Control-file reference
Every documented BOA control file, indexed straight from the documentation pages — each entry links back to the page that documents it. Most are markers or one-line files whose presence (or single value) changes behaviour; for the few settings-store files listed here (barracuda.cnf, octopus.cnf, the two boa_*_control.ini templates) the individual settings are indexed separately under Variables.
| File | Location | Purpose | Documented in |
|---|---|---|---|
.${USER}.octopus.cnf |
/root/ |
Per-instance settings store for one Octopus instance (o1, o2), sourced by the octopus/boa installer and upgrade runs - holds instance identity, platform-tree control, per-instance PHP-FPM sizing, SQL conversion, cleanup retention and the _CLIENT_OPTION plan selector; individual settings indexed separately | /operating/control-files-ini/octopus-cnf |
.activate.apparmor.cnf |
/root/ |
Presence under /root/ loads the AppArmor profile set in complain mode via aa-complain - violations logged but not blocked. Needs a reboot with the grub apparmor=1 flag to take effect. Absent by default. | /operating/security/apparmor |
.allow-codebasecheck.cnf |
/etc/boa/ |
Legacy presence marker, converted to the _ALLOW_CODEBASECHECK variable in /root/.barracuda.cnf — the variable is the supported switch and the flag stays honoured for one release. When enabled, the nightly owl maintenance runs single-codebase codebasecheck once per platform per night; the file under each account's log/ctrl/ is only the zero-byte once-per-night stamp — findings go to the per-account night log and, for non-OK codebases, to /var/log/boa/core/incompatible-*.log. To switch it off, set _ALLOW_CODEBASECHECK=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/database/percona8-readiness |
.allow-php-multi-install-cleanup.cnf |
/root/ |
Presence marker in /root/ gating automatic deactivation of unused PHP versions on an UPGRADE pass - written by barracuda php-idle disable, removed by php-idle enable, or set by hand to opt a classic-path host into the _AUTO_PHP_CLEANUP prune. | /operating/os-lifecycle/major-os-upgrade |
.allow.aegir.queue.cnf |
/etc/boa/ |
On CI or Jenkins-style boxes where the automatic queue is off by default, its presence lets the automatic task queue run - still requires at least one instance to opt in via run-aegir-queue.info. Converted to _ALLOW_AEGIR_QUEUE=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _ALLOW_AEGIR_QUEUE=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. | /operating/architecture/task-queue |
.allow.any.virt.cnf |
/root/ |
Opt-in expert override control file - its presence lets BOA install when it cannot detect a virtualisation layer and would otherwise treat the host as unsupported bare metal and stop. Emphatically unsupported - use a VM for a first server instead. | /self-hosting/before-you-install |
.allow.apparmor.cnf |
/root/ |
Record of the enable decision, not a switch - barracuda touches it in the AppArmor install arm and removes it in the removal arm, and the major-OS-upgrade drivers autobeowulf, autochimaera, autodaedalus and autoexcalibur touch it too, but nothing in the tree ever reads it back, so creating or deleting it by hand changes no behaviour. What it records is decided by /root/.keep_apparmor_on.cnf and /root/.deny.apparmor.cnf. | /operating/security/apparmor |
.allow.auto.reboot.cnf |
/root/ |
Operator-created marker opting a non-hosted box into unattended reboot after a scheduled kernel upgrade - its presence (or _hostedSys=YES) makes autoupboa run _if_new_kernel_reboot and trigger boa reboot when a new kernel is pending, only inside the 04:00-04:59 night window and never on a day with a barracuda/octopus upgrade scheduled in /etc/crontab; each reboot is logged in /var/log/boa/kernel-reboot.log and announced by email alert to the configured admin address. Stays in /root, not relocated to /etc/boa. | /operating/os-lifecycle/selfupgrade-reference |
.allow.clamav.cnf |
/root/ |
Operator-created opt-in that keeps ClamAV registered - its absence is the active state, so on a box carrying no marker autoupboa deregisters clamav-daemon and clamav-freshclam on every pass, moves both init scripts into /var/backups, kills clamd and freshclam and clears /run/clamav. Six of the seven readers use that negated test - autoupboa, the four codename upgrade drivers autobeowulf, autochimaera, autodaedalus and autoexcalibur, and the clean-boa-env stop path - and /root/.deny.clamav.cnf overrides the opt-in in all of them. The single positive reader is the system monitor auto-restart, which additionally requires that /root/.deny.clamav.cnf is absent, that /data/u exists and that both init scripts are still in /etc/init.d, and which stands down while /run/max_load.pid or /run/critical_load.pid exists; BOA never creates or erases this marker and the hosted normalisation block does not touch it. Converted to _ALLOW_CLAMAV=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _ALLOW_CLAMAV=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. The pair converts together and all seven read sites honour both forms. Transition caveat - until the next release serial reaches the two slow-cycle OS-upgrade drivers autochimaera and autodaedalus, which are refreshed only through the release-latched tool update, pair _ALLOW_CLAMAV=YES with the marker file, because a major OS upgrade driven by a still-stale driver would tear ClamAV down on a variable-only box. | /operating/os-lifecycle/selfupgrade-reference |
.allow.downgrades.on.same.os.dist.upgrade.cnf |
/root/ |
One-shot marker making the same-OS dist-upgrade pass run apt-get dist-upgrade --allow-downgrades (twice, as the pass always double-runs), then deleting the marker after honouring it. Both BOA-written and operator-written - a major OS hop touches it itself before the pre-reboot leg so the resumed post-reboot dist-upgrade can replace packages with older builds from the new release's repositories, which plain dist-upgrade refuses; an operator can also touch it by hand to unstick a same-OS pass blocked on a package apt refuses to downgrade. Seeing it appear and vanish during a hop is normal behaviour, not tampering. No variable form exists. | /operating/os-lifecycle/major-os-upgrade |
.allow.du.cnf |
/etc/boa/ |
Presence keeps the du command available to lshell users - the test is negated, so with the file absent manage_ltd_users.sh strips both the du entry in the allowed command list and the du -s -h alias out of the lshell config it regenerates on every pass. Box-wide, affecting every lshell account on the host, and applied on the next pass (within three minutes) only when the regenerated config differs from the installed /etc/lshell.conf, in which case the previous copy is kept under /var/backups/ltd/old/. Read from /etc/boa/ only - BOA copies a legacy /root/ original across once during upgrade. Converted to _ALLOW_DU=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _ALLOW_DU=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. The read site is an AND-of-negations, so du survives when either the file exists or the key is YES, and the strip happens only when both are absent. | /operating/security/lshell-ltd-users |
.allow.mc.cnf |
/root/ |
Presence opens Midnight Commander to lshell users - MC can spawn sub-shells and thus bypasses the lshell layer, so do not enable on untrusted-tenant hosts. Deliberately NOT converted to a barracuda.cnf variable - the file stays the control and stays in /root, because the lshell shell-escape family (.allow.mc, .allow.node.lshell, .allow.php.lshell) is kept file-only on purpose - a cnf line is copyable box-to-box in a way a root-owned marker is not. No variable form exists; do not look for one. | /operating/security/lshell-ltd-users |
.allow.nginx.restart.cnf |
/etc/boa/ |
Box-wide enable for the self-service run-nginx-restart.pid sentinel - presence is an extra OR-arm beside the qualifying-plan grep (POWER/PHANTOM/CLUSTER/ULTRA/MONSTER) in nginx.sh, never a replacement, so plan-based eligibility keeps working with or without it. Neither test is per-account, so one marker opens the gate for every account on the box, and the nginx restart it triggers is box-wide anyway. The restart stays cooldown-gated by _NGINX_COOLDOWN_SECS and a request landing inside a cooldown is kept for the next pass rather than consumed. Read from /etc/boa only - operator-created, with no BOA writer and no hosted wipe; an existing /root copy is migrated once by the svc-control relocation. Converted to _ALLOW_NGINX_RESTART=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _ALLOW_NGINX_RESTART=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/monitoring/auto-healing |
.allow.node.lshell.cnf |
/root/ |
Presence allows Node and NPM for lshell users - Node can bypass lshell, so only enable on trusted-tenant hosts. | /operating/security/lshell-ltd-users |
.allow.php.fpm.reload.cnf |
/etc/boa/ |
Legacy host marker enabling the self-service run-php-fpm-reload.pid FPM-reload sentinel box-wide, converted to the _ALLOW_PHP_FPM_RELOAD variable in /root/.barracuda.cnf — the variable is the supported switch and the flag stays honoured for one release. Without either, the sentinel works only for qualifying-plan accounts (POWER/PHANTOM/CLUSTER/ULTRA/MONSTER). Box-wide in effect either way — the reload recycles every FPM version's workers, not one account's. To switch it off, set _ALLOW_PHP_FPM_RELOAD=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/php-fpm-performance/cache-tuning |
.allow.redis.restart.cnf |
/etc/boa/ |
Back-compat twin of .allow.valkey.restart.cnf - the current valkey.sh watchdog honours this redis-named file exactly as it honours the valkey-named one, so a box carrying it from before the Valkey rename keeps working untouched, and it is the only name the retired redis.sh watchdog knows. Presence is an extra OR-arm beside the qualifying-plan grep (POWER/PHANTOM/CLUSTER/ULTRA/MONSTER), enabling the self-service cache-restart sentinel box-wide; redis.sh tests this same filename twice in one OR chain, a harmless duplicate arm with no behavioural effect. Read from /etc/boa only - operator-created, with no BOA writer and no hosted wipe. Converted to _ALLOW_VALKEY_RESTART=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _ALLOW_VALKEY_RESTART=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/monitoring/auto-healing |
.allow.sendmail.cnf |
/etc/boa/ |
Box-wide toggle that re-opens /usr/sbin/sendmail for hosted-site local delivery - present flips the binary to mode 755, absent keeps it 750 so sites cannot send locally. While present, _smtp_check also clears the Postfix relayhost, forcing direct delivery for all mail. Converted to _ALLOW_SENDMAIL=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _ALLOW_SENDMAIL=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/security/mailing-policy |
.allow.valkey.restart.cnf |
/etc/boa/ |
Forward name of the pair - presence is an extra OR-arm beside the qualifying-plan grep (POWER/PHANTOM/CLUSTER/ULTRA/MONSTER) in valkey.sh, enabling the self-service cache-restart sentinel box-wide for every account (valkey.sh accepts either run-valkey-restart.pid or the older run-redis-restart.pid, and clears both names when it acts). Only valkey.sh reads this name - a box still running its own local copy of the retired redis.sh needs the redis-named twin .allow.redis.restart.cnf instead. Restarts stay paced by _VALKEY_COOLDOWN_SECS. Read from /etc/boa only - operator-created, with no BOA writer and no hosted wipe. Converted to _ALLOW_VALKEY_RESTART=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _ALLOW_VALKEY_RESTART=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/monitoring/auto-healing |
.auto.up.cnf |
/root/ |
Vestigial write-only stamp with NO reader anywhere in the tree - autoupboa touches it once on a BOA-hosted box (host8 marker present, or an .aegir.cc hostname) the first time its hosted-fleet arm runs, and nothing ever consults it since the historical auto-upgrade eligibility readers were removed. Creating it by hand enables nothing; deleting it breaks nothing (it is recreated on the next hosted pass); a stale copy on a box that left the hosted fleet is expected residue. Its mtime records the FIRST hosted pass, not the latest - it is not a heartbeat. Never created while _SKYNET_MODE=OFF (autoupboa exits first), so absence proves nothing either. Do not confuse it with /root/.turn.off.auto.update.cnf, a different file with a real job. | /operating/os-lifecycle/selfupgrade-reference |
.autoinit-early-upgrade.cnf |
/root/ |
Operator-set presence marker with exactly one reader in the tree - when present BEFORE the first autoinit run, the pre-install conversion fully upgrades the EXISTING Debian system first (apt-get update with --allow-insecure-repositories, dpkg --configure -a, apt-get upgrade, then -f install), after freeing the dpkg lock by killing a running unattended-upgrade worker and its apt.systemd.daily parent - expected behaviour, not a fault. Useful on a stale vendor image whose packages would otherwise be dragged through the codename hops unupgraded. One-shot by construction - honoured only while /root/.init-to-devuan-ctrl.cnf is still absent, and skipped even then on a pass with a live GRUB rewrite pending or once /usr/bin/mc is already installed, so never describe the block as unconditional. Nothing deletes it - it simply goes inert. No variable form exists. | /self-hosting/debian-to-devuan |
.backboa.exclude |
/root/ |
Optional singular-named path list (one path per line) passed to Duplicity as --exclude-filelist to fine-tune what backboa omits beyond _AWS_EXB. The duobackboa twin reads /root/.duobackboa.exclude instead - a trailing-s plural name is read by nothing. | /operating/backups/legacy-backboa |
.backboa.include |
/root/ |
Optional singular-named path list (one path per line) passed to Duplicity as --include-filelist to fine-tune what backboa backs up beyond _AWS_EXB. The duobackboa twin reads /root/.duobackboa.include instead - a trailing-s plural name is read by nothing. | /operating/backups/legacy-backboa |
.barracuda.cnf |
/root/ |
Master host-level BOA settings store - bash-assignment _VAR settings applied system-wide to every Octopus instance unless overridden per-instance in octopus.cnf, sourced on every barracuda pass; individual settings indexed separately in the Variables catalogue. | /operating/control-files-ini/barracuda-cnf |
.debug-barracuda-installer.cnf |
/root/ |
Presence marker enabling _DEBUG_MODE tracing for the barracuda chain, and the only marker that makes the BOA.sh.txt bootstrap itself verbose - env dumps plus PROC and DEBUG lines in the Master install stage. DESTRUCTIVE side effects - it also skips the whole Drush toolchain install/update (Drush 8/10/11, the /usr/bin/drush symlinks, CiviCRM cv, Backdrop bee) on fresh installs and upgrades alike, and on upgrade passes forces the Master Ægir frontend skip (_SYSTEM_UP_ONLY=YES, exact synonym of /root/.skip-aegir-master-upgrade.cnf at both read sites). Short debugging windows only, never leave it on a production box. Verbosity persists after the marker is removed - _DEBUG_MODE=YES lands in /root/.barracuda.cnf and nothing writes NO back, so edit the cnf to restore quiet output | /developing/install-internals/staged-setup |
.debug-boa-installer.cnf |
/root/ |
Presence marker enabling _DEBUG_MODE tracing across both the barracuda and octopus install chains - env dumps plus PROC and DEBUG lines throughout the staged run. The safe one - verbosity only, it preserves the Drush toolchain and Master Ægir updates that its barracuda-named sibling skips. Three caveats - on the barracuda upgrade chain it propagates only when the command line carries an extra key token (a php-* choice, nodns or a New Relic key), so a plain barracuda up-* run ignores it and _DEBUG_MODE=YES in /root/.barracuda.cnf is the supported switch there, while fresh boa in-* installs and every octopus run honour it unconditionally; despite its name it does NOT make the BOA.sh.txt bootstrap verbose (only the barracuda-named marker does); and verbosity persists after the marker is removed because _DEBUG_MODE=YES lands in the persistent cnf files - set _DEBUG_MODE=NO there to restore quiet output. Auto-created together with the octopus twin on every dev-tree barracuda run | /developing/install-internals/staged-setup |
.debug-octopus-installer.cnf |
/root/ |
Presence marker enabling _DEBUG_MODE tracing for the octopus chain only - env dumps plus PROC and DEBUG lines in the AegirSetup A, B and C stages. Pure verbosity, no side effects anywhere, and the octopus read sites are unconditional. Verbosity persists after the marker is removed - _DEBUG_MODE=YES lands in the per-instance /root/.<user>.octopus.cnf and nothing writes NO back, so edit the cnf to restore quiet output. Auto-created together with the boa twin on every dev-tree barracuda run | /developing/install-internals/staged-setup |
.debug-purge-build-tree.cnf |
/root/ |
