Command reference
Every documented BOA command and helper tool, indexed straight from the documentation pages — each entry links back to the page that documents it.
| Command | Purpose | Documented in |
|---|---|---|
aegir2boa-preflight |
Read-only phase-0 discovery for a candidate vanilla Ægir box - inventories the estate and grades STAGE 1 / STAGE 2 PASS/WARN/FAIL, writing a human report and a machine contract under /tmp; writes only /tmp, installs nothing, SQL is SELECT/SHOW-only; A2B_NO_DRUSH=1 suppresses the one optional drush health check, A2B_ALLOW_BOA=1 permits inspecting a BOA box (verdicts stay FAIL), --aegir-root handles non-standard layouts; exit 0 report emitted, 2 precondition failure, 3 hard-floor bail | /operating/migration-cloning/aegir-to-boa |
aegir2boa-stage1 |
In-place Apache-to-Nginx flip on the vanilla source using Ægir's native http_service_type - verbs --flip / --revert / --status, every acting verb a DRY run unless --live; both stacks stay installed until sign-off so the revert is flipping back; handles http_service_type apache and apache_ssl (the apache_ssl to nginx_ssl path drilled end to end, certificates carried and HTTPS verified each way; cluster/pack refused); logs to /var/log/aegir2boa-stage1.log | /operating/migration-cloning/aegir-to-boa |
aegir2boa-stage2 |
The dual-resident migrator - source verbs (peer/check/pre-mig/create/export/transfer/proxy/cert-sync/revert/resume/status) refuse to run on a BOA box and target verbs (peer/import/target-status) refuse to run on a vanilla box; peer arranges firewall-then-key reachability between the boxes, adopts the estate per-site or by whole-panel db-import, demotes the source to an HTTP(S) proxy with a per-site dotfile revert (proxy --refresh re-renders already-proxied vhosts in place from current templates); every acting verb a DRY run unless --live; logs to /var/log/aegir2boa-stage2.log | /operating/migration-cloning/aegir-to-boa |
autosymlink |
Root worker for native files/private symlinking - global modes DRY (default) / report / live / batch / --batch-if-clean, plus narrow single-site mode --site <url> [--account <oNNN>] [--apply] [--force-unshare] used by the Provision install/clone/migrate hooks; crash-safe conversion, logs to /var/log/boa/autosymlink.log; a NOT CLEAN dry run ends with a read-only [EXPLAINED] section that re-probes each blocking finding and reports the diagnosis and fix (ghost alias, platform gone, migrate stranded, space, non-standard symlink) | /operating/files-symlinking/tools-reference |
clearwebbans |
One-shot idempotent recovery from web-IDS false positives - removes permanent 'Brute force Web Server' csf.deny entries and temporary 80/443 bans, clears web.log and scan_nginx archive logs plus the nginx-native IPv6 web-ban store (web6.tempban), resets the scan_nginx byte-offset to end of access.log, regenerates both nginx geo-ban sets (IPv4 via nginx_deny.sh, IPv6 via nginx_deny6.sh); SSH/FTP bans untouched; supports --dry-run; lock /run/clearwebbans.lock | /operating/abuse-guard/operations |
dhcpfix |
Safe-on-live-servers DNS recovery tool - installs the /etc/dhcp/dhclient-enter-hooks.d/nodnsupdate no-op hook (so dhclient can never overwrite resolv.conf on lease renewal) and writes the canonical resolv.conf once (127.0.0.1 plus 1.1.1.1/8.8.8.8/9.9.9.9 fallbacks), leaving it mutable; no lease release/renew, no dhclient.conf rewrites; _DEBUG_MODE=YES env gives verbose [dhcpfix] output | /operating/troubleshooting/dns-resolver |
drush @hostmaster hosting-migrate-source-sweep |
Reconcile migration-source grants against what the Ægir instance intends - revokes grants nothing justifies, and queues a verify where an intended grant is missing. | /operating/migration-cloning/migration-source |
fix-drupal-site-symlinks.sh |
Hardened NOPASSWD sudo entry point (/usr/local/bin, 700 root) letting aegir/oN users trigger the root-level single-site conversion - accepts only --site=<url> [--account=<oNNN>] [--force-unshare], fail-closed token validation, cannot reach autosymlink's global batch/live modes; the documented manual recovery for incomplete clone unshares | /operating/files-symlinking/tools-reference |
fixrepo |
