form help) now say so.

2026-08-09

• DXPR Marketing and OpenLucius retired from the catalogue: both distributions are formally unmaintained upstream, so the DXP and OLS platform keywords no longer build new platforms — existing platforms and their sites are untouched. Their rows leave the distributions catalogue and the octopus-cnf symbol table; the background lives on Discontinued features.

• Failing back documented as a first-class path: xmass whole-server move gains the reverse pass — the cutover now clears a failback target's demotion artefacts before the rename (records, markers, parked dispatchers, proxy vhosts restored from the conversion's backups), the one-time state refusal every failback hits is explained together with its remedy, replicas are health-checked by GTID set containment rather than identity counts, and init proves a returning master's GTID and binlog before streaming.

• A finalized proxy is a live server: after the proxy-marker narrowing, PX0 proxies & shrinking now states that intrusion detection, service watchdogs, host hardening and tool self-updates all keep running on a finalized proxy, that a rebooted proxy comes back serving, and that only the site-serving machinery it genuinely lacks stays down. (An interim note describing a tooling freeze was published earlier the same cycle and superseded by this rewrite.)

• Every page carrying proxy-marker claims synced to the narrowing, after a claim-level sweep of all eighteen: architecture overview (twelve gated tools, not seventeen; three build-side arms with nginx and cron exempted; the surviving-channel list), task queue and auto-healing (the PHP-idle quiesce marker that replaced the synthetic proxy marker), loadreport (proxy nodes are profiled — relay load is the point), serial pipeline (BOA.sh.txt is now never stale on any box, proxies included), and nightly worker internals (the full prologue gate list and the bounded queue wait).

2026-08-08

• Correction to the day-old PX0 page: the target proof is not a name match for the account's own panel and dedicated site (a migration names those for the new host) — client sites still match by name; the account's own plumbing is proved by a live account on the target. Also clarified that a shrink failure before the first drop leaves the account restorable, and that restore keeps a proxied account's dispatcher parked.
• NEW page PX0 proxies & shrinking a migrated source — xtrim: what a migrated source becomes when it is kept as a permanent web proxy, the refusal battery that has to pass before anything is removed, the reversible quiesce step and the one-way shrink, the box-wide finalize, what is never touched, and how certificates stay alive on a long-lived proxy.

2026-08-07

• Added: the BOA-5.88.833 Candour Edition release notes page — panel backups that hold exactly what their label says with a Restore that brings it all back, single-email installs completing with a welcome email true for the box, the XDR9000 permanent attack & health archive on every Ægir server, distributed scrapers' cold fetches answered before PHP, and staged kernels activating only in the night window.
• Backups cheat sheet caught up with the new Backup task behaviour: Backups & restore — Cheat Sheet no longer teaches a workaround for a DB-only form default — the form now opens on the complete restorable mode, every mode restores exactly what it holds, and partial snapshots are labelled in the backup lists (in sync with Backing up and restoring in the UI).
• XDR9000 permanent attack & health archive documented: new page XDR9000 archive covers the read-only harvester that preserves attack bans, auto-heal incidents, backup outcomes and metric samples past routine log cleanup, the root-only xdr9000 CLI, the _XDR9000 opt-out, and the never-pruned disk footprint.

2026-08-05

• New HybridAuth-window cold-fetch gate and guard-404 detector 6 documented: Request guards gains the /hybridauth/window/<Provider> gate, which fires only on a cold fetch — no Referer and no session cookie — because the window path is also the OAuth return target, so a Referer-only gate would 404 the hop that completes a real login. The scoring engine gains Detector 6, which counts the gates' own static 404s in a cross-run window: it raises a GUARD404-CAMPAIGN operator alert when a distributed campaign is running, and can additionally ban the repeat-offender tail — opt-in, because the signal is browser-inducible from any third-party page. The configuration page adds the _NGINX_GUARD404_* tunables.

• New Flag-toggle no-referer gate documented, print gate corrected to 404: Request guards gains the new /flag/flag/… no-Referer gate (Referer-less GET flag toggles are scraper botnets or crawlers; a real click always carries a Referer), and the print no-referer gate section now matches the shipped behaviour — a static 404, not 444, so search crawlers no longer surface it as a 5xx. The 444-vs-404 convention lists moved both no-referer content gates to the 404 family.

• Module policy extended to D8+ as detect-and-alert: the modules matrix documents the new Tuesday _MODULES_OFF_EIGHT_PLUS banned-module list (currently linkchecker, whose synchronous URL probes inside web cron self-DoS shared FPM pools), why D8+ gets detection and an operator alert rather than enforcement (BOA never runs Drush8 against D8+ sites — full bootstraps can corrupt D8+ internals), the drushless database probe that replaces it, the admin-UI removal path, and why there is no D8+ force-enable list.

• md-proxy classified as AI bulk collection: the AI crawler policy training-class token table now includes md-proxy (RetrievableAIAgentProxy), observed bulk-sweeping full site content while returning only 200s.

• Backup and Restore rewritten for site owners: the end-user page now explains all three backup modes and — new — what each one restores (full rollback, database-only rollback, files-only rollback), the labels shown in the backups and Restore lists, how automatic and older archives without a database dump behave on restore, what the automatic pre-restore safety copy is (and when to take your own full backup instead), and why a files-carrying backup's size can be trusted again. The MyQuick troubleshooting entry now describes the graceful files-only restore behaviour instead of "Restore won't work". Affected pages: Backup and restore, Backup failures.