Debugging helper read by both upgrade wrappers - presence makes every barracuda or octopus run that takes the install lock start by deleting the reusable build tree /opt/tmp/boa together with /opt/tmp/boa.tar.gz, so that run stages the whole tree again from a freshly re-synced mirror. Operator-created only, never written or removed by BOA and not wiped by either hosted normalisation pass, so it keeps costing a full re-download on every later wrapper run until it is deleted by hand. Wrapper-only reach - boa in-<tree> (in-lts, in-dev, in-pro) and boa in-octopus execute the staged BARRACUDA.sh.txt and OCTOPUS.sh.txt directly and never see it. Intended for dev and test boxes. Converted to _DEBUG_PURGE_BUILD_TREE=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DEBUG_PURGE_BUILD_TREE=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /developing/install-internals/staged-setup |
.debug.cnf |
/root/ |
Operator-created debug marker with no writer anywhere in BOA - inside the major-OS-upgrade routine only (which runs solely when a per-hop _FROM_TO_TO variable matches the box codename) it swaps /etc/init.d/networking for the distribution's networking.dpkg-dist on a box that already carries the Ægir Master nginx includes, and enables the devpts/ptmx repair on kernels other than the legacy -beng one. On a hosted box, on the fresh-install path only, it also suppresses the Nginx log-retention widening of /etc/logrotate.d/nginx, unless /root/.default.cnf is present as well - upgrade passes run that widening unconditionally on hosted boxes and read neither file. Erased on hosted BOA boxes by the BOA.sh.txt _update_agents fleet block on every pass (clear.sh fires that roughly every five minutes whenever no BOA run holds /run/boa_run.pid), so it never latches there; unrelated to the _DEBUG_MODE variable in /root/.barracuda.cnf. | /operating/os-lifecycle/major-os-upgrade |
.debug.email.txt |
/etc/boa/ |
Diagnostic redirect for the usage and quota accounting pass - presence makes usage.sh discard every account's resolved client address and substitute a hardcoded internal BOA inbox ([email protected]) before any notice is sent or logged. The destination is fixed in the script, so this is a boolean marker and not an address knob. On a hosted box it redirects the four client notices usage.sh can send (deprecated PHP-FPM version, Pressflow migration, database usage over quota, disk usage over quota); on a self-hosted box those four return early and are never sent, so the only effect is the address written into /var/log/boa/usage/usage-latest-verbose.log and usage-latest-silent.log. Let's Encrypt client notices are unaffected. Read from /etc/boa/ only - BOA copies a legacy /root/ original across once during upgrade. Converted to _DEBUG_EMAIL=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DEBUG_EMAIL=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/security/mailing-policy |
.debug.monitor.cnf |
/etc/boa/ |
Debug marker for the scan_nginx scorer - its presence turns on a set -x shell trace plus declare -p dumps of every scoring array on startup; relocated from /root under C-003. Converted to _DEBUG_MONITOR=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DEBUG_MONITOR=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. The conversion is full-marker - the variable covers all six read sites, including the pre-source set -x trace at the top of scan_nginx.sh, so there is no half-instrumented state | /operating/abuse-guard/operations |
.debug.monitor.log.cnf |
/etc/boa/ |
Debug marker for the scan_nginx scorer - its presence forces _verbose_log on regardless of _NGINX_DOS_LOG, the way to restore debug logs when a box has _NGINX_DOS_LOG set to SILENT; relocated from /root under C-003. This marker gets no key of its own - it folds into the EXISTING _NGINX_DOS_LOG. While the marker exists, the next barracuda upgrade pass ensures _NGINX_DOS_LOG=NORMAL in /root/.barracuda.cnf - an explicit NORMAL or VERBOSE already set wins, while SILENT, empty or unrecognised is rewritten to NORMAL, and the write repeats on every pass while the file exists. The marker itself still forces verbose logging in the deployed scorer and in guest-fire.sh for one more release. Off = remove the marker AND set _NGINX_DOS_LOG=SILENT - removing the marker alone no longer reverts the level, because the cnf value persists. The fold consumes /etc/boa only - a twin that exists only in /root is not folded and instead earns a one-time advisory note on the pass. _NGINX_DOS_LOG is now seed-only across fleet DOS retunes - a set value survives, while the other _NGINX_DOS_* keys are reset | /operating/abuse-guard/operations |
.debug_daily.info |
/root/ |
Operator-only verbose gate for the four nightly drush8 wrappers in night.inc.sh - when present each wrapper echoes one timestamped line naming the account user and the exact drush8 command before running it and nothing else changes, so it only makes the nightly logs verbose - the line lands in the orchestrator log or in the per-account log depending on which process runs the wrapper - nothing in BOA writes or removes it and no hosted pass touches it - the same-named wrapper copies in xoct and xcopy carry no such gate. Converted to _DEBUG_DAILY=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DEBUG_DAILY=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /developing/monitor-abuse-internals/nightly-worker-internals |
.default.cnf |
/root/ |
Operator-created companion to /root/.debug.cnf with no effect of its own - its only reader is the co-guard that re-enables the fresh-install Nginx log-retention widening of /etc/logrotate.d/nginx which .debug.cnf alone suppresses on a hosted box, making the pair a tri-state (neither file - the widening runs; .debug.cnf alone - the widening is skipped; both - it runs again). It governs no TTL retune any more - that one was retired as inert. Erased on hosted BOA boxes alongside .debug.cnf by the BOA.sh.txt _update_agents fleet block on every pass. | /operating/os-lifecycle/major-os-upgrade |
.deny.apparmor.cnf |
/root/ |
One-way opt-out latch for the whole AppArmor family - the barracuda AppArmor step takes its install arm only when /root/.keep_apparmor_on.cnf exists and this file does not, so presence alone forces the removal arm on every install and upgrade pass, tearing AppArmor down, removing the apparmor and auditd packages and rewriting the grub drop-in to apparmor=0, with the mode markers never read. BOA creates it with a touch in that removal arm - the shipped default path - and nothing in the tree ever removes it, so a host that has already run barracuda without the master switch cannot be switched on by creating .keep_apparmor_on.cnf alone - delete this file as well, then run barracuda upgrade and reboot. | /operating/security/apparmor |
.deny.clamav.cnf |
/root/ |
Operator-created override that forces the ClamAV teardown even on a box that carries /root/.allow.clamav.cnf - all seven readers test the pair together, so this file only changes anything where the allow file exists. On its own it is redundant, because the absence of the allow file already denies. BOA never creates it - autoupboa's only write is a touch that refreshes the timestamp of a file you already made, inside the development-tree freeze branch guarded by /etc/boa/.ice.vm.cnf, and the hosted normalisation block does not touch it. Converted to _DENY_CLAMAV=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DENY_CLAMAV=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. | /operating/os-lifecycle/selfupgrade-reference |
.deny.java.cnf |
/root/ |
Operator opt-out marker - its presence skips the entire Solr and Java subsystem on an UPGRADE pass regardless of _XTRAS_LIST, so _if_install_upgrade_solr is never called. Converted to _DENY_JAVA=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DENY_JAVA=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. The xmass migration tool writes BOTH forms at cutover, touching the marker and setting _DENY_JAVA=YES in /root/.barracuda.cnf and saying so in its output (on a box with no cnf it says the variable form was not set and writes the marker only), so the published recovery is to set _DENY_JAVA=NO AND run rm -f /root/.deny.java.cnf. The deny is not permanent either - with both cleared, the next UPGRADE pass installs or upgrades Solr again. | /developing/web-search-internals/solr-installer |
.deny.jetty9.cnf |
/etc/boa/ |
Marker read by autoupboa on every plain pass, written either by an operator or by BOA's own Solr tools - solrtrim remove solr4 writes it together with _DENY_JETTY9=YES as the first step of a removal, before it stops the service or deletes anything, and an xmass server move writes the same pair on the target for every Solr version outside the move's used set. While /etc/init.d/jetty9 still exists autoupboa deregisters jetty9 with update-rc.d, moves the init script aside to /var/backups/jetty9.initd and kills jetty9 and avahi-daemon. The teardown is not permanent, but nothing in the janitor undoes it - the pass that finds the marker gone restores nothing, and it is the Solr installer that puts the service back, because that installer is gated on the separate Java deny alone and its Jetty 9 arm rewrites /etc/init.d/jetty9 and runs update-rc.d again on a later barracuda upgrade pass whenever the init script is missing. Only the copy parked in /var/backups is never restored on its own, and it is left behind as a stale duplicate. Inert while _SKYNET_MODE=OFF, because autoupboa exits before the teardown function is reached; autoupboa itself only reads the marker, never creating or erasing it, and the hosted normalisation block does not touch it. The one eraser in the tree is the same xmass target write - for a version inside the move's used set it sets _DENY_JETTY9=NO and removes both /etc/boa/.deny.jetty9.cnf and the legacy /root/.deny.jetty9.cnf. Converted to _DENY_JETTY9=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DENY_JETTY9=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. |
/operating/os-lifecycle/selfupgrade-reference |
.deny.solr7.cnf |
/etc/boa/ |
Marker read by autoupboa on every plain pass, written either by an operator or by BOA's own Solr tools - solrtrim remove solr7 writes it together with _DENY_SOLR7=YES as the first step of a removal, before it stops the service or deletes anything, and an xmass server move writes the same pair on the target for every Solr version outside the move's used set. While /etc/init.d/solr7 still exists autoupboa deregisters solr7 with update-rc.d, moves the init script aside to /var/backups/solr7.initd and kills solr7 and avahi-daemon. The teardown is not permanent, but nothing in the janitor undoes it - the pass that finds the marker gone restores nothing, and it is the Solr installer that puts the service back, because that installer is gated on the separate Java deny alone and its Solr 7 arm lays the init script down again through install_solr_service.sh, which a later barracuda upgrade pass re-runs on a Solr version bump or on a box whose /var/solr7/data is gone. Only the copy parked in /var/backups is never restored on its own, and it is left behind as a stale duplicate. Inert while _SKYNET_MODE=OFF, because autoupboa exits before the teardown function is reached; autoupboa itself only reads the marker, never creating or erasing it, and the hosted normalisation block does not touch it. The one eraser in the tree is the same xmass target write - for a version inside the move's used set it sets _DENY_SOLR7=NO and removes both /etc/boa/.deny.solr7.cnf and the legacy /root/.deny.solr7.cnf. Converted to _DENY_SOLR7=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DENY_SOLR7=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. |
/operating/os-lifecycle/selfupgrade-reference |
.deny.solr9.cnf |
/etc/boa/ |
Marker read by autoupboa on every plain pass, written either by an operator or by BOA's own Solr tools - solrtrim remove solr9 writes it together with _DENY_SOLR9=YES as the first step of a removal, before it stops the service or deletes anything, and an xmass server move writes the same pair on the target for every Solr version outside the move's used set. While /etc/init.d/solr9 still exists autoupboa deregisters solr9 with update-rc.d, moves the init script aside to /var/backups/solr9.initd and kills solr9 and avahi-daemon. The teardown is not permanent, but nothing in the janitor undoes it - the pass that finds the marker gone restores nothing, and it is the Solr installer that puts the service back, because that installer is gated on the separate Java deny alone and its Solr 9 arm lays the init script down again through install_solr_service.sh, which a later barracuda upgrade pass re-runs on a Solr version bump or on a box whose /var/solr9/data is gone - though Solr 9 is only re-entered at all while SR9 sits in _XTRAS_LIST or the box is BOA-hosted, because its remaining trigger is the absence of the Solr 9 log. Only the copy parked in /var/backups is never restored on its own, and it is left behind as a stale duplicate. Inert while _SKYNET_MODE=OFF, because autoupboa exits before the teardown function is reached; autoupboa itself only reads the marker, never creating or erasing it, and the hosted normalisation block does not touch it. The one eraser in the tree is the same xmass target write - for a version inside the move's used set it sets _DENY_SOLR9=NO and removes both /etc/boa/.deny.solr9.cnf and the legacy /root/.deny.solr9.cnf. Converted to _DENY_SOLR9=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DENY_SOLR9=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. |
/operating/os-lifecycle/selfupgrade-reference |
.dev.server.cnf |
/root/ |
Marks a box as a dev-server - autoupboa never writes auto-upgrade cron lines (barracuda up / octopus up in /etc/crontab) on boxes carrying this marker. | /developing/release-model/serial-pipeline |
.disable.apparmor.cnf |
/root/ |
Presence under /root/ keeps AppArmor torn down - identical to the shipped no-control-file default. Profiles go to complain mode, then apparmor is stopped, removed from boot, and aa-teardown runs. | /operating/security/apparmor |
.disable.auditd.logs.cnf |
/root/ |
Presence under /root/ sets write_logs = no in /etc/audit/auditd.conf during the AppArmor profile sync. Absence is the active state, not a passive one - the else arm re-asserts write_logs = yes on every barracuda pass, so deleting the file switches auditd logging back on and a hand-edit of auditd.conf is reverted the same way. Only read when /etc/audit/auditd.conf exists and only inside the profile sync, so it does nothing on a host where the missing /root/.keep_apparmor_on.cnf master switch leaves the AppArmor family off. Operator-created - BOA never writes or removes it. Converted to _DISABLE_AUDITD_LOGS=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DISABLE_AUDITD_LOGS=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/security/apparmor |
.disable_mysql_cleanup.cnf |
/etc/boa/ |
Kill-switch - create this file to stop the pre-dump inline TRUNCATE of giant transient tables (queue, batch, watchdog, accesslog) whose .ibd has grown into the gigabyte range, leaving them untouched during the nightly run. Its scope is deliberately asymmetric and is preserved as-is - presence, or the variable set to YES, kills the whole hourly mysql_cleanup.sh run, which exits at the very top of the script, before its lock and before its start banner, while inside the nightly mysql_backup.sh pass it suppresses only the four giant-table truncation gates and nothing else. Converted to _DISABLE_MYSQL_CLEANUP=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DISABLE_MYSQL_CLEANUP=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. | /operating/database/dumps-mydumper |
.dont.touch.permissions.cnf |
/etc/boa/ |
Box-wide kill file for the nightly codebase lock - presence forces the worker's per-platform decision to YES for every registered platform, so night/20-sites.sh skips the ownership and permission pass entirely. Its test is evaluated last, after both the platform INI opt-out and the Drupal 7 SA-CORE-2014-005 arm, and overwrites them, so with the file in place an unpatched D7 platform is neither re-permissioned nor patched. It does not gate the separate sweep over the shared /data/all and /data/conf trees, which takes _PERMISSIONS_FIX as its only operator gate and stamps itself done once per BOA serial and release rather than running nightly, and unlike a hand-set _PERMISSIONS_FIX=NO it survives a barracuda upgrade. Read from /etc/boa/ only - BOA copies a legacy /root/ original across once during upgrade. Converted to _SKIP_PERMISSIONS_PASS=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _SKIP_PERMISSIONS_PASS=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. The variable does not gate the shared /data/all and /data/conf sweep either - that limitation is unchanged, and _PERMISSIONS_FIX remains its only operator gate. | /operating/security/codebase-lock |
.dont.upgrade.octopus.on.install.cnf |
/root/ |