Root-only repair of a codebase for the shared oN + oN.ftp same-group workflow - chmod -R g+rwX over the whole tree, setgid on every directory, and (when .git is present) a permissions pass over the git internals plus git config core.sharedRepository=group run as the repo owner; resolves its single path argument to the real target and refuses anything outside /data/disk/<user>/, /var/aegir/, /var/www/ and /home/<user>/; knobs _DEBUG_MODE=YES and _STRICT_MODE=NO; idempotent, never scheduled/automated | /operating/security/shared-codebase-permissions |
floodreport |
Read-only summariser of Abuse Guard i18n-flood activity from /var/xdrago/monitor/log/i18n_flood.log and the per-trip snapshot dir - per-vhost event counts, timeline, merged attack profile and findings (SATURATION / LOAD-PAUSE / SHED / DETECT); options --days N, --hours N, --data DIR, --json | /operating/abuse-guard/operations |
hosting-dispatch |
Centralised command that dispatches the registered queue processors (tasks, cron, task_gc) | /developing/aegir-apis/hosting-api |
hosting-import |
Import an existing back-end context name into the front end | /developing/aegir-apis/hosting-api |
hosting-pause |
Prepare the hostmaster site to be migrated to a new platform | /developing/aegir-apis/hosting-api |
hosting-resume |
Complete the migration of the hostmaster site to a new platform | /developing/aegir-apis/hosting-api |
hosting-setup |
Set up initial configuration such as the cron entry for the queue dispatcher | /developing/aegir-apis/hosting-api |
hosting-task |
Execute a specific queue item (one Ægir task node) | /developing/aegir-apis/hosting-api |
loadguard |
RETIRED placeholder from a dropped orchestrator redesign, never wired into any crontab; no longer delivered - new installs never receive it, boxes that already have it keep a dormant copy at /opt/local/bin/loadguard. second.sh is the live load-control enforcement path | /operating/monitoring/load-control |
loadreport |
Read-only /proc load profiler answering which recurring BOA agents drive idle load - modes live (default), --json, --log (append daily JSONL history), --data (summarise an off-node corpus); header shows the box's live monitor-throttle class; cron-logged every 30 min at idle priority | /operating/monitoring/loadreport |
migratefs |
Operator-only relocation of account static/files stores and shared /data/disk/arch onto the single attached /mnt filesystem, symlinked back (<mount>/files/<oN>/static/files and <mount>/files/system/arch) - DRY plan by default, --apply to perform; options --target <mount>, --account <oN> (implies skipping arch), --no-arch, --yes, --grace <sec> (default 15); refuses to run with more than one /mnt mountpoint; never scheduled/automated | /operating/migration-cloning/migratefs-storage-relocation |
owl.sh |
Nightly maintenance orchestrator (/var/xdrago/owl.sh, replaces daily.sh) - freezes run state into /run/night/run.env and dispatches the night/ workers (night.inc.sh, 10-account.sh, 20-sites.sh, 90-global-post.sh); launched from root crontab at 04:15; optional parallel account fan-out via _NIGHT_PARALLEL/_NIGHT_MAX_PARALLEL; per-account logs /var/log/boa/daily/acct-<user>-<NOW>.log; xoct/xcopy disable toggle /var/xdrago/.owl.sh.off; skips entirely on /root/.proxy.cnf, /root/.pause_heavy_tasks_maint.cnf or /root/.standby.cnf boxes | /operating/monitoring/nightly-owl |
provision-backup |
Generate a backup tarball of DB, files and config | /developing/aegir-apis/provision-api |
provision-clone |
Clone a site to a new name on the same platform | /developing/aegir-apis/provision-api |
provision-delete |
Backup and remove a site, or remove an empty platform | /developing/aegir-apis/provision-api |
provision-deploy |
Re-deploy a backup tarball with pre and post upgrade hooks | /developing/aegir-apis/provision-api |
provision-disable |
Disable a running site by swapping its vhost for a disabled redirect | /developing/aegir-apis/provision-api |
provision-dlock |
Lock a platform's local (vendor) Drush - thin wrapper that auto-fixes the platform root and delegates to the canonical lock path used by Platform Verify; detection-based idempotent (re-running in the locked state is a clean no-op) | /developing/aegir-apis/provision-api |
provision-dunlock |
Unlock a platform's local Drush before vdrush/composer work; idempotent, and Verify/upgrade re-locks all platforms automatically | /developing/aegir-apis/provision-api |
provision-enable |