• Restore reliability wave: the Restore task now always imports the archive's own database dump (on MyQuick-enabled systems it previously re-imported the pre-restore safety dump of the current database — a silent no-op restore), the imported dump is always removed from the site directory afterwards (a leftover used to fail the next classic-dump backup), the Site files without any DB mode now genuinely skips the database dump, the Backup form defaults to the complete restorable mode, and the backups list labels database-only and files-only archives so they are recognisable on the Restore form. Affected pages: Backup and restore, Backups on static FS.

• Backups of symlinked sites documented end to end: the files-carrying panel Backup-task modes now always dereference the files/private symlinks (a self-contained, restorable archive on every box), every other backup — the DB-only mode and all implicit safety copies — preserves symlinks by default (files-safe and store-backed; the new /data/conf/dereference_backups.conf opts back into the old behaviour, and the legacy /data/conf/force_symlinks.conf is documented as a now-redundant hard-preserve switch), and Restore joins the site lifecycle — a restored site is re-homed into its own store right after the post-restore verify (share-preserving, with a files-less archive guard that keeps the existing store instead of emptying it). Affected pages: Backups on static FS, Files symlinking overview.

2026-08-04

• Updater model corrected across the developer and operator references: the once-per-release _update_boa_tools latch (the _bTs serial) is retired and every fetched tool now has exactly one _fetch_versioned line, so a tool update reaches every box — including _SKYNET_MODE=OFF boxes — on the next self-update pass after its own fNN serial changes, with no release bump involved. Affected pages: the serial & fetch pipeline (also documents the new --require-token content sentinel and the validated atomic-replace fetch path), SELFUPGRADE reference, build & test, monitor deploy surfaces, files-symlinking tools reference, and the architecture overview.

• New topic: Drupal distributions — a Using-area chapter on the distribution catalogue: the keyword table with per-build freshness (rebuilt-from-upstream vs pinned), and dedicated pages for Drupal CMS, Commerce Kickstart's three generations, Thunder, LocalGov Drupal, farmOS (locked front page by design), OpenCulturas (BOA-corrected build), Open Social, OpenFed, Opigno LMS and Ubercart (D6/D7 legacy commerce with the migration runway).

2026-08-01

• Changed: the syslog_legacy process guard is retired, together with the legacy syslog restart arms of the nightly graceful pass. With rsyslog the only supported daemon, the guard had nothing valid left to watch — a conflict-swap leaves only an orphaned init script behind, and every barracuda pass now purges those rc-state sysklogd/inetutils-syslogd leftovers. Updated process guards, Host OS baseline and monitor deploy surfaces.

• Changed: rsyslog is now the only supported syslog daemon and is never removed by any pass. The old syslog-daemon choice — the /root/.use.sysklogd.cnf marker, its short-lived _USE_SYSKLOGD variable and the OpenVZ inetutils-syslogd arm — is retired: those arms purged rsyslog first, and sysklogd no longer has an install candidate in current Devuan/Debian, which could leave a host with no syslog daemon at all. Stale markers and cnf lines are inert; a host that lost logging gets rsyslog back on its next barracuda pass. Updated Host OS baseline and the process guards row for syslog_legacy.

• Changed: site search is now word-based with typo tolerance. Multi-word queries match by words instead of one exact phrase, results link straight to the matching section of a page, and a near-miss spelling gets a "did you mean" suggestion. Live on docs.boa.io and the test deployment alike.

• Changed: the command-line PHP switching story now names Composer everywhere it names Drush — one setting covers the Drush PHP and Composer PHP version alike — on Choosing your site's PHP version, Running Drush and Building your own platform (which gains a "Which PHP builds it?" callout), plus the shell and control-file cheat sheets. Both full pages now also state explicitly that the instant phpNN.info switch steers the Drush runs behind Ægir backend tasks — Verify, Install, Clone, Migrate — while the marker exists, so one-off markers should be removed when the job is done.

• Added: the BOA-5.88.822 Clarity Edition release notes page — 35 control-file markers become named barracuda.cnf settings, PHP security releases on all four maintained branches as prebuilt packages, a gated Devuan Excalibur kernel update, Backdrop contrib via the shared symlinked bundle, and the LTS = PRO 1:1 parity statement.

2026-07-31

• Changed: eleven more control-file markers became /root/.barracuda.cnf variables — the Java/Solr deny, the nightly permissions-pass skip, the CI task-queue allow, the database cleanup disable, the abuse-guard debug marker, the restricted-shell du allow, the home-directory chmod suppression, the ClamAV allow/deny pair, the CI box-class force and the cron autostart suppression. As before, each marker file stays honoured for one release and the variable is the supported switch; to switch one off, set it to NO and remove the marker file.

• Changed: two of the new names deliberately differ from their marker names. The CI marker becomes _FORCE_CI_BOX because the literal name is already used by BOA's internal Java-symlink code, and the cron marker becomes _NO_CRON_AUTOSTART because the old name promised an init-system choice it never made. Detection of a real Jenkins install is separate and unchanged.

• Changed: the debug-logging marker /etc/boa/.debug.monitor.log.cnf did not get a variable of its own — it folds into the existing _NGINX_DOS_LOG. While the marker exists an upgrade pass keeps that key at NORMAL, and turning the logs off now means removing the marker and setting _NGINX_DOS_LOG=SILENT. That key also now survives a fleet DoS retune, unlike its siblings — see Abuse Guard operations.

• Changed: five markers were reviewed and deliberately stay files, and each row now says so and why — the daily-cleanup skip, the heavy-task maintenance pause, the Midnight Commander allow, the extended firewall exceptions and the Site24x7 firewall-ignore marker.