Box-wide install-window guard on a BOA target - while it exists, an in-octopus run or a full boa in-<tree> install skips both the hosting-dispatch plus four hosting-tasks --force rounds that finish the installation and the enforced post-install octopus up-<tree> upgrade that completes the Let's Encrypt setup. aegir2boa-stage2 create touches it on the target over ssh immediately before boa in-octopus and removes it again once the quiescence wait returns, or straight away if in-octopus finished without producing /data/disk/<oN>; xoct only probes it remotely and skips its own install-settle wait when it finds it, never writing or removing it. Nothing else in BOA creates or erases the marker and no hosted normalisation pass touches it, so an interrupted create leaves it on the target, where it silently suppresses the same steps for the next Octopus install until it is removed by hand. | /operating/migration-cloning/aegir-to-boa |
.dont.use.fancy.bash.login.cnf |
/root/ |
Operator-created marker turning off the decorative root login banner. Presence makes a barracuda pass rewrite the fancynow and screenfetch lines in /root/.bashrc to /bin/true (left in place, neutered) and purge the toilet, figlet and screenfetch packages - but that purge arm also requires /usr/bin/screenfetch to exist, and without it the else arm installs toilet and figlet instead, so this is not a cosmetic-only marker. The separate .bashrc arm taken when the marker is absent also purges the distro screenfetch package whenever /usr/bin/screenfetch is present, before symlinking BOA's own copy there. Persistent; no writer anywhere in the tree and no hosted normalisation pass erases it. Converted to _DONT_USE_FANCY_BASH_LOGIN=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _DONT_USE_FANCY_BASH_LOGIN=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/os-lifecycle/host-os-baseline |
.enable.newrelic.sysmond.cnf |
/etc/boa/ |
Legacy opt-in flag for the New Relic server monitor (nrsysmond), converted to the _ENABLE_NEWRELIC_SYSMOND variable in /root/.barracuda.cnf — the variable is the supported switch and the flag stays honoured for one release. When enabled and nrsysmond is down it is restarted; when disabled and running it is stopped, both by the ~5s guard and by every barracuda upgrade pass. To switch it off, set _ENABLE_NEWRELIC_SYSMOND=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/monitoring/process-guards |
.enforce.apparmor.cnf |
/root/ |
Presence under /root/ loads the AppArmor profile set in enforce mode via aa-enforce - violations blocked and logged. Needs a reboot with the grub apparmor=1 flag. Operators set this file to switch confinement on. | /operating/security/apparmor |
.extended.firewall.exceptions.cnf |
/root/ |
Operator marker that extends guest-water.sh csf.allow provider-range refresh beyond the defaults (Cloudflare, Googlebot, Google's special-case crawlers, Bingbot, Pingdom) to also whitelist Imperva, Sucuri, Auth0 and Site24x7 ranges. Deliberately NOT converted to a /root/.barracuda.cnf variable - the file stays the control. On hosted boxes BOA computes and auto-creates it on the roughly five-minute self-update tick and removes it nowhere, so a variable would be meaningless there and converting would move firewall-exemption behaviour onto a new mechanism for no gain. Its dependent marker /etc/boa/.ignore.site24x7.firewall.cnf - which only ever runs behind this gate, adding the same Site24x7 ranges to csf.ignore as well as csf.allow - stays a file for the same reason. The split homes are correct and not a typo, this gate lives in /root while that one lives in /etc/boa. | /operating/abuse-guard/ban-pipeline |
.fast.cron.cnf |
/root/ |
Forces the Fast queue cadence - runner.sh loops the per-Octopus action ten times with 5 s sleeps, unless the Slow arm claimed the pass first (Slow wins while .slow.cron.cnf exists and .force.queue.runner.cnf does not). It does not set the concurrent-runner ceiling - that is 1 when .slow.cron.cnf exists and 8 when it does not, keyed on that marker alone. The only writer in the tree is the _update_agents normalisation pass in BOA.sh.txt, which runs on omega8.cc-hosted boxes only (roughly every five minutes via clear.sh) and re-creates the file for every instance-count and plan tier except boxes above 50 instances, where it removes it and writes .slow.cron.cnf instead - on a self-hosted box nothing writes it and it is a pure operator knob. | /operating/architecture/task-queue |
.force.duplicity.reinstall.cnf |
/root/ |
Operator-created marker forcing the Duplicity dependency installers to rebuild even when the installed version already matches the pinned one - without it a version match short-circuits the Duplicity reinstall (the shared installer still continues with the remaining dependencies; backboa/duobackboa skip their whole install block), so a matching-but-broken Duplicity (the classic case is a Devuan dist-upgrade wrecking its pipx venv while the version string still reports fine) has no other route to a rebuild. All four backup tools honour it. With the marker present the pipx install runs with --force. No writer or eraser anywhere in the tree; no variable form exists. | /operating/backups/cli-reference |
.force.queue.runner.cnf |
/root/ |
Presence forces the monitor box-class to NORMAL, overriding the slow-marker and the RAM-at-or-below-4096-MB heuristic so an operator can keep full watchdog cadence on a small box. Only this marker forces NORMAL. | /operating/monitoring/cadence-and-throttle |
.force.sites.verify.cnf |
/root/ |
Operator trigger with two unrelated effects - owl.sh sets _FORCE_SITES_VERIFY=YES from it, which makes the per-site night worker queue a forced Ægir verify task for every site whose permissions fix runs (so _PERMISSIONS_FIX=YES and no permissions opt-out are needed too), and the nightly _load_control overrides _CPU_TASK_RATIO from 3.1 to 4.1 while the file exists, so a ratio pinned in /root/.barracuda.cnf is ignored - pin the nightly load ceiling with _CPU_TASK_RATIO instead - no BOA code creates it, and the five-minute autoupboa pass deletes it on every hosted box. | /operating/monitoring/nightly-owl |
.full.csf.cleanup.cnf |
/etc/boa/ |
Operator marker whose presence makes guest-water.sh strip every do-not-delete line from csf.deny via sed - the explicit override to wipe even the persistent 24-hit Brute force Web Server bans on the next pass. | /operating/abuse-guard/ban-pipeline |
.giant_traffic.cnf |
/root/ |
Operator marker with two live effects, both negated tests, so presence is the off switch and absence the working default - it suppresses the Speed-Booster purge inside the daily 03:01 graceful.sh maintenance pass (the nginx cache-levels sed, the two nginx reloads and the sweep of /var/lib/nginx/speed), and it suppresses the segfault_alert.pl spawn in the php.sh watchdog, the only thing that mails PHP-FPM and nginx segfault reports. It does not switch off the rest of the graceful.sh pass - that is .skip_cleanup.cnf. On hosted boxes BOA deletes it on every five-minute self-update tick, so it cannot be made to stick there; self-hosted boxes keep it. | /operating/monitoring/auto-healing |
.goaccess.all.cnf |
/etc/boa/ |
Persistent nightly toggle that adds one aggregate GoAccess report per account - it acts only when _ENABLE_GOACCESS=YES in /root/.barracuda.cnf, in which case the per-account night worker also builds the pseudo-site ALL report beside the per-site reports vhosts opt into - that ALL run is a box-level aggregate of the merged nginx access logs rather than the account's own traffic, and still needs a qualifying account plan and weblogx installed - nothing removes the marker, it is not one-shot, and a legacy /root copy is carried to /etc/boa once on self-update. Converted to _GOACCESS_ALL=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _GOACCESS_ALL=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/monitoring/nightly-owl |
.high_traffic.cnf |
/root/ |
Operator marker with exactly one live effect today - a negated test in the php.sh watchdog that suppresses the segfault_alert.pl spawn, the same arm .giant_traffic.cnf shares, so no PHP-FPM or nginx segfault report is mailed from that box. The daily cache-server restart, the locked/fpmcheck skip, buffered nginx logging and the hourly FPM reload that older changelog entries attach to this name all have no reader left in the tree. It doubles as a create-once guard on hosted boxes - when absent, BOA creates both it and /root/.no.swap.clear.cnf with an instance count as content that nothing ever reads back, then never re-fires and never removes either, so on a hosted box segfault alerting is off permanently and graceful.sh permanently skips its swap reset. | /operating/monitoring/auto-healing |
.home.no.wildcard.chmod.cnf |
/etc/boa/ |
Presence disables the wildcard chmod 700 /home/* that manage_ltd_users.sh otherwise runs late in every pass - the test is negated, so absence is the active state and every entry directly under /home is reset to owner-only every three minutes. Only that one chmod is suppressed; the same pass still re-asserts modes on /var/log/lsh, on the /var/aegir/.drush alias files and on the server_master config tree. Read from /etc/boa/ only - BOA copies a legacy /root/ original across once during upgrade. Converted to _HOME_NO_WILDCARD_CHMOD=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _HOME_NO_WILDCARD_CHMOD=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. The read site is an AND-of-negations, so the wildcard chmod runs only when neither the file nor the key says otherwise. | /operating/security/lshell-ltd-users |
.hr.monitor.cnf |
/root/ |
Vestigial marker that no BOA code reads - its only consumer was the retired Perl scanner scan_nginx.pl, where the read was already a no-op, so creating or deleting this file changes nothing today. On hosted boxes the tier ladder in BOA.sh.txt still writes it above 50 Octopus instances and removes it in the other tier arms, which is bookkeeping with no effect. Scheduled for retirement - the real per-IP aggressiveness control is _NGINX_DOS_MODE in /root/.barracuda.cnf, default 2, honoured by scan_nginx.sh. | /operating/security/security-model |
.ice.vm.cnf |
/etc/boa/ |
Operator-created development-tree freeze marker - on a box whose deployed autoupboa carries the dev delivery-tree stamp it truncates six /var/xdrago scripts (move_sql.sh, proc_num_ctrl.pl, runner.sh, monitor/check/nginx.sh, monitor/check/mysql.sh and mysql_backup.sh) to a blank line, deletes the aegir crontab, kills pure-ftpd and newrelic-daemon, and stops nginx, PHP-FPM, MySQL, Valkey and Redis wherever their run files exist. It re-runs on every pass while present and has no reversing arm - removing it restarts no daemon and restores neither the crontab nor the blanked scripts, so recovery is entirely manual. On a pro or lts box the branch never runs and the whole teardown function is skipped while _SKYNET_MODE=OFF; BOA never creates or erases the marker, and the hosted normalisation block does not touch it. | /operating/os-lifecycle/selfupgrade-reference |
.ignore.ifnames.cnf |
/root/ |
Operator opt-out from the GRUB kernel command line rewrite, created by hand - no BOA tool ever writes it. Presence makes autoinit's _ifnames_grub return before touching /etc/default/grub, and it is the first test in the boa, barracuda and cluster copies of _ifnames_grub_check_sync, so an installed host skips the same check on every boa in-* and barracuda up-* run. It is one half of a deliberate double confirmation - a live rewrite needs both a classic, predictable or auto .ninc.selected marker AND the absence of this file, and autoinit additionally short-circuits on its own guard-once stamp /root/.ninc.grub.updated.cnf. Not durable on NAT or cloud boxes - on a pass where no .ninc.selected.classic.cnf exists yet and every non-loopback IPv4 address is private, autoinit clears the immutable flag on this file and deletes it so it can force classic eth0 naming. | /self-hosting/debian-to-devuan |
.ignore.site24x7.firewall.cnf |
/etc/boa/ |
Migrated CSF marker, touch to enable - presence makes guest-water.sh mirror the fetched Site24x7 probe addresses into /etc/csf/csf.ignore as well as /etc/csf/csf.allow, so the CSF login-failure daemon stops tracking them; absent (the default) the probes are allowed through the firewall but stay tracked. Both Site24x7 arms honour it (the DNS-resolved probe list and the static extra list), and both arms run only when /root/.extended.firewall.exceptions.cnf exists - a file BOA auto-creates on every hosted box. The live readers test /etc/boa only. Deliberately not converted to a /root/.barracuda.cnf variable - the file stays the control, because this marker is only meaningful behind the /root/.extended.firewall.exceptions.cnf gate and follows that gate; note the pair's split homes, with the gate in /root and this marker in /etc/boa. | /operating/control-files-ini/overview |
.include-php-latest.cnf |
/root/ |
Operator-created marker that keeps PHP 8.4 in the version set the multi-install cleanup recomputes, so 8.4 survives even when no site declares it - the name says latest but the version added is 8.4 specifically, and BOA-hosted boxes get it added with or without the file. It only bites inside the _AUTO_PHP_CLEANUP prune, which needs an UPGRADE pass with /root/.allow-php-multi-install-cleanup.cnf present (what barracuda php-idle disable writes), _PHP_SINGLE_INSTALL left empty, /data/u and a healthy Ægir Master alias in place, and a host built against the modern OpenSSL series. Any /root/.run-to-<codename>.cnf marker set by an automated OS hop pins the set to versions in use and disarms this marker; nothing in BOA creates or removes the file. Converted to _INCLUDE_PHP_LATEST=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _INCLUDE_PHP_LATEST=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/os-lifecycle/manual-boa-upgrade |
.install.legacy.openssl.cnf |
/root/ |
BOA-managed breadcrumb marking that the legacy /usr/local/ssl build (the EOL OpenSSL 1.1.x series) is needed - touched on a fresh install or whenever /usr/local/ssl/bin/openssl is missing, removed automatically once that binary exists. While present it blocks the auto-opt-in that would otherwise create .install.modern.openssl.cnf, so it doubles as the operator's hold-on-legacy lever. No variable form exists. | /operating/os-lifecycle/host-os-baseline |
.install.modern.openssl.cnf |
/root/ |
BOA-managed state marker (kept chattr +i) selecting the modern OpenSSL 3 series for BOA's own SSL toolchain - while present, the barracuda pass delivers OpenSSL 3.x into /usr/local/ssl3 (prebuilt package where available, source build otherwise), every _SSL_BINARY consumer prefers that binary over the EOL 1.1.x build in /usr/local/ssl, and the Nginx build check forces a rebuild until Nginx is linked against the selected series. Honoured only on buster/bullseye/bookworm/beowulf/chimaera/daedalus/excalibur - on stretch and older codenames every pass force-deletes it and stays on the EOL series. BOA touches it itself - on a fresh install when the legacy marker is absent, on an upgrade pass once no legacy PHP interpreter (/opt/php56 through /opt/php73) remains, and unconditionally once both series' binaries exist - so a current box opts in on its own. The operator lever is for the exceptions - pre-create it (touch) to force the 3.x build on a box still holding legacy PHP, or chattr -i and remove it together with touching the legacy marker to hold a box on the EOL series. The rebuild itself runs when _ALLOW_HEAVY_REBUILDS=YES or the ssl3 binary is missing. No variable form exists - the pair is install-state machinery, not a settings toggle. | /operating/os-lifecycle/host-os-baseline |
.install.myquick.src.info |
/root/ |
RETIRED - building mydumper from source is an internal fallback for OS codenames BOA has no packaged build for, not an operator switch. This marker (and the briefly-lived _INSTALL_MYQUICK_SRC variable it was converted to) used to force _MYQUICK_SRC_INSTALL_REQUIRED=YES on any host; because the source path always builds _MYQUICK_VRN_ONE (0.19.3-3), forcing it on a codename that has a package held mydumper a version line back while myloader could still come from the package, and database imports then failed on the command-line option the two binaries no longer agreed about. Both forms are now ignored - a stale marker file is inert and safe to leave in place, and the cnf key is deleted from /root/.barracuda.cnf on the next barracuda run so it cannot be flipped back. The codename arm is unchanged and still selects the source build on its own for any _SQL_OS_CODE that is not trixie, bookworm, bullseye or buster. | /operating/database/dumps-mydumper |
.instant.busy.mysql.action.cnf |
/etc/boa/ |