Re-enable a disabled site | /developing/aegir-apis/provision-api |
provision-import |
Detect existing site directories on a platform and register them as Ægir site nodes | /developing/aegir-apis/provision-api |
provision-install |
Install a new Drupal site (DB, files, vhost, install profile) | /developing/aegir-apis/provision-api |
provision-lock |
Lock a platform against new site creation | /developing/aegir-apis/provision-api |
provision-login-reset |
Generate a one-time admin-login URL for the site | /developing/aegir-apis/provision-api |
provision-migrate |
Move a site to a different platform (used for Drupal-version upgrades) | /developing/aegir-apis/provision-api |
provision-restore |
Revert a site to a previous backup tarball | /developing/aegir-apis/provision-api |
provision-save |
Save a context to disk (used internally by other commands) | /developing/aegir-apis/provision-api |
provision-stats |
Return Drupal stats such as user count and post count | /developing/aegir-apis/provision-api |
provision-unlock |
Unlock a platform so new sites can be created again | /developing/aegir-apis/provision-api |
provision-verify |
Re-emit Nginx vhost and settings.php from current Ægir context (idempotent) | /developing/aegir-apis/provision-api |
renameaegirhost |
Universal in-place Ægir hostname rename for the BOA Master (--aegir-root /var/aegir) or any Octopus account (--aegir-root /data/disk/oN) - rewrites Drush aliases, nginx vhosts and the Ægir DB with serialise-safe statements behind a completeness-verified backup dump, carries host-derived tenant sites (directory, alias file, static files store, settings.php URI values, per-site PHP pins) through the rename with a fail-closed pre-queue gate, runs the 5-pass Ægir task queue, and ends with a bounded per-site serving gate (_RENAME_SERVE_WAIT, default 180 s); flags --dry-run, --force-old FQDN, --old-account/--new-account (account axis, used by xoct rename mode); called automatically by xoct import and xmass cutover | /operating/architecture/entity-model |
solrtrim |
Per-version Solr uninstall/cleanup (root-only, /opt/local/bin) - status classifies each of solr4/jetty9, solr7 and solr9 as USED, stale, ambiguous, unused or absent on the one-year index-write bar (newest data/index write per dotted core, reported per version; live boa_site_control.ini bindings and SR tokens count as used regardless of write age) and forecasts whether the next full barracuda pass would (re)install it; remove takes unused and stale versions off the box deny-first (variable + /etc/boa marker written before anything is deleted), refuses USED and ambiguous versions without --force, archives the data tree to /var/backups before removing any version with real cores, and with 'all --blanket' writes the blanket java deny pair once nothing remains installed - the golden-template end state that survives full barracuda passes with nothing reinstalling | /operating/solr/overview-and-tuning |
sqlclean |
Root-only orphan-database detector and cleaner at /opt/local/bin/sqlclean - bare run = DRY report only (writes /var/log/dbs_to_remain.log, /var/log/db_cleanup.log and the ghost manifest /var/log/sqlclean-ghosts.txt, deletes nothing); sqlclean LIVE = interactive cleanup where each ghost must be confirmed by typing its exact name (needs a terminal); sqlclean LIVE auto = non-interactive runbook mode gated on a fresh reviewed manifest. Truth source is the Drush alias set, never the nginx vhosts. Exit codes 0 clean, 1 refused or failed outright, 2 completed with at least one failed drop | /operating/database/orphan-database-cleanup |
stackbuild |
Builder-mirror tool that snapshots, packages and publishes the heavy stack components (Modern/Legacy OpenSSL, ICU, cURL, Valkey, Nginx, Unbound, Pure-FTPd and each selected PHP) that a real barracuda upgrade just built, as prebuilt per-component .deb.gz packages with sha256 sidecars; verbs check, package, publish, sync, all, force; also detects and republishes packages gone stale when a companion bump (an OpenSSL pin bump rebuilding PHP/Nginx) rebuilt a tree without changing its own version; refuses to run unless _USE_PREBUILT_PKGS=NO on the builder box; run daily from cron | /developing/prebuilt-builder-pipeline |
staticbuild |