• Removed: the long-query TTL retune driven by /root/.big_db.cnf and /root/.high_load.cnf is retired as inert, and the documentation that said the ceiling is auto-lowered to 1800 or 300 seconds was wrong — the value in /root/.barracuda.cnf was always the one in force. Set _SQL_MAX_TTL explicitly; existing files are harmless and now earn a one-time note on the next upgrade pass. See Discontinued features.

• Changed: the .debug.cnf / .default.cnf pair is re-scoped with that retirement. On a hosted box the pair still gates the fresh-install nginx log-retention widening, and .debug.cnf still drives the two major-OS-upgrade effects; it no longer suppresses any database retune — see Classic major OS upgrade.

• Fixed: the service teardown documentation said the Solr and Jetty deny markers never reverse. They do — clearing the deny restores nothing by itself, but the Solr installer lays the init script down and registers it again on a later upgrade pass; what stays behind is the stale copy parked in /var/backups. See Self-upgrade reference.

• Changed: ClamAV needs one transition step — until the release after this one, keep /root/.allow.clamav.cnf in place alongside _ALLOW_CLAMAV=YES, because the two slow-cycle OS-upgrade drivers only learn the variable when the next release serial reaches them.

• Changed: twenty more control-file markers became /root/.barracuda.cnf variables — the service teardowns, the self-service restart allows, the nightly and reporting toggles, the database monitor gates and the base-system switches. As before, each marker file stays honoured for one release while hosts converge, and the variable is the supported switch from now on.

• Changed: every converted row, including the four converted earlier, now states the off-switch honestly. Setting the variable to NO is not enough on its own while the old marker file still exists: the file wins and is re-asserted on every upgrade pass, so remove it as well. The reference rows say so per marker.

• Changed: the crawl-protection marker /root/.hr.monitor.cnf is retired. It had no reader left, and BOA no longer writes or removes it; the knob it was believed to set is _NGINX_DOS_MODE. An existing file is harmless.

• Fixed: three long-standing defects the conversion work surfaced. A php-idle run no longer removes a genuine proxy node's role marker; the daily report requested outside its send window is no longer discarded before it can be sent; and a never-working buffered-access-log rewrite was removed rather than left to fail silently on every pass.

• New: the control-file reference grew from 153 to 194 rows — every system-level marker file BOA honours now has exactly one catalogue row, on the page that owns its subject. The batch covers the service-restart allow files on auto-healing, the autoupboa teardown and reporting markers on the self-upgrade reference, the lshell and permissions markers under security, the database monitor gates and the password-rotation family on Percona setup, the autoinit conversion markers on Debian to Devuan, the nightly and install-window markers, and a new Host OS baseline page for the markers that pin the base system's syslog daemon, login look and cron handling.

• Changed: a sweep of corrections landed with the new rows, each one verified against the shipped code: the crawl-protection knob is _NGINX_DOS_MODE, not the vestigial .hr.monitor.cnf marker (its only reader was retired in 2025 — security model and CSF firewall now say so); pausing the task queue on a hosted box is transient by design (the pause file is recreated and cleared by the self-update agent — task queue); .fast.cron.cnf is written by BOA's own normalisation pass, not the Octopus installer; .big_db.cnf and .high_load.cnf are operator files, not "markers BOA manages itself"; the .local.IP.list family is BOA-generated rather than operator-maintained, and its generated .allow sibling now has a row; and nine duplicate reference rows were merged so every file appears exactly once.

2026-07-30

• Changed: four /etc/boa marker files became /root/.barracuda.cnf variables — _ENABLE_NEWRELIC_SYSMOND, _ALLOW_PHP_FPM_RELOAD, _ALLOW_CODEBASECHECK and _INSTANT_CSF_BLOCK. The variable is the supported switch; each former marker stays honoured for one release while fleets converge. Every documenting page was corrected in the same pass: Process guards now also covers the second, upgrade-time enforcement arm of the New Relic toggle; Cache tuning and PHP opcache & APCu now state that a reload request made inside the cooldown window is discarded, not deferred; Percona 8 readiness now says where codebasecheck findings actually land (the log/ctrl/ file is only a once-per-night stamp); and scan_nginx scoring now names the csf-installed co-guard and the synproxy re-assert. Two duplicate control-file reference rows were merged (one row per file).
• New: background-batch storms are now stopped at the edge, not only healed after the fact. A per-vhost rate ceiling on /bgp-start/ — the path Drupal 7's background_process uses to POST to its own site — bounds the self-request wall that a runaway batch chain builds, and is documented with its sizing, its coverage and its one accepted trade-off on Request guards. The config templates page lists the new bgp_flood zone alongside the existing rate-limit zones, including why it is declared in its own file rather than the generated master config.
• Changed: the welcome page's orientation heading says outright which part is which — "BOA is the armoured vehicle for the Ægir engine". The earlier one-liner compaction had cut it to "The engine and the armoured vehicle", which kept the metaphor but no longer said what it meant; the new heading restores that and still fits on one line.
• New: the batch storm guard — batch_guard.sh joined the auto-healing watchdog family: it detects a Drupal 7 background_process+background_batch self-request loop (the box's own address flooding /bgp-start/ with POSTs that all time out under load) and deletes only the confirmed dead batches' transient rows, severing the loop with no service restart. The cadence page notes its five-minute self-throttle, and the barracuda.cnf catalogue documents _USE_BATCH_GUARD and its seven companion knobs.
• Reference: _USE_BATCH_GUARD, _BATCH_GUARD_DETECT_ONLY and the six _BATCH_GUARD_* threshold/breaker knobs added to the variables index (312 → 320).