Presence adds a second saturation detector to the database watchdog - besides the syslog scan, _sql_busy_detection also asks the server directly on every pass with mysql -u root -e status and treats a Too many connections reply as the trigger. The live arm has its own co-guards, a running mysqld and a non-empty /root/.my.pass.txt, and since 2026-08 it also stands down while a Provision task is in flight, as the syslog arm already did. It does not restart: that reply proves the server is answering, and _sql_restart returns without acting on a server that answers, so the arm used to do nothing at all. It now relieves the saturation instead - flush-hosts and the long-query sweep - which matters because the later unconditional sweep is suppressed while the load markers exist, exactly the regime that produces the saturation. Operator-created and absent by default - BOA never makes one, though a one-time shim copies a legacy /root/ copy into /etc/boa/ once per box and leaves the /root/ original behind inert. Converted to _INSTANT_BUSY_MYSQL_ACTION=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _INSTANT_BUSY_MYSQL_ACTION=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/database/percona-setup-tuning |
.instant.csf.block.cnf |
/etc/boa/ |
Legacy presence marker, converted to the _INSTANT_CSF_BLOCK variable in /root/.barracuda.cnf — the variable is the supported switch and the flag stays honoured for one release. When enabled AND the csf binary is installed, a blocked offender also receives an immediate csf -td 900 temporary ban on ports 80 and 443 plus a synproxy re-assert when configured, shaving one hop off the web.log-to-guest-fire ban pipeline. Without csf the toggle has no effect. To switch it off, set _INSTANT_CSF_BLOCK=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/abuse-guard/scan-nginx-scoring |
.keep_apparmor_on.cnf |
/root/ |
Master switch for the whole AppArmor family - barracuda enables AppArmor only when this file exists and /root/.deny.apparmor.cnf does not, otherwise it takes the removal arm, which removes the apparmor and auditd packages, rewrites the grub drop-in to apparmor=0, creates /root/.deny.apparmor.cnf and never syncs the shipped profiles, so the .activate.apparmor.cnf and .enforce.apparmor.cnf mode markers are not even read. Nothing in BOA ever removes /root/.deny.apparmor.cnf, so enabling on a host that has already run barracuda without the switch also requires deleting that file. autoupboa and autoinit read the same marker and tear a live AppArmor down when it is absent, autoinit before BOA is installed at all. Operator-created - BOA never writes or removes it. | /operating/security/apparmor |
.local.IP.csf.listed |
/root/ |
Once-per-box done flag for the CSF whitelisting of the box's own addresses - while it is absent, each guest-water.sh pass rewrites csf.ignore and csf.allow for every address in /root/.local.IP.list (backing csf.allow up under /var/backups/csf/water first), and the pass touches the flag at the end so later passes skip that rewrite. It does not narrow the rest of the exemption - csf -ar, csf -dr and csf -tr still clear every listed address from the ban tables on every pass. Nothing in BOA removes it, and the /root/.local.IP.list* family wipe does not match its name, so it survives a regeneration of the list; delete it by hand to have the csf.ignore and csf.allow lines written again. | /operating/abuse-guard/ban-pipeline |
.local.IP.list |
/root/ |
BOA-generated list of the box's own IP addresses, not an operator-maintained whitelist - when the file is missing guest-water.sh deletes the whole /root/.local.IP.list* family and rebuilds it from hostname -I (the master and satellite Nginx config passes carry the same regeneration), and when it is present each pass appends any hostname -I address not yet listed. Every listed address is exempt across the pipeline - guest-water.sh zeroes its archive hit count so it can never be escalated, clears it from the CSF ban tables with csf -ar, csf -dr and csf -tr on every pass, and once per box (guarded by the /root/.local.IP.csf.listed done-flag) writes it into csf.ignore and csf.allow, while guest-fire.sh never temp-bans it, scan_nginx never scores it and batch_guard counts it as one of the box's own addresses. Operator-added lines are never individually removed, but they last only as long as the file itself - any pass that finds it missing wipes and regenerates the family - so a durable exemption belongs in csf.allow. | /operating/abuse-guard/ban-pipeline |
.local.IP.list.allow |
/root/ |
Generated Nginx allow fragment derived from .local.IP.list - a barracuda or octopus Nginx config pass deletes and re-emits it as one allow line per listed address plus allow 127.0.0.1 and a closing deny all, then splices it into the Ægir vhost templates (Inc/vhost_include.tpl.php, subdir.tpl.php and nginx_vhost_common.conf) in place of their deny all line, so a multi-IP host can still reach its own cron-protected locations. It is rebuilt only on a pass where the box's resolved public IP is already present in .local.IP.list. Never hand-edit it - the next config pass rewrites it from scratch, and the /root/.local.IP.list* family wipe deletes it whenever .local.IP.list goes missing. | /operating/abuse-guard/ban-pipeline |
.look.like.jenkins.cnf |
/etc/boa/ |
Explicit CI marker whose presence forces the monitor box-class classifier to resolve to CI, the quietest cadence - minute.sh runs a single pass and second.sh runs its heavy fan-out once per minute. Highest precedence, so a CI box stays CI even when also small. Converted to _FORCE_CI_BOX=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _FORCE_CI_BOX=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. The key is _FORCE_CI_BOX rather than a transliteration of the marker name because _LOOK_LIKE_JENKINS is already occupied by the internal java-symlink variables. The CI classification reaches further than monitor cadence - it also governs the runner.sh queue policy, the usage.sh accounting bail-out and the Jenkins-era java symlink set - while the separate detection of a real Jenkins install (an executable /etc/init.d/jenkins together with /var/lib/jenkins) is unaffected by either form and never writes the marker. | /operating/monitoring/cadence-and-throttle |
.manual-autoinit-reboot.cnf |
/root/ |
Operator brake on the unattended reboots of the pre-install Debian to Devuan conversion - create it before starting, and note that no BOA tool creates or removes it. At every reboot point in autoinit and automini the tool runs service cron stop, waits 90 seconds and exits 0 instead of running shutdown -r now, so the box stays up and restarting it is left to the operator. Stopping cron also parks the minutely /etc/crontab autoinit line that resumes the conversion after a reboot, so the next stage begins only once the box is restarted by hand. It does not remove the need for those reboots - the conversion cannot complete without them. | /self-hosting/debian-to-devuan |
.migration.proxy.ips.cnf |
/root/ |
Persists the migration-proxy IPs that migration_proxy_trust.sh whitelists in CSF (csf.allow ports 80 and 443 plus csf.ignore) so the water.sh ticks re-assert L4 proxy trust across reloads until the migration ends. | /operating/security/csf-firewall |
.migration_proxy_trust.cnf |
/data/conf/ |
Holds the migration-proxy IP(s) that migration_proxy_realip.sh turns into nginx set_real_ip_from lines so the new host recovers the real client behind the proxy hop - CIDR validators reject /0 and an empty or all-invalid file triggers teardown of the L7 trust include. | /operating/security/csf-firewall |
.mode.selected.<mode>.cnf |
/root/ |
Records which mode the pre-install conversion runs in - autoinit always resolves to minimal, so on its first run it creates only .mode.selected.minimal.cnf and locks it with chattr +i, and removing that file needs chattr -i first. Presence of .mode.selected.full.cnf is what later readers test, and autoinit can never create it - an operator adds it by hand, alongside the immutable minimal marker, with no chattr -i needed. With it in place autoinit and the four automated codename drivers autobeowulf, autochimaera, autodaedalus and autoexcalibur call _if_remove_cloud_utils, which removes the cloud-utils, cloud-init and cloud-image-utils packages and moves /etc/cloud into /var/backups. The minimal marker has no reader anywhere and only records the choice. | /self-hosting/debian-to-devuan |
.my.batch_innodb.cnf |
/root/ |
Weekly forced repair-and-convert marker - when present it runs on Saturday inside the 01:15 mysql_backup.sh pass to repair databases, truncate the cache tables, and convert tables to InnoDB - a persistent toggle, not a one-shot, nothing in mysql_backup.sh removes it - on BOA-hosted boxes BOA deletes it on every _update_agents pass of its own self-update, alongside the long-retired bare-name variant .batch_innodb.cnf, so the Saturday pass never fires there and the marker cannot be made to stick by hand. | /operating/database/dumps-mydumper |
.my.cache.exceptions.cnf |
/root/ |
Value-bearing operator file protecting extra cache tables from the automatic TRUNCATE - its contents (exact table names, whitespace- or newline-separated) are appended to the built-in exception list cache_bootstrap cache_discovery cache_config, and every cache* table whose name is on the combined list is skipped by _truncate_cache_tables in all three consumers - the hourly mysql_cleanup.sh pass, the weekly/monthly forced repair passes inside the 01:15 mysql_backup.sh run, and mysql_cluster_backup.sh. Names must match exactly - these are not patterns, the comparison is string equality per table. No writer anywhere in the tree and no hosted pass erases it; no variable form exists. | /operating/database/dumps-mydumper |
.my.cluster_root_pwd.txt |
/root/ |
Cluster marker - its presence (together with .my.cluster_write_node.txt) is what lets the shipped-but-dormant mysql_cluster_backup.sh actually run - without both files it self-exits immediately on a normal single-server host. | /operating/database/dumps-mydumper |
.my.cluster_write_node.txt |
/root/ |
Cluster marker - its presence (together with .my.cluster_root_pwd.txt) is what lets the shipped-but-dormant mysql_cluster_backup.sh actually run - without both files it self-exits immediately on a normal single-server host. | /operating/database/dumps-mydumper |
.my.optimize.cnf |
/root/ |
Monthly forced repair-and-optimise marker - when present it repairs each database, truncates its cache tables and optimises it on the Sunday whose day of the month falls from 24 to 30, inside the 01:15 mysql_backup.sh pass and only in full mode (an explicit mysql_backup.sh basic run skips it) - a persistent toggle, not a one-shot - it is also the gate .my.restart_after_optimize.cnf needs before that marker can do anything - on BOA-hosted boxes autoupboa deletes this file on every pass, roughly every five minutes, so the monthly optimise never fires there and the marker cannot be made to stick by hand. | /operating/database/dumps-mydumper |
.my.restart_after_optimize.cnf |
/root/ |
Twin of .my.optimize.cnf - when both files exist, mysql_backup.sh follows the monthly optimise with a full graceful MySQLD restart via /var/xdrago/move_sql.sh, run after every database has been dumped and before the compress and retention phases - it is inert on its own because the restart block repeats all of .my.optimize.cnf's conditions (Sunday, day of the month from 24 to 30, full mode) and adds one more of its own, requiring /run/boa_run.pid to be absent so no restart is issued while a BOA upgrade run is in progress - operator-only and persistent, BOA never creates or removes it, but on BOA-hosted boxes autoupboa deletes its gate .my.optimize.cnf on every pass, which leaves this marker permanently inert there. Converted to _MY_RESTART_AFTER_OPTIMIZE=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _MY_RESTART_AFTER_OPTIMIZE=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/database/dumps-mydumper |
.mysql.force.legacy.backup.cnf |
/root/ |
When present - forces nightly dumps into legacy single-file mysqldump output gzipped to .sql.gz per database instead of the faster mydumper split-file default - kept only for old tooling that expects a .sql file. | /operating/database/dumps-mydumper |
.mysql.no.new.password.cnf |
/root/ |
Presence suppresses the forced MySQL root password rotation - sql.sh.inc calls _forced_mysql_root_password_update only when this file is absent and either /root/.mysql.yes.new.password.cnf or /root/.my.cluster_root_pwd.txt exists; the file is empty and no password value passes through it. boa in-dev, in-pro and in-lts create it together with the valkey and redis twins so a long install is not interrupted by a rotation, and autoupboa deletes all three once per box after the install has settled, stamping the immutable /var/log/boa/reset_no_new_password.pid so that cleanup never runs again. On a host with _DB_SERIES=8.4, helper.sh.inc _turn_on_password_update clears any immutable flag and deletes this file on every barracuda run, from _os_detection early in the run, so a hand-made opt-out there never takes effect - the next barracuda run deletes it before the rotation gate is reached, and rotates in that same run. | /operating/database/percona-setup-tuning |
.mysql.yes.new.password.cnf |
/root/ |
Presence opts a host into the forced MySQL root password rotation - it is the OR term sql.sh.inc tests, alongside /root/.my.cluster_root_pwd.txt, once /root/.mysql.no.new.password.cnf is absent; the file is empty and carries no password value. It is a genuine operator opt-in only on 5.7 and 8.0 - on a host with _DB_SERIES=8.4 helper.sh.inc _turn_on_password_update re-creates it on every barracuda run and locks it with chattr +i, making it BOA-computed state there. Nothing in BOA ever removes it, and the immutable flag means deleting it by hand needs a chattr -i first. | /operating/database/percona-setup-tuning |
.mysqladmin.monitor.cnf |
/etc/boa/ |
Presence sets the monitor's internal _SQLMONITOR=YES, which appends a full mysqladmin -u root proc -v process list to /var/log/boa/mysqladmin.monitor.log on every pass and, on the first pass after the flip, turns slow_query_log on with long_query_time 5 writing to /var/log/mysql/sql-slow-query.log. Absence is the active state, not a no-op - the else arm turns slow_query_log off on the running server and deletes both that monitor log and /var/log/mysql/sql-slow-query.log, including slow-query logging an operator enabled by hand; each arm acts once per transition, stamped by /var/log/boa/.debug_slow_query.pid while the marker is present and /var/log/boa/.nodebug_slow_query.pid while it is absent. The monitor sources /root/.barracuda.cnf before it tests the marker, so a stray _SQLMONITOR=YES line there switches the same behaviour on; operator-created only, though a one-time shim copies a legacy /root/ copy into /etc/boa/ once per box. Converted to _MYSQLADMIN_MONITOR=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _MYSQLADMIN_MONITOR=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/database/percona-setup-tuning |
.net_gateway.cnf |
/root/ |
Single-line IPv4 gateway hint read by vmnetfix - BOA-managed state in the normal case (every vmnetfix run auto-saves the live default gateway into it, even under --dry-run), operator-seeded in one specific case - a routed IP block whose real gateway sits OUTSIDE the interface subnet (a routed /28 is the classic shape), where no auto-detection can find it and the last-resort base+1 guess would yield the guest's own address. Seed it with exactly one bare IPv4 address before a conversion on such a block, so networking survives the transient route loss across the init-system and interface-rename reboots. A live default route always beats the hint, so editing it on a healthy box changes nothing and the next run overwrites the edit - it only takes effect when the live route is absent or wrong. Written mode 0600; content is character-filtered on read with no octet-range check, so keep it to the one address and nothing else. No variable form exists. | /self-hosting/debian-to-devuan |
.ninc.grub.updated.cnf |
/root/ |
Guard-once stamp for the autoinit GRUB kernel command line rewrite - _ifnames_grub returns before touching /etc/default/grub while it exists, the same early exit /root/.ignore.ifnames.cnf takes, so the rewrite happens at most once per box. autoinit touches it on the LIVE arm only, both after an actual rewrite of GRUB_CMDLINE_LINUX and when it finds that line already in the wanted state, and never on the DEMO preview arm. It is not chattr locked and nothing in BOA ever removes it, so deleting it by hand is what re-arms the rewrite. Only autoinit reads it - the boa, barracuda and cluster copies of _ifnames_grub_check_sync do not, so an installed host is gated by .ignore.ifnames.cnf and the .ninc.selected markers alone. | /self-hosting/debian-to-devuan |
.ninc.selected.<convention>.cnf |
/root/ |