Mirror-source builder for the newer Drupal core and distribution test codebases (plus the Backdrop family) that publishes them to /var/www/static/{core,distro,dev/{dev,lts,pro}}; run as root on the mirror-source VM, builds as the Octopus user (o8, -u overrides); subcommands check / catalogue / all / build / package / distribute / backdrop, every published version derived from the actual build | /developing/build-test/staticbuild-test-codebases |
symlinkinfo |
Read-only query of one or more sites' files-symlink and archive history from autosymlink logs plus the live filesystem - reports conversions, State NOW (active/disabled/deleted/partial), Store NOW and every archive event; options --logs-only, --fs-only, --log-dir DIR, --disk-root DIR | /operating/files-symlinking/tools-reference |
updatesymlinks |
Root wrapper around autosymlink with queue pausing, locking, load guards and email - 'updatesymlinks --auto-fix' (gated by _AUTOSYMLINK_NIGHTLY=YES) pauses the Ægir queue, waits _AUTOSYMLINK_PAUSE_GRACE (240 s default), then runs the batch-if-clean apply; '--orphan-report' (gated by _ORPHAN_FILES_REPORT=YES) is read-only and never pauses tasks; argless run = legacy full manual mode; '--debug|-d' explains why a run did nothing; cron line 47 0-5,22,23 * * * | /operating/files-symlinking/nightly-automation |
xcopy |
Non-destructive single-account duplicate onto a second host (root-only, /opt/local/bin) - xoct's dispatcher shape without http-off on the source and without the proxy conversion; source stays live throughout, target gets a full independent copy; same truthful dump/import gating and DRY/--live storage model as xoct | /operating/migration-cloning/xoct-account-move |
xdr9000 |
Root-only, read-only reader for the permanent on-box health/attack archive - status, today, attacks/heals over a window, a full report with since-first-record totals, and raw JSONL feeds; reads gzip-compressed past months transparently | /operating/monitoring/attack-health-archive |
xmass |
Whole-server BOA migration driver (root-only, /opt/local/bin) - moves every Octopus account, database and Solr index to a fresh target over xtrabackup snapshot + GTID replication; verbs pre-mig / prep-target / init / sync / status / cutover / verify / post-mig / restore-solr / reset-phase, with sync and cutover behind the storage-aware DRY/--live gate and every state-mutating verb behind a box-wide owner-PID single-flight lock (status and verify stay unlocked); prep-target refuses across BOA releases and gates the target's Solr set against the source's measured USED set (per-version classification on the one-year index-write bar with a live-bindings carve-out, newest-write dates reported per version; --fix-solr reconciles with per-version denies, the blanket java pair, unpark via the target's restore-solr and one preflighted install pass; init/sync/cutover re-gate before any Solr data tree can land); restore-solr re-enables the Solr stack on a rolled-back source (clearing the deny by hand is not enough) | /operating/migration-cloning/xmass-server-move |
xoct |
Single-account cross-host move (root-only, /opt/local/bin) - dispatch verbs export / create / import / pretransfer / transfer / proxy / proxy-mode / proxy-retire / reset-state / pre-mig / post-mig / ssl-gen; mydumper/myloader DB phase (cross-Percona-version safe), truthful export/import gating via log/export_failed.pid and log/import_failed.pid, storage-aware DRY/--live on transfer/pretransfer, box-wide owner-PID single-flight on every state-mutating verb (proxy-mode stays unlocked), and the migration-proxy conversion with per-account policy modes; optional fourth argument renames the account on the target | /operating/migration-cloning/xoct-account-move |
xtrim |
PX0 shrink tool for fully proxied migration sources (root-only, /opt/local/bin) - verbs status / plan / quiesce / restore / shrink / finalize, flags --live (act; DRY otherwise), --dry/--test (explicit DRY) and --drop-datadir (finalize only; the MySQL data directory is kept by default and the dry-run token is keyed to the flag); per-account phase gating (none / stage-a / stage-b-started / stage-b / restored, shown by status as phase=), reversible quiesce with quarantine restore, dump-verified one-way shrink, and the box-wide finalize that stands down only what a proxy genuinely has no use for | /operating/migration-cloning/px0-proxy-shrink |