2026-07-29

• Changed: the documentation's prose is uniformly British English now — a measured sweep converted the remaining American spellings (localised, artefact, licence the noun, serialised, towards and friends: 167 word fixes across 68 files, release notes and the auto-built reference included). Machine text keeps its exact spelling on purpose: variable, file and module names, code, quoted command output and vendor terms such as New Relic's "license key", Solr's optimize operation and the control panel's "Leftover artifact" badge. Two release-note action headings also joined the one-liner rule, shedding only redundant words.
• Changed: body section headings are compact one-liners now — 15 headings that wrapped to a second line at desktop width were shortened across the using, operating, developing and discontinued areas (every qualifier dropped from a heading lives on in that section's body; the FAQ answer on hosting non-Ægir vhosts now spells out that the mechanism is not Drupal-specific). Release-notes pages are historical records and keep their headings as published.
• Changed: the locked-root normalisation grew safety semantics — the guard now recognises options-prefixed, sk- FIDO and certificate authorized_keys entries (an anchored-only match used to miss them and leave such boxes locked out), preserves the untouched /etc/shadow once at /var/backups/shadow.boa-orig before its first edit so a passwd -l stored hash stays recoverable instead of being silently destroyed, and warns loudly instead of staying silent when root is locked with no usable key on file (SSH + SFTP hardening).
• Changed: page titles are compact one-liners now — 11 pages dropped their "title — subtitle" tails (the detail lives in each page's description; menu labels and addresses are unchanged), and the welcome page's orientation heading was shortened. No section or page title wraps to a second line.
• Added: the pre-install checklist now has you set a root password before you add SSH keys — many VM images (keys-only cloud images in particular) ship with the root account locked, BOA is built around key-based root login, and the provider's emergency console is the one place that password is ever asked for; the install and recovery pages carry the same emphasis, including how to recover via rescue mode when the console prompt cannot be passed because no password was ever set (Before you install, Install BOA, When the box breaks, Start here).
• Added: documented the locked-root normalisation BOA runs at install, at every upgrade, and in the boa dispatcher's root-key gate — on keys-only cloud images it rewrites root's locked shadow entry so that key-based SSH survives BOA's PAM-free sshd, which would otherwise refuse a locked root even with the right key; console access still needs an operator-set password (SSH + SFTP hardening).
• Single-account moves with xoct: documented the import's new panel platform reconciliation (the twin of the xmass cutover's drift handling) and corrected a stale claim — the import quiesces cron and running BOA jobs itself; the manual pre-import cron stop is gone.
• Whole-server moves with xmass: the Solr core-parity comparison now describes how a core is counted — Solr is asked on the ports BOA installs it on, and only a core Solr reports as loaded passes; one whose configuration fails to resolve is called out as arrived-but-unloadable instead of passing as healthy.
• Whole-server moves with xmass: documented how the cutover's panel rewire absorbs panel platform drift — an aged source's control panel sits on a higher platform number than a fresh target's, and the rewire now adopts the target's code-bearing panel platform and repoints the hostmaster platform row in the live database so the rename queue keeps the adoption.

2026-07-28

• Changed: the prebuilt stack package set now includes Unbound — the builder packages the DNS cache binaries and the installer consumes the package with automatic source fallback, exactly like Valkey and Nginx; component rosters updated across the affected pages (Prebuilt stack packages, Prebuilt package builder, Commands reference).
• Corrected: _USE_PREBUILT_PKGS auto-defaults to YES on Devuan Excalibur as well as Daedalus when the line is absent (barracuda.cnf, Variables reference); sql_web_max_exec_ms is now indexed from the INI precedence page's own metadata, replacing its two hand-added duplicate rows with one authoritative row.
• Changed: Backdrop platforms now receive the Valkey/Redis cache module through the shared, centrally updated o_contrib_backdrop bundle (symlinked in on every platform verify and repaired nightly) instead of a copy baked into each platform tree (Backdrop CMS, staticbuild test codebases).
• Changed: the migration pages now describe what a migration actually carries per account (xmass server move, xoct account move). Both tools now carry each account's /root/.<oN>.octopus.cnf values, its PHP version pins, the client's shell and sub-account credentials and SSH keys, the sub-account registry and the billing suspension flag — previously a migrated account was rebuilt from the target's install-time defaults, which on a box whose sites pin older PHP meant every migrated site quietly served by the wrong interpreter. New xmass prep-target (CSF both directions, PHP coverage with --fix-php, per-account installs and seeding) and read-only xmass verify; new xoct reset-state for chained migrations. Corrected: the xmass page previously said matching Octopus accounts were not required on the target — they are, and every phase now verifies it.
• Added: the sql_web_max_exec_ms site/platform INI setting (Variables reference): web requests cap a single read-only SELECT at 30 seconds by default so one runaway query cannot stack up PHP workers; 0 disables the cap for a site, and CLI tools (Drush, cron, migrations, backups) are never capped.
• Added: the sqlprobe log-only SQL sampler and the rebuilt memorytuner advisory (Percona setup + tuning, Auto-healing watchdogs, barracuda-cnf): a ~5-minute read-only sampler (on by default, new _USE_SQLPROBE=NO opt-out) records SQL rate deltas and memory facts, keeps the tuning's datadir/Valkey measurement stores fresh between upgrades — which lets the measured Valkey ceiling engage on ordinary runs — and memorytuner now reads that corpus and names exact _SQL_*_FORCE pin lines with reasons instead of running its own RAM-estimate model. Nothing applies automatically.
• Changed: the Hostmaster upgrade internals page now documents the drush 8 launcher pin: the per-account _PHP_CLI_VERSION pin previously rewrote only the drush/drush.php shebangs, which the drush.launcher step then bypassed by re-selecting the box-default PHP — the pin functions now also give the launcher a #!/bin/bash shebang and a DRUSH_PHP default, so pinned accounts get their configured PHP on every drush entry path. The default never overrides websh: the per-invocation PHP-CLI selection from ~/static/control/ (cli.info and the instant phpNN.info switch files) always wins when present.