Chattr locked enum choosing the network interface naming convention autoinit writes into the GRUB kernel command line - one of .ninc.selected.vanilla.cnf, .ninc.selected.classic.cnf, .ninc.selected.predictable.cnf or .ninc.selected.auto.cnf. autoinit reads them in the fixed precedence classic, predictable, vanilla, auto, then creates the marker for the resolved choice with chattr +i, defaulting to vanilla, which leaves /etc/default/grub untouched. classic writes net.ifnames=0 and biosdevname=0, predictable writes net.ifnames=1 and biosdevname=1, auto adds no naming flag at all, and every live rewrite in autoinit also adds memhp_default_state=online, copies the file to /etc/default/grub.bak, runs update-grub, stamps the guard-once /root/.ninc.grub.updated.cnf and then reboots into the next conversion stage. A live rewrite additionally requires that /root/.ignore.ifnames.cnf does not exist; when that file or the guard-once stamp /root/.ninc.grub.updated.cnf is present, or the resolved convention is vanilla or none, the check simply returns and logs nothing. On a pass where the classic marker does not exist yet and every non-loopback IPv4 address is private, autoinit creates and locks it itself and deletes /root/.ignore.ifnames.cnf. The boa, barracuda and cluster copies of the check honour the same markers on an installed host but pin whichever naming ip a already reports rather than the convention the marker names, and boa and barracuda also run update-grub. | /self-hosting/debian-to-devuan |
.no.swap.clear.cnf |
/root/ |
Negated test in the daily 03:01 graceful.sh maintenance pass - presence skips the swap reset, so neither swapoff -a nor swapon -a runs, while the RAM optimisation beside it still does. The reset it suppresses runs only where /dev/disk exists, and even without this marker swapon -a is held back while duplicity is running, so a box mid-backup can legitimately be left with swap off until the next night. On hosted boxes BOA creates it once, together with /root/.high_traffic.cnf and only while that file is absent, writing an instance count that nothing reads back, and never removes either - so the nightly swap reset is off there permanently. Self-hosted boxes have no writer and it stays a pure operator knob. | /operating/monitoring/auto-healing |
.no.sysctl.update.cnf |
/root/ |
Skips the /etc/sysctl.conf and system-limits refresh that BOA otherwise applies on every barracuda upgrade. Converted to _NO_SYSCTL_UPDATE=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _NO_SYSCTL_UPDATE=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. A legacy cluster tool keeps reading the file only, so on a box still running that toolchain a converted opt-out is invisible to it. | /operating/os-lifecycle/host-os-baseline |
.owl.sh.off |
/var/xdrago/ |
Toggle marker disabling the nightly owl.sh maintenance run on a box - xoct and xcopy park owl.sh here during operations that must not collide with maintenance then restore it - xmass does not manage it - legacy .daily.sh.off is converted to it on self-update. | /operating/monitoring/nightly-owl |
.pause_heavy_tasks_maint.cnf |
/root/ |
Honoured by three of the four off-site backup tools - multiback, backboa and duobackboa - and by mysql_backup.sh and dcysetup; presence makes each exit 0 immediately to pause heavy tasks during maintenance. mybackup carries no such gate, so tenant restores queue and run through a pause. Deliberately NOT converted to a /root/.barracuda.cnf variable - the file stays the control. It is a transient operational latch with a published remove-to-resume recovery, and one of its consumers is a destructive enforcement arm rather than a polite skip - while the file exists, the autoupboa pass that runs on the roughly five-minute self-update tick also runs killall -9 mysqldump and killall -9 rsync - so a sticky variable would turn a maintenance latch into a persistent silent killer. Safety over uniformity. | /operating/backups/overview |
.pause_tasks_maint.cnf |
/etc/boa/ |
Maintenance-pause switch for all task processing on the host - runner.sh, killer, weblogx, manage_ltd_users.sh and purge_binlogs.sh exit immediately while it exists, and autosymlink defers a narrow single-site files-store apply. Create it to pause during a maintenance window or manual DB fix and remove it to resume - that holds on a self-hosted box only. On an omega8.cc-hosted box (a /root/.host8.cnf marker or an .aegir.cc hostname) autoupboa rewrites it on every pass, roughly every five minutes, keyed on /run/boa_run.pid - creating it while a barracuda, octopus or boa run holds that pid and deleting it again once the pid is gone - so a hand-set pause there is removed within minutes and is not a usable interlock. | /operating/architecture/task-queue |
.percona.5.7.cnf |
/root/ |
Standing equivalent of the percona-5.7 command-line token - barracuda _up_action seds _DB_SERIES=5.7 into /root/.barracuda.cnf and into the settings copy under /var/backups, but only when the installed Percona version (mysql -V) already reports 5.7, so it can never downgrade an 8.0 or 8.4 host. Its arm is reached only when neither an 8.4 nor an 8.0 request is present, and what it writes is exactly what the no-argument default writes on a 5.7 box, so today it records intent rather than changing behaviour. Nothing in BOA removes the file. | /operating/database/percona-setup-tuning |
.percona.8.0.cnf |
/root/ |
Standing equivalent of the percona-8.0 command-line token - barracuda _up_action seds _DB_SERIES=8.0 into /root/.barracuda.cnf and into the settings copy under /var/backups, but only when the installed Percona version (mysql -V) reports 5.7, so it can never downgrade an 8.0 or 8.4 host. A .percona.8.4.cnf marker or a percona-8.4 argument is tested first and wins. Nothing in BOA removes the file, so it keeps asking on every later run until an operator deletes it. | /operating/database/percona-setup-tuning |
.percona.8.4.cnf |
/root/ |
Standing equivalent of the percona-8.4 command-line token - barracuda _up_action seds _DB_SERIES=8.4 into /root/.barracuda.cnf and into the settings copy under /var/backups, but only when the installed Percona version (mysql -V) reports 5.7 or 8.0, so it is a no-op once the box is already on 8.4. It is not a way round the staged path - on a 5.7 box _sql_strict_upgrade_path in sql.sh.inc rewrites the request back to 8.0 for that run, so the marker walks the box from 5.7 to 8.0 to 8.4 over two consecutive upgrade runs. Requests are tested 8.4 first, then 8.0, then 5.7, and nothing in BOA removes the file, so it keeps asking on every later run until an operator deletes it. | /operating/database/percona-setup-tuning |
.proxy.cnf |
/root/ |
Node-role marker declaring the box a proxy node rather than a hosting node - presence is the whole signal and the content is never read. Narrowed 2026-08-09 to gate only what a proxy genuinely lacks. Twelve BOA tools exit 0 the moment they see it - runner.sh, owl.sh, usage.sh, manage_solr_config.sh, move_sql.sh, checksql.sh, purge_binlogs.sh, mysql_backup.sh, mysql_cleanup.sh, mysql_repair.sh, mysql_cluster_backup.sh and mycnfup - and three barracuda build-side arms skip the Percona system-table check and the start and reload of Valkey/Redis with PHP-FPM (nginx itself and cron are registered and started/restarted unconditionally). Everything a live internet-facing relay needs keeps running - second.sh with its IDS scanners and guard fan-out, minute.sh and the per-service watchdogs, clear.sh (the whole 5-minute channel including tool self-updates), graceful.sh, manage_ltd_users.sh host hardening and loadreport --log - and neither hosted normalisation pass creates or erases the file; the PHP-idle path no longer synthesises it either (it uses the owner-PID-keyed /run/boa_php_idle_quiesce.pid instead). | /operating/architecture/overview |
.randomize_duplicity_full_backup_day.cnf |
/root/ |
Presence marker - creating it switches backboa and duobackboa from the fixed default full-backup weekday to a randomised persisted weekday (stored in /var/log/boa/bucket.randomize.full.log) and staggers each step with a short random sleep to spread fleet load off the Sunday peak. On an omega8.cc-hosted box (a /root/.host8.cnf marker or an .aegir.cc hostname) the _update_agents normalisation pass in BOA.sh.txt deletes this file on every run, roughly every five minutes via clear.sh, so the fixed default weekday always applies there and the toggle holds only on a self-hosted box. | /operating/backups/legacy-backboa |
.redis.no.new.password.cnf |
/root/ |
Presence suppresses the forced Redis password rotation, with the same shape as the Valkey twin - redis.sh.inc runs _forced_redis_password_update when this file is absent OR /root/.redis.pass.txt is missing, so a host with no stored password rotates regardless of the marker. It is created by boa in-dev, in-pro and in-lts alongside the mysql and valkey twins and deleted with them once per box by autoupboa after the install has settled; the file is empty and no password value passes through it. | /operating/database/percona-setup-tuning |
.restrict_this_vm.cnf |
/root/ |
Presence marks a restricted VM so autoupboa deliberately sets mode 700 on /usr/bin/rsync and /usr/bin/mysqldump and runs killall -9 rsync instead of the normal 755, which blocks the aegir user and breaks per-site backups. | /operating/backups/overview |
.run-to-<codename>.cnf |
/root/ |
Presence marker - drop exactly one of run-to-daedalus.cnf, run-to-excalibur.cnf, run-to-chimaera.cnf or run-to-beowulf.cnf - then start the clean-boa-env service to launch the matching auto codename driver, which chains barracuda up-<tier> system passes and reboots until the host reaches that Devuan codename. | /operating/os-lifecycle/devuan-os-upgrades |
.run.example.report.cnf |
/etc/boa/ |
Operator-created one-shot request for a full status report - on the pass that lands on the top of the hour autoupboa runs boa info report both and mails the output, but the recipient and BCC addresses are only ever set on a BOA-hosted box, so on any other host the marker does nothing at all. On a hosted box the same run erases it in the hosted normalisation block, roughly every five minutes, and the reader never deletes it after a send. A request created away from the top of the hour is therefore wiped before the send window arrives and is silently dropped. | /operating/os-lifecycle/selfupgrade-reference |
.secret.txt |
/root/.remote_backups/ |
The Duplicity encryption passphrase - a single 44-character base64 line generated once by dcysetup setup (openssl rand -base64 32), mode 600 and chattr +i, read into the PASSPHRASE env var before every backup and restore run. A missing or empty file aborts the run. Also generated per-tenant at /data/disk/USER/remote_backups/.secret.txt - one per account per server, never rotated in place. Lose it and the off-site archives are unrecoverable, so back it up out of band; a tenant asking for server-independent access gets a copy per the hand-off procedure on this page. | /operating/backups/multiback-operations |
.send-extended-report.cnf |
/etc/boa/ |
Operator-created marker that switches barracuda upgrade reports and boa installation reports to the extended form - the mail then also carries the highest-ranked /root/.auto<codename>.log (only one, even on a box that hopped more than once), ls -ltcra /root, a ps auxf process tree, aureport, the aa-status loaded, enforce and complain counts, aa-unconfined, and boa info full - on barracuda that goes in place of the short boa info summary the default report carries, while boa installation reports carry no such summary at all, so there the block only adds. It applies to failure alerts as well as success reports, on both tools. It is one of five OR terms, so any of the four /root/.run-to-<codename>.cnf markers already produces an extended report during an automated OS hop without this file, and on barracuda the extra material is appended after that tool's scrub of _NEWRELIC_KEY and _AWS_ lines - the boa installation report is never scrubbed - so an extended report is more disclosing than the default one. | /operating/os-lifecycle/manual-boa-upgrade |
.silent-octopus-upgrade.cnf |
/etc/boa/ |
Operator-created marker that silences the already-up-to-date notice octopus prints when an instance log already records the running release and tier - and because the same branch sets the skip flag, its presence also turns that skip into a re-run, so an unforced octopus up-<tier> upgrades already-current instances again instead of passing over them. On an already-current instance the mode token has been cleared by then, so the re-run takes the catch-all path and upgrades the Ægir frontend and the platforms whatever token was typed; a run with force never reaches the test and behaves the same either way. No hosted normalisation pass creates or erases it, and an existing /root/ copy is copied into /etc/boa once by the BOA.sh.txt relocation, leaving the /root/ original in place while only /etc/boa is read. Converted to _OCTOPUS_UPGRADE_RERUN_SILENT=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _OCTOPUS_UPGRADE_RERUN_SILENT=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. | /operating/os-lifecycle/manual-boa-upgrade |
.silent.update.cnf |
/root/ |
Mail-suppression marker read as a plain file by the stage A finalise block - when it exists, preparing and sending the Satellite setup-mail and welcome email are both skipped, the INIT setup mail and the UPGRADE resend alike. Mostly BOA-managed rather than operator-set - xoct probes the target over ssh before seeding an account onto another box and touches the marker only when the probe came back absent (an operator-set marker is preserved, an unreadable probe counts as unknown and is left alone with a warning), then removes it after the remote install returns, with an EXIT INT TERM trap removing it on any unwind so an install that dies cannot leave the box quietly skipping setup mail. run-xdrago deletes it unconditionally on every queued Octopus upgrade, on hosted and self-hosted boxes alike, so an operator preset does not survive one. Neither hosted normalisation pass touches it. | /developing/install-internals/staged-setup |
.skip-aegir-master-upgrade.cnf |
/root/ |
Code-managed hop state, not an operator knob - BOA touches it itself when a major OS upgrade starts, in _if_major_os_upgrade, and removes it again in _finale, but only once the hop has finished, that is when .completed_post_major_os_upgrade.info exists and .run_post_major_os_upgrade.info does not, so it survives the intermediate reboots. While present it forces _SYSTEM_UP_ONLY=YES in the same OR arm as .debug-barracuda-installer.cnf, so the Ægir Master frontend upgrade never runs; it also suppresses the system-wide Drush install and update pass, and drops the imap, imap-ssl and kerberos extras from source builds of PHP below 8.5. Creating it by hand imitates hop state, and the next barracuda run that sees a finished hop deletes it. Neither hosted normalisation pass touches it. | /developing/install-internals/hostmaster-upgrade |
.skip_cleanup.cnf |
/root/ |
Presence makes the daily 03:01 graceful.sh maintenance pass skip its whole action body and exit 0 - no Devuan mirror refresh, no postfix queue purge, no syslog daemon restart, no swap reset or cache drop, no GeoIP fetch, no /opt/tmp session-file purge and no Speed-Booster purge. Positive test, ORed with the pass's in-flight gate, so it is the operator equivalent of telling the box that a BOA run is in flight. That gate was widened in 2026-08 from a single /run/boa_run.pid test to the same seven signals owl.sh uses - the three install lock pids plus anchored process forms for the BARRACUDA/OCTOPUS legs, the barracuda/octopus wrappers, boa in- and the AegirSetup children - because the chained install's octopus leg holds only octopus_install_run.pid and the setup children match no wrapper form, so the phase that rewrites the very trees this pass seds and reloads nginx against was invisible to it; it sits after the earlier hard exits on /root/.pause_heavy_tasks_maint.cnf and the PHP-idle quiesce marker /run/boa_php_idle_quiesce.pid (honoured only while its recorded owner PID is alive; a dead-owner marker is deleted and the pass continues). Since the 2026-08-09 proxy-marker narrowing there is no /root/.proxy.cnf exit here at all - the daily pass runs on proxy nodes too. On hosted boxes BOA deletes it on every five-minute self-update tick, so it cannot be made to stick there. Deliberately NOT converted to a /root/.barracuda.cnf variable - the file stays the control. That five-minute wipe is a published fleet guarantee, and a sticky cnf line would create a durable form of exactly the capability the wipe exists to deny. | /operating/monitoring/auto-healing |
.skip_duplicity_monthly_cleanup.cnf |
/root/ |
Presence marker suppressing the monthly cleanup --force run that otherwise fires once a month on a per-bucket random day-of-month 1-5 (persisted in /var/log/boa/bucket.randomize.cleanup.log). Age retention via remove-older-than after a full-day run is unaffected. On an omega8.cc-hosted box (a /root/.host8.cnf marker or an .aegir.cc hostname) the _update_agents normalisation pass in BOA.sh.txt deletes this file on every run, roughly every five minutes via clear.sh, so the monthly cleanup always runs there and the toggle holds only on a self-hosted box. | /operating/backups/legacy-backboa |
.slow.cron.cnf |
/root/ |
Forces the Slow queue cadence - runner.sh runs a single per-Octopus action pass padded with 15 s sleeps, and that arm is tested before the Fast one, so Slow wins over .fast.cron.cnf unless .force.queue.runner.cnf exists. Separately and independently it pins the concurrent-runner ceiling to 1 (8 without it), keyed on this marker alone. It also forces the monitor box class to SLOW in minute.sh and second.sh - 3 minute.sh passes with sleep 18 and the heavy second.sh fan-out every 4th pass - again unless .force.queue.runner.cnf exists. runner.sh auto-creates it immutable with chattr +i on boxes with 4096 MB RAM or less and writes .slow.cron.cnf.protected beside it. On omega8.cc-hosted boxes the _update_agents ladder in BOA.sh.txt writes it above 50 instances and removes it on every lower instance tier and on the POWER, PHANTOM and CLUSTER plans - unless .slow.cron.cnf.protected exists. | /operating/architecture/task-queue |
.slow.cron.cnf.protected |
/root/ |
Protection marker runner.sh writes beside the immutable .slow.cron.cnf on low-RAM boxes so the forced Slow cadence survives Octopus plan changes. | /operating/architecture/task-queue |
.small_hop_on_major_os_upgrade.info |
/root/ |
State marker written during the major OS upgrade run to record whether a codename hop is a small hop or a big hop. BOA touches .small_hop_on_major_os_upgrade.info for the same-generation Debian-to-Devuan sidegrades - Debian Buster to Beowulf, Bullseye to Chimaera and Bookworm to Daedalus - and .big_hop_on_major_os_upgrade.info for every other jump. The full per-installed-version PHP rebuild in the post-upgrade phase runs only when the big-hop marker is present, so small hops skip reinstalling and rebuilding every PHP version. | /operating/os-lifecycle/devuan-os-upgrades |
.sql.problematic.users.cnf |
/etc/boa/ |
Lists MySQL usernames held to the lower per-query kill ceiling _SQL_LOW_MAX_TTL (default 60s) rather than _SQL_MAX_TTL when the high-load monitor kills over-TTL queries - root-owned processes are always skipped. | /operating/database/percona-setup-tuning |
.sqlclean.protect.cnf |
/root/ |
Operator-authored allow-list of database names sqlclean must never offer for deletion, one exact name per line, # comments allowed - and a deliberate safety interlock, because any LIVE run refuses to start until the file exists, even empty (its existence is the recorded sign-off that non-Ægir schemas were reviewed after a DRY run). A listed name joins the preserved bucket alongside system schemas and every alias-resolved site database. Names must match [A-Za-z0-9_] exactly - a name carrying a hyphen, dot or space is silently dropped from the list (whitespace is stripped anywhere in the line, so a space inside a name silently renames it), leaving that schema a ghost candidate; this only bites hand-created databases, since Provision never emits such names. Never written or removed by BOA; no variable form exists. |
/operating/database/orphan-database-cleanup |
.ssh.auth.keys.only.cnf |
/root/ |
Presence marker enforcing key-only SSH - when it exists system.sh.inc re-appends PasswordAuthentication no at upgrade instead of the template default PasswordAuthentication yes. | /operating/security/ssh-sftp |
.ssh.root.auth.keys.only.cnf |
/root/ |
Presence marker forcing PermitRootLogin to prohibit-password at upgrade - BOA also forces this on all hosted systems, so the file matters mainly on non-hosted hosts. | /operating/security/ssh-sftp |
.standby.cnf |
/root/ |
Durable passive-replication role marker. xmass init writes it on the target FIRST, before the datadir swap and before any replication exists, so the copied-in production datadir is gated from its first minute; init re-verifies it once the replica is running, and every LIVE sync restores it if it has gone missing. Cutover step 15 removes it and verifies the removal, post-mig clears a leftover loudly, and the second.sh watchdog self-removes it only on a box whose replica probe runs clean with no fresh in-flight window signal (/run/boa_xmass_init.pid or its reboot-proof twin /root/.standby.init.pid), logging to /var/log/boa/standby.quiesce.log. Presence is the whole signal and the content is a one-line provenance note that records the source IP - xmass init and prep-target read it back and hard-refuse a target whose marker names a DIFFERENT source (prep-target refuses ANY standby target; repair of an existing mirror is init's job), and a box carrying the marker refuses to SOURCE a migration at all. Cron stays ARMED - the marker carries passivity per job. DATABASE - the replica runs super_read_only, persisted as the xmass-standby-hold block in xmass_gtid.cnf and set at init; the mysql watchdog re-asserts it every minute, appends the block to a standing mirror built by older bytes (fleet-delivery retrofit), and releases it - runtime verified BEFORE the block is stripped - once the marker is gone; the replication appliers stay exempt, everything else including root gets refused at the server. WEB - the tier is held DOWN by the start() gate in the shipped nginx init script (covers boot), the per-minute enforcer, and the BOA_STANDBY_WEB firewall chain (v4+v6, loopback exempt) the enforcer asserts and csfpost.sh re-adds after every csf restart. FTPS - the daemon is killed on sight and its self-healer stands down. TENANTS - lshell/mysecureshell logins flip to nologin with live sessions killed, recorded in /var/log/boa/standby-held-shells.txt; the release restores exactly the recorded users, each verified, keeping failures for retry; users born on a held standby are created nologin and recorded. BACKUPS - mybackup, multiback, backboa and duobackboa exit quietly (the active owns the lineage). JOBS - runner.sh holds the task queue and parks the panel's per-minute hosting-dispatch crontab as .aegir, while owl.sh, usage.sh, manage_solr_config.sh, batch_guard.sh, task_guard.sh, purge_binlogs.sh, mysql_repair.sh, checksql.sh, updatesymlinks, mysql_cleanup.sh, java.sh, both SQL backup paths, the tenant self-service restart triggers in the nginx/php/valkey watchdogs, the wiped-config self-heal arming and the forced LE re-registration arm all stand down; barracuda steers up-* to the system flavour (skipping the binlogged 5.7 mysql-schema heal), refuses the aegir flavour and the enable/disable flag verbs, and octopus refuses any run. Every hold honours the in-flight window (either window file fresh means xmass owns the box) and releases within about a minute of the marker going - promotion needs no cutover to un-hold a box. Never create by hand on a production box. | /operating/migration-cloning/failover-recovery-scenarios |
.standby.init.pid |
/root/ |
Reboot-proof twin of the in-flight window signal /run/boa_xmass_init.pid (which lives on tmpfs and vanishes at reboot). second.sh mirrors the fresh /run file here every minute, so a reboot inside an xmass window cannot leave the box with no signal and let the watchdog self-remove the standby marker mid-init; it carries the same 48-hour age ceiling and is reaped the moment the window is definitively over (replication confirmed, or the marker gone). Every standby hold stands down while EITHER file is fresh - the window belongs to xmass. Never touch by hand. | /operating/migration-cloning/failover-recovery-scenarios |
.standby.serve.cnf |
/root/ |
Operator escape hatch on a passive standby - WEB-ONLY preview, deliberately narrow. While it exists next to .standby.cnf the nginx enforcer stands down (the health checks heal nginx UP) and the BOA_STANDBY_WEB firewall hold is removed, so the mirror answers HTTP/HTTPS; every OTHER hold stays exactly as it was - the DB keeps super_read_only, tenant logins stay nologin, FTPS stays down, backups and the task queue stay gated. It is a read-only preview, never a go-live. No expiry by design (operator-owned), but the enforcer logs one line an hour into the nginx incident log while it holds, so a forgotten marker stays visible. Meaningless without .standby.cnf. Remove it to re-hold the web tier within a minute. | /operating/migration-cloning/failover-recovery-scenarios |
.tg.cnf |
/root/ |
BOA-computed host-tier state, never an operator knob - the hosted-fleet ladder in BOA.sh.txt _update_agents writes it (its content is the instance count the ladder measured) once a hosted box carries more than 50 Octopus instances or any account sits on a POWER, PHANTOM or CLUSTER plan, and removes it again below that; BOA never creates it on a self-hosted server. Presence classifies the host as _VMFAMILY=TG rather than XEN, derives the MySQL memory base from RAM/12 instead of RAM/24 on a VS-family host, takes the bare-metal branch of the tuning ladder on boxes with at least 8 GB of usable RAM (a floor of 10 on the derived max_connections plus mysqlnd.mempool_default_size doubled from 64000 to 128000 in every /opt/phpNN/etc/phpNN.ini, 5.6 through 8.5), and arms the one-shot rewrite of _PHP_FPM_WORKERS to 100 in /root/.barracuda.cnf that .fixed_fpm_workers.cnf then latches. Do not hand-create or remove it - the next hosted pass recomputes it and the FPM-workers rewrite is never undone. | /operating/control-files-ini/overview |
.top-<codename>.cnf |
/root/ |
State marker recording the top Devuan codename the host has reached - for example .top-daedalus.cnf or .top-excalibur.cnf. On either hop into Excalibur the old .top-daedalus.cnf is renamed to .old-top-daedalus.cnf and a fresh .top-excalibur.cnf is created; a first Trixie-to-Devuan hop touches .top-excalibur.cnf. | /operating/os-lifecycle/devuan-os-upgrades |
.turn.off.auto.update.cnf |
/root/ |
Per-box lock file whose presence opts the box out of BOA weekly auto-updates - one of two opt-outs alongside _SKYNET_MODE=OFF in .barracuda.cnf, though SKYNET-on with auto-updates live is the assumed default. | /developing/release-model/branches-and-editions |
.upstart.cnf |
/root/ |
Operator-created marker suppressing the three places where BOA starts or reloads the cron service - the reload ending the BOA.sh.txt bootstrap, the start in _finale at the end of every barracuda pass, and the start ending each per-account Octopus setup run. All three tests are negated, so presence is what suppresses them. It never stops cron and is only partially honoured - the abnormal-exit cleanups in both the wrappers and the staged installers, the Nginx stage on a fresh install, the duplicate-cron detector, the runner.sh master-cron enable and disable toggles, the reload the BOA self-update runs after appending the migration_proxy_certs crontab line, and the migration tools all start or reload cron regardless. Zero writers in the tree and no hosted normalisation pass erases it. Converted to _NO_CRON_AUTOSTART=YES in /root/.barracuda.cnf - the variable is the supported switch and the marker file stays honoured for one release; to switch it off set _NO_CRON_AUTOSTART=NO and remove the marker file, because while the file exists it wins and is re-asserted on every upgrade pass. System cnf only - a same-named line in an octopus cnf is unsupported. The key is _NO_CRON_AUTOSTART rather than a transliteration of the marker name, because that name is actively misleading - it neither detects nor selects an init system, and the historical half that skipped stopping cron during an upgrade no longer exists in code. | /operating/os-lifecycle/host-os-baseline |
.use.curl.from.packages.cnf |
/root/ |
Operator-created escape hatch forcing the box back onto the distro-packaged cURL instead of BOA's own build (prebuilt package or source build) - during the next upgrade pass that reaches the curl install step, its presence moves BOA's own libcurl libraries aside into a dated /var/backups/legacy-libcurl-pre-* directory, renames /usr/local/bin/curl out of the way, releases any dpkg hold and installs the packaged curl; it also clears .sorted.multi.php.cnf so the multi-PHP ordering re-derives against the changed toolchain. Reported by boa info as CRL_From_Packages YES/NO. Effectively one-shot - autoupboa deletes the marker (chattr -i then rm) on every daily pass, so touch it right before the upgrade run you want it to affect. No variable form exists. | /operating/os-lifecycle/host-os-baseline |
.use.default.nameservers.cnf |
/root/ |
Forces BOA default public-nameserver handling - when both nameserver toggles exist this one wins and .use.local.nameservers.cnf is deleted | /operating/troubleshooting/dns-resolver |
.use.local.nameservers.cnf |
/root/ |
Sets _USE_PROVIDER_DNS=YES - skips the remote lookup test and the unbound install path forced public-set rewrites, leaving a provider-managed resolv.conf in place; the BOA-DNS-Config header check is not gated by this toggle so a header-less provider file can still be rewritten to canonical | /operating/troubleshooting/dns-resolver |
.use.sysklogd.cnf |
/root/ |
RETIRED - rsyslog is the only supported syslog daemon and is never removed. This marker (and the briefly-lived _USE_SYSKLOGD variable it was converted to) used to select sysklogd by purging rsyslog first, but sysklogd is no longer installable on current Devuan/Debian, which left an opted-in host with no syslog daemon at all. Both forms are now ignored - a stale marker file or cnf line is inert and safe to leave in place; every barracuda pass restores a missing rsyslog. | /operating/os-lifecycle/host-os-baseline |
.valkey.no.new.password.cnf |
/root/ |
Presence suppresses the forced Valkey password rotation, but only in company - valkey.sh.inc runs _forced_valkey_password_update when this file is absent OR /root/.valkey.pass.txt is missing, so a host with no stored password rotates regardless of the marker. It is created by boa in-dev, in-pro and in-lts alongside the mysql and redis twins and deleted with them once per box by autoupboa after the install has settled; the file is empty and no password value passes through it. The rotation it gates ends in a valkey-server restart. | /operating/database/percona-setup-tuning |
.whitelist.dont.cleanup.cnf |
/etc/boa/ |
Migrated CSF marker with a negated test - when ABSENT (the default) each guest-water.sh provider refresh first strips its own tagged lines from /etc/csf/csf.allow, after backing that file up under /var/backups/csf/water, and the matching crawler ranges from the IPv6 allow store, then re-adds the freshly fetched addresses; presence suppresses the strip, so a refresh only appends what is missing and stale tagged entries survive. Eleven call sites cover the IPv6 allow store plus the Pingdom, Cloudflare, migration-proxy, Imperva, Googlebot, Google-special-crawler, Microsoft, Sucuri, Auth0 and Site24x7 refreshes; the migration-proxy and Site24x7 arms strip their tagged lines from /etc/csf/csf.ignore as well as /etc/csf/csf.allow, which matters because the Site24x7 csf.ignore entries are what .ignore.site24x7.firewall.cnf puts there. Untagged manual operator lines are never touched either way. The live readers test /etc/boa only. | /operating/control-files-ini/overview |
.xmass_solr_disarmed.list |
/var/log/boa/ |
Record of which Solr and Jetty services the xmass hold took down, one service name per line, written by xmass init and appended to by the java.sh check as it re-asserts the disarm. It exists so a re-arm restores EXACTLY what the hold disarmed - services down for other reasons, an xtrim-finalized proxy or an operator hand-disarm, never enter the list and stay down. Two paths read it - the init unwind on an abandoned migration re-arms only the listed set, and java.sh re-arms the listed set (exec bit plus rc links, recognised service names only) once the hold marker is gone and then deletes the list, which is what keeps Solr from staying silently dead after a cutover run by an older xmass whose step 14 does not re-arm. It is not the only re-arm - current xmass cutover step 14 and post-mig re-arm all four services regardless of the list. The java.sh re-arm sits below the standby belt, so nothing is re-armed on a box carrying /root/.standby.cnf. The legacy unscoped .xmass_solr_disarmed.pid form is removed on sight. | /operating/migration-cloning/xmass-server-move |
.xmass_solr_hold.pid |
/var/log/boa/ |
Marker holding Solr DOWN on a migration target for the whole replication window - xmass init writes it and disarms the Solr and Jetty init scripts (exec bit and rc links dropped, not just a stop), and while it exists the java.sh check in the per-minute monitor fan-out re-asserts that disarm on every pass and reaps stray JVMs by service user, so the hold survives reboots and barracuda passes. manage_solr_config.sh exits immediately while it exists, so no core work fights the hold, and cutover step 0 re-holds in case someone started Solr by hand. It is cleared at cutover step 14, by post-mig, by the target's restore-solr, and by the init unwind when a migration is abandoned. | /operating/migration-cloning/xmass-server-move |
<oN>_civicrm.txt |
/data/conf/ |