2026-07-27

• Changed: the SQL memory derivation is now dataset-aware (Percona setup + tuning): the InnoDB buffer pool follows the measured table-data size under tiered ceilings (3/8 / 3/10 / 1/4 of usable RAM, 1024M-snapped, historical RAM/8 floor, OpenVZ/VS excluded), tmp_table_size/max_heap_table_size drop from the whole per-session SQL budget to clamp(RAM/64, 32–256M), key_buffer_size drops to 64M on proven-MyISAM-free boxes, and the Valkey maxmemory ceiling follows measured peak usage (4× headroom, floors, measurement failures keep the historical RAM/3). Corrected values are written at upgrade time and apply at each box's next natural database restart — no restart wave. Per-knob pins still override everything in both directions.
• Removed: the MySQLTuner integration is retired from BOA entirely — _USE_MYSQLTUNER (auto-stripped from existing barracuda.cnf files), the upgrade-time mysqltuner.pl sizing path, and the fetched mysqltuner5/mysqltuner8 helpers. The per-knob pins replace the use case. Pages updated: Percona setup + tuning, barracuda-cnf, Discontinued features. The seven pin variables now also ship as active (empty) lines in barracuda.cnf itself, per the self-documenting-config policy.
• Added: barracuda-cnf + my.cnf lifecycle — per-knob tuning pins. Seven new optional /root/.barracuda.cnf variables (_SQL_BUFFER_POOL_FORCE, _SQL_TMP_TABLE_FORCE, _SQL_KEY_BUFFER_FORCE, _SQL_LOG_FILE_SIZE_FORCE, _SQL_MAX_CONNECTIONS_FORCE, _VALKEY_MAXMEM_FORCE, _SOLR_HEAP_FORCE) each pin one derived value while BOA keeps managing the rest — the middle path between the fully derived model and the all-or-nothing _CUSTOM_CONFIG_SQL=YES. Values validate fail-closed (plain integers, clamped against installed RAM); a pool pin alone is restart-free.
• Fixed: my.cnf lifecycle — the _CUSTOM_CONFIG_SQL=YES section claimed you own the file "end to end, including keeping it valid across Percona upgrades"; in fact the staged major-upgrade path force-resets the toggle for that run and re-deploys the template over a custom file (preserved under /var/backups/dragon/t/my.cnf-pre-*). The page now documents the real behaviour and the re-apply step a custom box needs in a major-upgrade window, plus the fact that legacy mycnfup does not honour the new pins.
• Added: Cross-host migration — the migration-proxy certificate mirror. A long-lived proxy used to present its cutover-day certificate until it expired 69–90 days later, silently; migration_proxy_certs.sh now pulls each proxied domain's renewed certificate back from the target daily — staged, verified against the key, symlink-topology preserving, configtest-gated — and mails the admin when a horizon inside _MIGRATION_PROXY_CERT_WARN_DAYS (default 21) cannot be refreshed. With it, permanent and ha-switch proxies no longer have a certificate horizon.
• Changed: Ghost cleanup, Limited shell users, barracuda.cnf and octopus.cnf — the ghost-alias sweep (_GHOST_ALIASES_CLEANUP) now holds every candidate for 48 hours from its first sighting and never touches aegir/distro front-end companions, and the omega8.cc-hosted seed covers the whole _GHOST_*_CLEANUP family. Also corrected: a hand-set /etc/boa/.pause_tasks_maint.cnf does not survive on a hosted system, so on builds that predate the hold the guard during an inbound account transfer is setting the flag to NO in both control files. Variables reference regenerated.

2026-07-26

• Changed: Load control — loadguard is retired from delivery. It was a placeholder from a dropped plan to re-orchestrate auto-healing, installed on every box but wired into nothing; the upgrade path no longer ships it, new installs never receive it, and boxes that already have it keep a dormant copy. Pages that mistakenly described it as an active layer — the security model's load-damage layer, the architecture overview, the nginx debugging guide and the firewall-block table — now name the real actor, second.sh and the Abuse Guard's flood scoring.

• Changed: Auto-healing watchdogs and Load control — the low-tail hardening pass across eleven tools. Nginx restarts now escalate gracefully on every path: the recorded master (verified to still be nginx) is asked to QUIT and given a bounded wait before any -9 reaches the survivors, every restart path is cooldown-gated, an operator's restart request landing inside a cooldown is kept for the next pass, and a missing pidfile with a live serving master is treated as an artefact while a missing master always heals. The CRIT-tier process kill is TERM-first with a grace before -9 reaches survivors. The database kill feed is read from information_schema by column name — the positional parse could shift on blank columns, on the path that kills — with daemon and replication threads excluded. A database restart now holds its stand-down marker across the whole stop/start chain with no gap, bounded so a shutdown that never finishes cannot hold the lock forever. Assorted smaller repairs: a healthy rsyslogd is no longer killed for a missing pidfile, the LFD healer no longer re-enables a firewall an operator deliberately disabled, DHCP firewall rewrites are rate-limited, and several operator knobs no longer misread zero-padded values as octal.

• Changed: Percona install & tuning — memorytuner is now advisory only. It used to rewrite /etc/mysql/my.cnf in place (no backup), apply dynamic settings to the running server, and take the whole stack down through a move_sql.sh restart whenever a restart-flagged setting differed — on a healthy box, purely because the recommendation (derived from the live memory use of everything else) drifted from a deliberately set value. It now writes a grouped report to the terminal and /var/log/boa/memorytuner.log with the my.cnf lines to consider, the SET GLOBAL statements for the dynamic ones, and the database-only restart step for a maintenance window; recommendations snap to coarse steps so repeated runs read the same, and Valkey is now measured alongside the other services.

• Changed: Load control — the web pause latch learnt discipline. Resume now takes a minimum hold of consecutive below-resume passes (_RESUME_HOLD_PASSES, default 3), because a pause that stops the web tier collapses load towards zero and a single calm reading proves only that the web is off — clearing on it resurrected web into the same pressure and re-paused a minute later. The clear also stands down while a database restart is in flight, on the same markers the web watchdogs honour, and is evaluated at the end of every pass, so a load spike that just-missed its tier on the re-check can no longer strand a latch set a minute earlier. An orphaned in-progress marker from a killed pause is now dropped after two minutes instead of gating pauses off for up to ten. The load controller's pause and terminate pages also join the shared one-alert-per-incident throttle — it was the one mail-sending script the throttle had not reached, and the one that mails on every pause. See also the updated key table on Auto-healing watchdogs.

• Added: _RESUME_HOLD_PASSES to barracuda.cnf and the variables reference.

• Added: xmass server move and xoct account move — per-account migration proxy modes. How long the old address keeps forwarding, and what each customer is told about it, is now a per-Octopus-account policy (temporary, permanent, ha-switch, retired) kept in a root-owned record on both ends of the move. New xoct proxy-mode (policy table and set; pins beat box sweeps) and xoct proxy-retire verbs, --repair/--retarget to reopen or repoint a proxied account, mode-selected client notices that also state what the old address does not cover, and a record-driven migration_proxy_trust.sh reconcile that keeps the target's trust decision in step with the promise. xmass --proxy-mode writes the box default, prints every account's resolved mode at init, and cutover --live refuses undeclared accounts. --permanent-proxy stays as a deprecated alias.

• Changed: Cross-host migration — a standalone xoct proxy now wires the target-side realip/CSF trust itself; the "trust wiring is xmass-driven" asymmetry note is gone. Four new control files in the control files reference: migproxy.cnf, migproxy.log, migproxy_mode.txt, migproxy_deadline.txt.

• Changed: Auto-healing watchdogs — the cache watchdog was rebuilt and the page described the old one. valkey.sh now probes Valkey itself, across five spaced probes, and only a connect-level failure counts as down — an auth drift (WRONGPASS/NOAUTH) or any other composed reply proves a live server, so a stale password can no longer become a restart loop. The PHP-log-driven restart paths are gone, along with the PHP-FPM reloads they forced. Heals are paced by a cooldown and stopped by the same ledger-and-latch circuit breaker the database uses, on Valkey's own knobs, and a genuine cache restart now mails at the default reporting level instead of only at ALL — with the circuit page on its own throttle key. redis.sh is retired from delivery: boxes that have it keep their local copy, new installs never receive it.

• Added: _VALKEY_COOLDOWN_SECS, _VALKEY_FLAP_MAX, _VALKEY_FLAP_WINDOW_SECS and _VALKEY_FLAP_LATCH_MINS to barracuda.cnf and the variables reference.

• Changed: Auto-healing watchdogs — the memory-pressure response was rewritten and the page described the old one. It no longer reads a single free -mt sample and tears the stack down: pressure comes from MemAvailable and must hold across three samples five seconds apart, and the response is one kill -9 of the largest process that is safe to kill, with the database, the SSH lifeline and the provision/backup chain never chosen. If everything large is exempt it logs, pages, and leaves the rest to the kernel. Repeats are paced by a cooldown and stopped by a circuit breaker, the same shape the database heals use. The per-minute page-cache drop is gone.

• Added: _OOM_COOLDOWN_SECS, _OOM_FLAP_MAX, _OOM_FLAP_WINDOW_SECS and _OOM_FLAP_LATCH_MINS to barracuda.cnf and the variables reference.

• Changed: wide tables across the site — most visibly the control-file, variable and command reference catalogues — now fit the content column instead of scrolling horizontally. Columns auto-size, and a long unbroken value such as a control-file path splits onto the next line only when its column runs out of room; copied paths are unaffected. On phone-width screens tables keep the previous horizontal scrolling, since a multi-column table cannot fit that width either way.

• Changed: xmass server move — the cutover sequence is corrected. The final static/files pass runs before the FLUSH TABLES WITH READ LOCK, not under it: the web freeze is what stops file writes, so holding a database read lock across a walk of every store gained nothing and could keep the source database locked for hours on an account with millions of files. The replica wait is no longer a fixed thirty minutes; the ceiling is _XMASS_SYNC_MAX_WAIT (default 7200 s) and a timeout now reports whether the lag is closing or growing, since a growing lag will not be fixed by waiting. Transfers are gated too: a store that cannot be placed, or an rsync that fails for any reason other than source files vanishing mid-copy, aborts the cutover before anything destructive happens, and every abort after the web freeze prints the commands to restore service on the source.