Presence-only root-owned per-instance marker - lets backend Octopus user oN load the CiviCRM drush extensions civicrm.drush.inc, cv.drush.inc and civicrm_drush.drush.inc that the deny-filter otherwise blocks. Content irrelevant, existence is the signal. | /developing/aegir-apis/drush-fork-internals |
<oN>_elysia_cron.txt |
/data/conf/ |
Presence-only root-owned per-instance marker - lets backend Octopus user oN load elysia_cron.drush.inc, keeping Elysia backend-mode cron granularity instead of degrading to core cron. A deliberate explicit trust widening, off by default. | /developing/aegir-apis/drush-fork-internals |
<octopus-user>_civicrm.txt |
/data/conf/ |
Per-Octopus opt-in allowlist - when present the three CiviCRM command-file basenames are loaded during backend tasks - absent by default they stay blocked by the drush.inc filter. | /operating/troubleshooting/task-failures |
<service>.txt |
/root/.remote_backups/credentials/ |
Per-backend credential template - one <service>.txt per storage backend carrying that backend key/secret export lines plus KEEP_WITHIN and FULL_BACKUP_FREQUENCY retention vars, mode 600. Fill the your_ placeholders to enable a backend - a template still matching your_ is skipped and not scheduled. Also written per-tenant under static/control/remote_backups/credentials/. | /operating/backups/multiback-operations |
<service>.txt |
~/static/control/remote_backups/credentials/ |
Per-provider off-site backup credentials, one ready-made template per supported service. Filling in the your_ placeholders with real keys enables that provider; a file still holding placeholders is skipped. Ends with the KEEP_WITHIN retention window (months or years, minimum 1M, default 3M) and FULL_BACKUP_FREQUENCY full-copy cadence (7D to 60D, default 28D). Keep mode 600. | /using/backups/mybackup-and-quota |
<user>_use_proxysql.txt |
/data/conf/ |
Presence flips the per-instance DB port _THIS_DB_PORT from 3306 to 6033 for ProxySQL - a remnant of the discontinued Simple Cluster, inert on supported single-server hosts; host-wide variant is /var/aegir/use_proxysql.txt and _THIS_DB_PORT is auto-recomputed from the marker, never hand-edited. | /operating/database/percona-setup-tuning |
ClassicTrack.info |
~/static/control/ |
Empty on-switch that restores the verify-first behaviour after FastTrack.info was used - deleting FastTrack.info alone is not enough - you also touch this file to switch the clone and migrate pre-flight checks back on. | /using/sites-and-platforms/faster-clone-migrate |
FastTrack.info |
~/static/control/ |
Empty marker whose presence makes clone and migrate skip the site and platform pre-flight verifications so each job starts sooner - trades safety for speed - use only for bulk jobs on setups already confirmed healthy. | /using/sites-and-platforms/faster-clone-migrate |
MyClassic.info |
~/static/control/ |
Account-wide switch - present turns the fast parallel per-table database copy off so clone, migrate and backup produce the classic single-file mysqldump that lets the Restore task bring a site back whole - at the cost of slower jobs on large databases - remove to return to the fast default. | /using/sites-and-platforms/faster-clone-migrate |
MyQuick.info |
~/static/control/ |
Empty account-level marker - when present, the DB phase of backup, clone, migrate and delete uses per-table parallel mydumper/myloader instead of a single-stream dump. ON by default (barracuda pass rewrites it unless MyClassic.info exists); breaks the Ægir Restore task. | /operating/migration-cloning/site-cloning |
_no_codebase_lock_unlock.ctrl |
/data/conf/ |
Kill-switch that gates reverting and re-applying the Ægir core and console patches around the D8+ platform site-install run - present disables the installer lock-unlock cycle. | /developing/aegir-apis/provision-backend |
access.txt |
/data/disk/<oct>/static/control/ip/ |
Per-instance control file read by the ip_access generator - one site per line followed by space-separated allowed IPv4/IPv6 addresses or CIDR ranges - locks the whole site to that allow-list at Nginx with a 403 for anything else - the master sqladmin context uses /var/aegir/control/ip/access.txt | /operating/security/site-ip-access |
access.txt |
~/static/control/ip/ |
Whole-site IP lock - one line per site giving the site name and space-separated allowed IPv4/IPv6 addresses or CIDR ranges; all other clients get 403. Loopback, the server, and SSH-connected addresses are always allowed. Delete a site line to lift the lock. | /using/protecting-your-site/site-ip-lock |
backup_schedule.txt |
/root/.remote_backups/schedule/ |
Backup schedule list - one <service> <user> line per configured backup. The sequential_backups.sh wrapper iterates it and runs multiback backup <service> <user> for each in turn. Written by create_cron_entries.sh (dcysetup setup); inspect with cat to see the live schedule. | /operating/backups/multiback-operations |
boa_platform_control.ini |
sites/all/modules/ |
Per-platform INI settings store - tenant-editable template copied from the shipped default into the platform modules directory - exposes 34 settable variables that override the compiled-in defaults and the host cnf layer, and is itself overridden by the per-site INI. | /operating/control-files-ini/ini-precedence |
boa_site_control.ini |
sites/<domain>/modules/ |
Per-site INI settings store - the narrowest and highest-priority layer of the four-layer precedence chain - tenant-editable template copied into the site modules directory that exposes 33 settable variables overriding platform INI, octopus cnf and barracuda cnf. | /operating/control-files-ini/ini-precedence |
clear-drush-cache.info |
~/static/control/ |
Touch to force an immediate purge of the account backend build workspace and Drush caches, clearing crashed-build debris left in the hidden .tmp workspace so a rebuild does not trip over it - BOA deletes the control file once the purge finishes. | /using/deploying-code/building-a-platform |
cli.info |
~/static/control/ |
Single-line file naming the command-line PHP version for the whole account - governs drush, composer and bee in the oN.ftp shell plus the Drush runs behind Ægir backend tasks - read every three minutes - a platform carrying path_alias_cache with PHP 5.6 installed forces 5.6 here | /using/tuning/php-version |
clstr.cnf |
/data/conf/ |
Presence marks the host as a cluster node - when readable BOA keeps the bootstrap, discovery and config cache bins on cache.backend.redis (shared tier only) instead of overriding them to chainedfast, so the per-worker APCu tier and redis_exclude_bins do not apply. | /operating/php-fpm-performance/cache-tuning |
compass.info |
~/static/control/ |
Account-level toggle - touch it, then log out and log back in after up to five minutes, to install the server-provided Ruby with Sass and Compass gems for your main account and any client sub-accounts - on servers where the host has enabled Node it also provisions per-account NPM (Gulp/Grunt/Bower) tooling under /opt/user/npm for the main account only; deleting it removes the gems and the NPM setup again a few minutes later. | /using/deploying-code/gems-and-node-tools |
cron-proxy.info |
~/static/control/ |
Presence-only account switch that forces every scheduled cron request to skip the public domain and hit your server directly with the domain in the Host header, for all sites on the account. Contents ignored - create via shell or SFTP, delete to revert. | /using/sites-and-platforms/site-cron |
custom_paths.txt |
/root/.remote_backups/paths/ |
Root-side custom path-set - one of the three root path-set config files (global/data/custom), a shell file sourced before each run carrying the underscore-prefixed _SOURCE/_INCLUDE_PATHS/_EXCLUDE_PATHS/_INCLUDE_LIST/_EXCLUDE_LIST path variables. Written by create_global_paths_config.sh; edit to change the paths captured. | /operating/backups/multiback-operations |
dBackupCycle.info |
/data/disk/<user>/static/control/ |
Per-tenant override for local-disk DB-dump retention under static/files/dbackup/ - holds a single integer number of days (1-9999, the whole file digits-only) - default is 14 days when the file is absent. An invalid value (including 0) is ignored and logged to /var/log/backup_validation_issues.log; the cleanup still runs at the default, so a bad override can never disable pruning. | /operating/backups/retention |
dBackupCycle.info |
~/static/control/ |
Holds a single whole number - the days of local database dumps in static/files/dbackup to keep before BOA prunes older ones. Default is 14 days. The whole file must be that one number (1-9999, digits only); anything else - including 0 - is ignored with a server-side log entry and the cleanup runs on the 14-day default. Empty or deleted also means 14. | /using/backups/mybackup-and-quota |
data_paths.txt |
/root/.remote_backups/paths/ |
Root-side data path-set - a shell file sourced before each run carrying the same underscore-prefixed _SOURCE/_INCLUDE_PATHS/_EXCLUDE_PATHS/_INCLUDE_LIST/_EXCLUDE_LIST variables. Ships an empty _SOURCE plus a generated per-tenant include set. Written by create_global_paths_config.sh; edit to change the data path-set captured. | /operating/backups/multiback-operations |
dereference_backups.conf |
/data/conf/ |
Opts implicit site backups (the safety copies before restore and delete, pre-clone/pre-migrate source backups, nightly queued backups) and the DB-only backup mode back into dereferencing the files/private symlinks - self-contained safety copies at the cost of duplicating store data into each one. Preserving symlinks is the default without it. | /operating/files-symlinking/backups-on-static-fs |
development.services.yml |
sites/example.com/files/ |
Per-site Drupal 8+ file whose presence on a .dev. request makes BOA load it - routing Drupal render and dynamic page caches through a null backend instead of Valkey and enabling Twig template debug annotations - clear the site caches once after adding or removing it. | /using/deploying-code/dev-workflow |
disable_backups_on_static_fs.cnf |
/data/conf/ |
Box-wide kill-switch for the nightly backups-on-static-fs relocation - while present the per-account nightly pass returns before acting on any account on this host, stopping future relocation but never moving already-relocated data back. | /operating/files-symlinking/backups-on-static-fs |
disable_migrate_sweep_night.cnf |
/data/conf/ |
Box-wide kill-switch for the nightly migration-source grant sweep - while present the night runner takes no box-wide task-queue pause and sweeps no instance from the nightly maintenance window. It does not leave the box without an executor - if this runner had itself switched the module's own daily Migration source grants hosting queue off on its earlier passes, the first night under the kill-switch hands the sweep back by enabling that queue again on every hosted, non-proxied, non-cancelled instance that carries the module, once, and only that - a queue an operator switched off in the panel on a box this runner never swept is left exactly as found. The ownership stamp is /var/log/boa/migrate-sweep-fallback-on.info, written by a real nightly pass after it disables the queues and consumed by the re-arm. | /operating/migration-cloning/migration-source |
disable_native_files_symlink.cnf |
/data/conf/ |
Box-wide kill-switch for native symlinking - new sites get plain real files/private directories and the clone task leaves cloned files as-is - existing symlinked sites are untouched - touch to activate, rm to restore the default. | /operating/files-symlinking/configuration |
disable_orphan_store_archiving.cnf |
/data/conf/ |
Box-wide switch that reverts the nightly sweep to report-only for deleted-site orphan stores - archiving of a reused name on install/clone/migrate is unaffected - touch to activate, rm to restore the default. | /operating/files-symlinking/configuration |
dont-overwrite-<site>.pid |
<aegir-root>/tools/le/.ctrl/ |
Per-site immutable-cert marker - when present the cert is treated as immutable everywhere; Verify never re-issues LE over your PEM files, both nightly renewal legs and the octopus install/upgrade hostmaster leg skip the domain (logging the skip), and the Encryption-disable cleanup branch is skipped entirely; also protects the account frontend cert when named after the frontend domain; create before installing a custom cert, remove to revert to LE. | /operating/nginx-internals/ssl-operations |
drush_extension_filter_disabled.txt |
/data/conf/ |
Presence-only root-owned global kill switch - turns the drush.inc extension deny-filter OFF for every identity. Single-tenant boxes only, since it re-opens the drupal.org 762138 arbitrary-code path. Content irrelevant, existence is the signal. | /developing/aegir-apis/drush-fork-internals |
exclude.txt |
/data/disk/<user>/static/control/remote_backups/config/ |
Tenant exclude directive file - optional, one --exclude line per path the hosted user wants left out. Merged by create_user_paths_config.sh (dcysetup setup) under the same full-line validation as include.txt; an exclude wins over an overlapping include. | /operating/backups/multiback-operations |
exclude.txt |
~/static/control/remote_backups/config/ |
Optional --exclude directives removing absolute paths from the off-site backup. Same line shape and path rules as include.txt, and where an include and exclude overlap the exclude wins. | /using/backups/mybackup-and-quota |
exclude_regexp.txt |
/data/disk/<user>/static/control/remote_backups/config/ |
Tenant exclude-pattern file - optional, one --exclude-regexp line per pattern to drop. Validated line-by-line and merged by create_user_paths_config.sh (dcysetup setup) under the same pattern rules as include_regexp.txt; exclude patterns take precedence over include patterns. | /operating/backups/multiback-operations |
exclude_regexp.txt |
~/static/control/remote_backups/config/ |
Optional --exclude-regexp patterns for the off-site backup. Same pattern and line rules as include_regexp.txt, and exclude overrides include on overlap. | /using/backups/mybackup-and-quota |
force-ssl-certs-rebuild.info |
~/static/control/ |
Per-account marker - when present the nightly night-workers add --force to dehydrated so the account frontend cert and every per-site LE cert are force-rebuilt on the next daily pass, same as the roughly-monthly random force day; domains behind a dont-overwrite marker stay skipped. | /operating/nginx-internals/ssl-operations |
force_symlinks.conf |
/data/conf/ |
Legacy hard-preserve switch for site backups - redundant now that preserving symlinks is the default, but still honoured, and it beats dereference_backups.conf when both exist. The files-carrying panel Backup-task modes ignore both files and always archive the real content. | /operating/files-symlinking/backups-on-static-fs |
fpm.info |
~/static/control/ |
Single-line file naming the PHP-FPM version that serves all account sites to visitors - a background helper reads it every three minutes and switches every site - absent means BOA runs a sensible default | /using/tuning/php-version |
global_paths.txt |
/root/.remote_backups/paths/ |
Root-side global path-set - a shell file sourced before each run carrying the underscore-prefixed _SOURCE, _INCLUDE_PATHS, _EXCLUDE_PATHS, _INCLUDE_LIST and _EXCLUDE_LIST variables. Ships a populated _SOURCE (host paths like /etc, /var/aegir, /var/www, /var/xdrago). Written by create_global_paths_config.sh; edit to change what host-level paths are captured. | /operating/backups/multiback-operations |
http-off.pid |
~/static/control/ |
Per-account write-freeze marker written by xoct export and xmass cutover - contents are a TTL in seconds (3600 via xoct export, 7200 via xmass cutover); global.inc short-circuits every site in the account with a PHP-level 503; removed at proxy conversion. xcopy never writes it. | /operating/migration-cloning/cross-host-migration |
include.txt |
/data/disk/<user>/static/control/remote_backups/config/ |
Tenant include directive file - optional, one --include line per extra path a hosted user wants added to their off-site backup. Validated line-by-line and merged on top of the default include set by create_user_paths_config.sh (dcysetup setup); each line is one directive, one space and one bare absolute path inside the tenant static/ tree or their USER.ftp home, with shell punctuation and embedded whitespace refused. An invalid line is skipped and logged while valid lines and the defaults still apply. | /operating/backups/multiback-operations |
include.txt |
~/static/control/remote_backups/config/ |
Optional --include directives adding absolute paths to the off-site backup. Each line is one directive, one space and one bare path - absolute, inside static/ or the FTP home, built from letters, digits and _ . , + = @ ~ / - only, with no whitespace and none of $ ( ) { } ; & | < > or a backtick. A line breaking a rule is skipped and logged for the host; the built-in default include set always applies - valid lines here are added on top of it. | /using/backups/mybackup-and-quota |
include_regexp.txt |