• Added: xmass server move — the xmass reset-phase recovery verb, and a note that phase=cutover is now recorded only just before the MySQL lock, so an earlier abort stays at syncing and is recovered by re-running the dry run and --live.

• Corrected: xmass server move — the page claimed --permanent-proxy changes the wording of the migration-complete notifications. It does not. The flag is written to /data/conf/xmass_permanent_proxy.pid but nothing reads it, so the notifications are worded for a temporary proxy either way and still ask the client to update DNS as soon as possible.

• Changed: Auto-healing watchdogs and Dumps with mydumper — the crashed-table repair path now declines while a backup, another maintenance operation, an auto-heal or a restart is in flight, because a full-server mysqlcheck takes locks across every database. mysql_repair.sh additionally holds the maintenance marker for its own run, so the watchdog cannot read a full repair as a fault.

• Added: Auto-healing watchdogs — a new "One alert per incident, not one per pass" section under Email reporting. A service that keeps failing used to mail every time a watchdog acted on it; each watchdog now holds an alert back when it has already sent one for that class of incident inside _INCIDENT_EMAIL_COOLDOWN_SECS (default 30 minutes), and says in the subject how many it stood in for. The page lists which classes keep separate cooldowns and why, since a cheap alert must never spend the budget an expensive one needs.

• Added: _INCIDENT_EMAIL_COOLDOWN_SECS to barracuda.cnf and the variables reference.

2026-07-25

• Changed: Auto-healing watchdogs, Percona install & tuning and Graceful MySQLD control — the database watchdog was reworked, and these pages described the old behaviour. It no longer calls a server down because a socket or PID file is missing: it asks the server with a mysqladmin ping, re-tries across a short grace, and treats any reply — an authentication error or Too many connections included — as proof it is alive. Recovery is now database-only through the new move_sql.sh dbrestart verb, documented here for the first time; it no longer stops Nginx and PHP-FPM, wipes the cache or drops the page cache, and the high-load and Too many connections paths no longer restart the database at all. The start wait is bounded, and the lock cycle's cache drop is gone.
• Added: a flap circuit breaker in Auto-healing watchdogs, as a fourth recurring pattern and summarised on the database pages — repeated recoveries are spaced by _SQL_COOLDOWN_SECS, counted in a ledger, and after _SQL_FLAP_MAX heals inside _SQL_FLAP_WINDOW_SECS the breaker latches, logs CIRCUIT OPEN, sends one e-mail and stops restarting the database until an operator clears the latch or _SQL_FLAP_LATCH_MINS elapses.
• Added: the four knobs above to barracuda.cnf and the variables reference.
• Added: a fifth recurring pattern in Auto-healing watchdogs — the Nginx, PHP-FPM and cache watchdogs now stand their pass down while a database restart is in flight. move_sql.sh stops Nginx and every FPM pool to restart the database and does not start them again, so those watchdogs are the intended recovery; without the stand-down each pass restarted its service mid-teardown, in front of a database that was still coming up. Recovery is deferred by the length of the restart, not cancelled, and the new _SQL_MUTATION_MAX_MINS bounds how long an abandoned marker is believed.
• Changed: Ghost & empty-artifact cleanup — the nightly ghost-vhost check was fixed, and the page described it as one test when _GHOST_VHOSTS_CLEANUP in fact gates two: a vhost whose name ends in .restore, documented here for the first time, and a vhost with no matching site Drush alias. Each now keeps its own consecutive-night counter. The verbatim log block was reissued, since the old combined dry-run/grace line no longer exists and the two states must be read apart: a nightly dry-run line on a box whose flag is YES means something is resetting the counter. The 24-hour freshness test now guards the .restore case too, and is read once per vhost before the same run's own vhost fixes can rewrite the file.
• Changed: Ægir task failures, Backup-task failures and Ghost & empty-artifact cleanup — a failed Clone or Migrate strands two different kinds of leftover, and these pages between them covered only one at a time. Removing the sites/<domain>.restore directory, whether through the panel's Purge leftover task or by hand, leaves the matching .restore nginx vhost and Drush alias untouched; those are moved to undo/ by the nightly ghost-vhost check instead, which acts only after the ghost state holds across two consecutive nights and is off by default on any server that is not omega8.cc-hosted. The three pages now cross-link both halves, and task failures carries the manual path for a box where that flag is off.

2026-07-23

• Changed: Backdrop CMS sites moved to the top of the Using BOA chapter — it now sits right below Welcome instead of at the tail of the menu, with the sections in between shifted down one place. Page addresses are unchanged.
• Changed: Off-site backups & mybackup — reworked to the Basic use / Advanced use shape of the original backup guide: the hosted-or-PRO availability of the extended off-site subsystem now leads the page, a five-step basic path follows, and the deeper detail (includes/excludes, bucket naming, precise restores) sits under Advanced use. The backups chapter and the backups cheat sheet carry the same availability note.
• Changed: the Using-tree "Search, mail & access" grab-bag chapter is gone, split into Protecting your site — restricting access, site IP lock, login/admin IP lock, AI crawlers — and Extra services — Search (Solr), Adminer, outbound mail, New Relic.
• New: Print & PDF tools — the system wkhtmltopdf / pdftk binaries, previously mentioned only inside a chapter intro, now on their own findable page.
• New: Faster cloning and migration (FastTrack and MyQuick) — split out of Cloning and moving a site. The two optional speed switches and their FastTrack.info / ClassicTrack.info / MyClassic.info control files now have their own focused page.
• New: Ruby Gems and Node tools (Compass, Gulp, Grunt, Bower) — split out of Developing your site. The Sass/Compass and Gulp/Grunt/Bower shell toolchains and the compass.info control file gathered onto a dedicated page; the .dev. preview URL and theme debugging stay on dev-workflow.
• New: Whole-site IP allow-list — ip_access and Login/admin IP allow-list — user_admin_access — split out of Admin URL protection, which now covers only the default admin-path guard and its opt-out. Each new page carries its control file (access.txt / user_admin.txt) and cross-links its hosted-customer twin.
• New: Strict binary permissions and Security audit hardening — the deep hardening knobs relocated off the security model, which returns to a pure protection overview; the Node/NPM gate moved to lshell + manage_ltd_users, and the _PHP_FPM_DENY block deduped to FPM capacity sizing with a corrected description of the replace-not-append token mechanics.
• New: xoct — moving one account and xmass — moving a whole server — the two cross-host migration runbooks split out of Cross-host migration, which becomes the which-tool-when overview carrying the shared freeze and migration-proxy material.
• New: HTTP/3 and KTLS and SQL-admin vhosts — split out of Config templates, which keeps the static template set, the master http config and the rate-limit zones.
• New: Site IP lock and Login/admin IP lock — the two IP-based locks now have their own focused pages in the Using area, split out of Restricting access to your site, which becomes the family overview plus the default admin-page protection. Every access control is now its own entry in the section menu; the control files index rows for access.txt and user_admin.txt point at the dedicated pages.
• New: AI crawlers and assistants and AI crawler policy — the AI bot policy now has its own focused page in both the hosted-customer and the operator areas, split out of Restricting access to your site and Edge policy where it was buried as a trailing section. Both source pages slim down to their remaining topics and cross-link the new pages; the control files index rows for policy.txt now point at the dedicated pages.
• Updated: scan_nginx scoring, Ban pipeline, Operations + tuning, Abuse Guard internals and IP-blocked recovery — the adaptive IDS whitelist now covers IPv6: csf.allow cannot hold an IPv6 entry, so guest-water.sh mirrors the published Googlebot ipv6Prefix crawl ranges (146 /64 ranges as of today) into a new nginx-native allow store /var/xdrago/monitor/log/web6.allow, and the scorer family-dispatches every IPv6 client to it — a legitimate IPv6 crawler is exempt from both scoring and the v6 web ban. An empty provider fetch keeps the existing entries, and untagged manual lines survive the daily refresh — which is also how you whitelist your own IPv6 range. The web6.allow row joins the control files index.
• Updated: In-place upgrades — two important corrections: the Ægir Backup task never includes the platform codebase (it archives the site directory and, depending on the backup mode, a database dump), so the codebase must be backed up manually before an in-place upgrade; and a prominent warning is added — never use this method unless prepared for extended downtime, and never run a platform Verify before the PHP and Nginx caches have expired and proven the sites still work, because Verify re-locks the code immediately and a broken platform then stays broken until the next nightly run (or your host) returns ownership.
• Updated: Branches and editions, Start here and Solr overview and tuning — LTS and PRO are kept 1:1; the extended backup sub-system is the only PRO-only, licence-gated feature. The stale "Solr 9 is BOA PRO only" note is removed (Solr 9 ships to both editions).
• Updated: Restoring with mybackup now walks through setting up the off-site provider side — the ready-made credential templates with the aws.txt example, the KEEP_WITHIN / FULL_BACKUP_FREQUENCY retention knobs, and the automatic back-to-USER-HOSTNAME-PROVIDER bucket-naming rule; the per-provider <service>.txt credential file also joins the control files index.
• Updated: this changelog — the site-launch entry now correctly records the launch alongside BOA-5.88.8 Continuity Edition on 2026-07-18; it previously named BOA-5.88.811.
• Updated: all release notes pages now link the matching pages on this site — Manual BOA upgrade reference, SELFUPGRADE reference, the access-control and edge-policy pages, and Backing up & restoring — instead of the retiring GitHub docs/ files.
• Updated: upgrade blocks on older release notes pages now end with boa reboot (the BOA-aware graceful reboot), matching current guidance.
• New: In-place upgrades — unlocking your codebase — the unlock.info workflow for brave in-place composer/git upgrades, previously undocumented.
• New: The codebase lock — nightly ownership management — the mechanism behind the nightly ownership re-assert, the unlock.info/skip.info switches, and the operator knobs that gate it.
• Reference: unlock.info and skip.info added to the control files index.
• Updated: Shared codebase permissions — fixrepo now links the codebase lock page instead of describing the lock inline.
• New: this changelog page.
• New: Shared codebase permissions — fixrepo — the root-only fixrepo tool for group-write + setgid repair on shared codebases, previously undocumented; added to the commands index.
• Reference: _SYSTEM_AUTO_SECURITY added to the variables index.
• Updated: BOA-5.88.811 release notes gained the launch-day Backdrop CMS 1.34.3 same-day update.
• Updated: Dumps with mydumper now covers the myloader --overwrite-tables → --drop-table=DROP compatibility wrapper, the automatic --trx-tables=0 handling that keeps mixed-engine databases in the nightly archives, and the five-group /root/.my.cnf format.

2026-07-22

• Updated: Prebuilt stack packages documents the archived Percona 5.7 mirror safety net for fresh legacy installs.

2026-07-18

• Site launch — this documentation went live together with BOA-5.88.8 Continuity Edition.