/data/disk/<user>/static/control/remote_backups/config/ |
Tenant include-pattern file - optional, one --include-regexp line per pattern to add. Each pattern may open with a caret anchor before an allowed base path and may use basic regex metacharacters after it; validated line-by-line and merged by create_user_paths_config.sh (dcysetup setup). | /operating/backups/multiback-operations |
include_regexp.txt |
~/static/control/remote_backups/config/ |
Optional --include-regexp patterns for the off-site backup. Each line is one directive, one space and one pattern, which may open with ^ before an allowed base path (static/ or the FTP home, whose dot may be backslash-escaped) and may also use the regex characters . * + ? [ ] \ ^ on top of the plain-path set; other line rules match include.txt. | /using/backups/mybackup-and-quota |
le-notify.<domain>.info |
<account>/log/ctrl/ |
Per-site throttle marker for Let's Encrypt renewal-failure client notices - its mtime limits sending to once per 7 days per failing domain. Domain characters outside a-zA-Z0-9._- become underscore. Written by the nightly owl.sh account night worker. | /operating/security/mailing-policy |
local-allow.info |
sites/example.com/modules/ |
Control file you create to begin BOA supported procedure for editing local.settings.php - after creating it, run the Reset password task to make local.settings.php group-writable, edit and test as admin, then run Verify to restore read-only permissions. | /using/deploying-code/dev-workflow |
migproxy.cnf |
~/log/ |
Per-account migration proxy POLICY record written by xoct/xmass on both ends of a move (root-owned 0600, parsed never sourced) - role, host and peer addresses, mode (temporary, permanent, ha-switch, retired), scope (account pin vs box default) and deadline. Decides what the client is told about the old address and which peers the target's migration_proxy_trust.sh reconcile keeps trusting; a record whose host address is not the box's own arrived by the log/ rsync and is never a decision input. | /operating/migration-cloning/xmass-server-move |
migproxy.log |
~/log/ |
Append-only per-account migration proxy audit log (pipe-separated) recording every policy set and every client notice actually sent - the answer to "what was this customer told, and when"; the change-notice decision compares the resolved promise against its newest mail line. Never rotated by the tools. | /operating/migration-cloning/xmass-server-move |
migproxy_deadline.txt |
/data/conf/ |
Box-DEFAULT migration proxy deadline (single bare date line) written by xmass init/cutover --proxy-deadline; quoted in the client mail blocks for accounts that resolve to the box default. A default, never a decision - per-account records always win. | /operating/migration-cloning/xmass-server-move |
migproxy_mode.txt |
/data/conf/ |
Box-DEFAULT migration proxy mode (single bare line - temporary, permanent or ha-switch) written by xmass init/cutover --proxy-mode; accounts without their own record resolve to it, and cutover --live refuses while any account would fall back past it to the built-in default. An account pinned with xoct proxy-mode always wins. | /operating/migration-cloning/xmass-server-move |
multi-fpm.info |
~/static/control/ |
Per-site PHP-FPM override listing one main-domain-plus-version per line - any site listed uses its own PHP-FPM version while unlisted sites fall back to the single default in fpm.info - works alongside fpm.info | /using/tuning/php-version |
native_files_archive_alert_kb.cnf |
/data/conf/ |
Box-wide value file - threshold in KB for the archived-store pile alert, default 1048576 KB (1 GiB) - only the first line is read and non-digit characters stripped, else the default stays - controls only the alert and never moves or deletes anything - remove to restore the default. | /operating/files-symlinking/configuration |
newrelic.info |
~/static/control/ |
Holds your New Relic 40-character hex license key on its own line - arming the PHP layer for your whole instance. A background agent picks it up within minutes. Deleting the file disarms the layer and stops reporting instance-wide. | /using/extra-services/new-relic |
no_backups_on_static_fs.info |
/data/disk/<account>/static/control/ |
Per-account kill-switch disabling the nightly backups-on-static-fs relocation for one Octopus account - while present the nightly pass returns before acting, stopping future relocation but never moving already-relocated data back. | /operating/files-symlinking/backups-on-static-fs |
no_backups_on_static_fs.info |
~/static/control/ |
Per-account kill-switch for the nightly backups relocation - when present in an account, _relocate_backups_to_static_fs self-skips for that account so its backups/ and backup-exports/ stay in place rather than moving onto the static-files filesystem. | /developing/monitor-abuse-internals/nightly-worker-internals |
no_native_files_symlink.info |
/data/disk/<account>/static/control/ |
Per-account version of the native-symlinking kill-switch - disables native files/private symlinking for one Octopus account only - presence switch, touch to activate and rm to restore the default. | /operating/files-symlinking/configuration |
no_native_files_symlink.info |
~/static/control/ |
Per-account kill-switch that disables the post-install native symlink step for that account only so the new site files and private dirs are not re-homed into the static store - warn-not-fail. | /developing/aegir-apis/provision-backend |
nodnsupdate |
/etc/dhcp/dhclient-enter-hooks.d/ |
No-op dhclient enter-hook whose make_resolv_conf body is empty so dhclient can never overwrite /etc/resolv.conf on a DHCP lease renewal - installed by the BOA.sh.txt bootstrap and by dhcpfix, and re-installed on bootstrap self-heal when unbound runs but the hook is missing | /operating/troubleshooting/dns-resolver |
paths.txt |
/data/disk/<user>/remote_backups/paths/ |
Per-tenant path-set - a plain shell file sourced by multiback before each run, carrying the underscore-prefixed _SOURCE/_INCLUDE_PATHS/_EXCLUDE_PATHS/_INCLUDE_LIST/_EXCLUDE_LIST variables (a name without the leading underscore is read by nothing). Written by create_user_paths_config.sh; edit to change what the tenant captures. | /operating/backups/multiback-operations |
phpNN.info |
~/static/control/ |
Empty marker file named per version that switches the command-line PHP instantly for the next command - highest marked-and-installed version wins - markers for uninstalled versions are skipped - also steers the Drush runs behind Ægir backend tasks and the platform builds requested from the account while it exists - delete a higher marker to step down | /using/tuning/php-version |
platforms.info |
~/static/control/ |
Tenant-editable list of short platform keywords choosing which platforms install into your own Octopus instance - REPLACES the host default set rather than extending it - keeps only spaces-digits-capitals - the ALL keyword installs everything - an empty file falls back to the host default. | /using/sites-and-platforms/platforms |
policy.txt |
/data/disk/<oct>/static/control/ai/ |
Per-Octopus per-site control file - one line per site with flags train-allow, evasive-allow, search-block, user-block, utility-block - that flip the global AI bot policy per site; read by ai_policy.sh into a per-site nginx fragment. No record keeps global defaults. | /operating/nginx-internals/ai-crawler-policy |
policy.txt |
~/static/control/ai/ |
Per-site AI bot policy - one line per site giving the site name and space-separated flags that flip the host-wide AI defaults for that site (train-allow, evasive-allow, search-block, user-block, utility-block). AI training crawlers and the evasive Perplexity-User fetcher are blocked by default; AI search/index, honest assistant fetchers and utility bots are allowed and rate-limited. Sites with no line keep the defaults; comment lines and blank lines are ignored; delete a site line to restore the defaults. | /using/protecting-your-site/ai-crawlers |
proxied.pid |
~/log/ |
Per-account marker written by xoct proxy and xmass cutover for every source account once it is converted to a migration proxy; contents are COMPLETE. Read by owl as the proxied-state signal - a proxied account is skipped on nightly runs. | /operating/migration-cloning/cross-host-migration |
run-aegir-queue.info |
/data/disk/*/static/control/ |
Per-instance opt-in that enables the automatic task queue on CI or Jenkins-style boxes - an instance creates it under its static/control directory to participate once .allow.aegir.queue.cnf, _ALLOW_AEGIR_QUEUE=YES in /root/.barracuda.cnf, or a higher Octopus plan permits the queue. | /operating/architecture/task-queue |
run-php-fpm-reload.pid |
~/static/control/ |
Empty marker an account holder creates by hand (touch or over SFTP) to request a graceful reload of every installed PHP-FPM version - this recycles workers and clears stale APCu, then the monitor removes the file itself. A roughly 30-second cooldown guards against reload storms, and a request made inside the cooldown window is discarded, not deferred - the file is consumed with no reload, so re-create it after the window if the reload still matters. Available on qualifying plans (POWER/PHANTOM/CLUSTER/ULTRA/MONSTER) or box-wide via _ALLOW_PHP_FPM_RELOAD=YES. | /using/caching/php-opcache-and-apcu |
run-sftp-password-update.pid |
~/static/control/ |
Empty marker a tenant creates to rotate the main oN.ftp SSH/SFTP/FTPS password on demand without root - within a few minutes BOA removes the marker, sets a fresh random 64-character password on the account, clears any expiry lock, restarts the 90-day expiry clock, and writes the new password to ~/static/control/new-oN.ftp-password.txt - save it and delete that file yourself, nothing removes it for you. | /using/connecting/shell-and-sftp |
run-upgrade.pid |
~/static/control/ |
Empty marker a tenant drops next to platforms.info to trigger an on-demand Octopus upgrade without root - it reinstalls exactly the platforms your platforms.info lists then BOA deletes the file automatically - ignored if no platforms.info exists. | /using/sites-and-platforms/platforms |
share.files.<site>.info |
/data/disk/<account>/static/control/ |
Declares a cross-site files symlink for the named site intentional (e.g. a staging copy reading the live site uploads) so the tools leave it in place instead of breaking it into a separate copy - cloning always gets its own copy via --force-unshare. | /operating/files-symlinking/configuration |
share.files.<site>.info |
/data/disk/your_username/static/control/ |
Optional file-sharing marker a customer creates in the account control directory - while it exists the intentional cross-site files link for the named site is kept instead of being replaced with a separate copy - remove it to return to independent per-site copies - a clone never inherits it | /using/backups/your-files-storage |
skip-name-resolve.txt |
/etc/mysql/ |
Presence marker that keeps skip-name-resolve enabled in my.cnf - BOA writes it whenever the DB host is local (the default) and comments the directive out only when this file is absent. | /operating/database/my-cnf-lifecycle |
skip.info |
platform root directory |
Per-platform opt-out from the nightly recursive code-tree chowns (both the lock and the unlock direction) - place it in the platform docroot, and for composer-managed codebases also in the repository root next to composer.json; whatever ownership you set on the code trees then stays, while BOA still manages the container directories, settings files and files/ areas, and the nightly permission sweep still runs. | /using/deploying-code/in-place-upgrades |
ssl-live-mode.info |
~/static/control/ |
Per-account marker for migrating a site off the deprecated dedicated-IP xoct ssl-gen custom-cert model to Let's Encrypt - touch it and wait five minutes after clearing leftover proxy vhosts, then enable SSL for the affected sites. | /operating/nginx-internals/ssl-operations |
ssl-no-san-<domain>.info |
~/static/control/ |
Per-site no-SAN switch - the Lets Encrypt certificate is requested for the site main domain ONLY, with every alias skipped. The escape hatch when one alias whose DNS does not (yet) point at the server keeps failing the whole certificate order, since Lets Encrypt validates every name the certificate covers; the LE machinery itself names this file in its log when a multi-name order fails. Touch it, then run Verify. Named after the site main domain. | /using/ssl/ssl-for-your-sites |
ssl-yes-dev-<domain>.info |
~/static/control/ |
Per-site override that gives a development-named site (main domain containing .dev. .devel. .test. .testing. .temp. .tmp. or .temporary.) a real browser-trusted Lets Encrypt certificate instead of the default self-signed placeholder - touch it from the oN.ftp shell then run Verify. Named after the site main domain. | /using/ssl/ssl-for-your-sites |
tls-legacy-enable-<domain>.info |
~/static/control/ |
Per-site legacy TLS switch - this one site's HTTPS server blocks accept TLSv1.1 alongside TLSv1.2/1.3, for old clients that cannot speak modern TLS. Weakens the TLS floor for that site only; every other site keeps the default. Touch it, then run Verify (the vhost is regenerated). Named after the site main domain. | /using/ssl/ssl-for-your-sites |
unlock.info |
~/static/control/ |
Account-wide switch that flips the nightly codebase-lock direction - while it exists, the nightly maintenance chowns your registered platform codebases to your shell user (oN.ftp) instead of the backend user, granting the owner-only rights that in-place composer and git upgrades need (chmod on hardened paths, git ownership trust); takes effect on the next nightly run, and removing the file re-locks the next night. | /using/deploying-code/in-place-upgrades |
user_admin.txt |
/data/disk/<oct>/static/control/ip/ |
Per-instance control file read by the user_admin_access generator - one site per line followed by space-separated allowed IPv4/IPv6 addresses or CIDR ranges - restricts only the /user and /admin URIs to that allow-list at Nginx while the rest of the site stays public | /operating/security/user-admin-ip-access |
user_admin.txt |
~/static/control/ip/ |
Login/admin-only IP lock - like access.txt but guards only /user and /admin and pages under them while the rest of the site stays public; other clients hitting those get 403. Same one-line-per-site format, always-allowed loopback/server/SSH, and delete-to-lift behaviour. | /using/protecting-your-site/login-admin-ip-lock |
web6.allow |
/var/xdrago/monitor/log/ |
Nginx-native IPv6 allow store - the v6 counterpart of csf.allow, which cannot hold IPv6 entries. guest-water.sh mirrors the published crawler ipv6Prefix ranges into it daily (an empty provider fetch keeps the existing entries) and scan_nginx family-dispatches every IPv6 client to it, exempting a legitimate IPv6 crawler from scoring and the v6 web ban; untagged manual operator lines survive the refresh. | /operating/abuse-guard/ban-pipeline |
wildcard-enable-<domain>.info |
~/static/control/ |
Per-site wildcard switch - Lets Encrypt issues a wildcard certificate (*.domain) through the DNS-01 challenge instead of per-name HTTP validation. Active only when the account's LE toolchain carries the Cloudflare DNS hook (~/tools/le/hooks/cloudflare/hook.py) and its config (~/tools/le/config), because only a DNS record can prove a wildcard; a leading www. is stripped and subdomain aliases are covered by the wildcard itself. On hosted BOA this needs the DNS API wired by your host. Named after the site main domain. | /using/ssl/ssl-for-your-sites |
xmass_solr_used.cnf |
/data/conf/ |
The source's measured Solr classification - the USED and AMBIGUOUS version sets plus a UTC timestamp - recorded on the source while it could still be read live, and written only while no blanket java deny is in force there. Mode 600. Once a cutover has denied Solr on the source, the prep-target, init, sync and cutover re-gates prefer this record; it counts as present on the timestamp alone, so an empty used set from a genuinely Solr-free source is a correct and complete record. With the deny in place and nothing recorded, classification falls back to on-disk evidence and is reported as degraded. | /operating/migration-cloning/xmass-server-move |
xmass_state.cnf |
/data/conf/ |
Whole-server migration state file written by xmass through the phases init/syncing/cutover/complete; each subcommand refuses to run out of sequence, and cutover parks at rename-failed on a target web-layer refusal, a panel-rewire failure, a renameaegirhost failure, or a promotion that committed despite a reported failure. The cutover phase is recorded only just before the durable write freeze, so an earlier abort stays at syncing; correct a wrong phase with xmass reset-phase rather than by hand. Mode 600 - it holds the xmass_repl replication password. Remove to abandon a migration, but only after replication is torn down on the target. | /operating/migration-cloning/xmass-server-move |