Deploy
Data and backing it up
Everything CERMM knows is in one folder: /var/lib/cermm under deploy/lxc.sh, data/ in a checkout.
What's in it
| File | What it is |
|---|---|
cermm.db (with -wal and -shm) | The SQLite database: devices, people, alerts, jobs, docs, tickets, assets, the vault's sealed entries, the audit log. |
signing.key | The server's Ed25519 key. It signs every job and agent update; agents pinned it at enrollment. |
tls/ | CERMM's certificate authority, the server's certificate and key, and custom.crt/custom.key if you gave it your own. |
doc-files/ | Images pasted or uploaded into docs. |
icons/ | App icons for the Software catalog, cached. |
winget-index.db | The winget index, downloaded daily. Can be thrown away. |
setup-code.txt | The setup code, until the first account is claimed. |
The keys are what you can't make again. Lose signing.key or the key in tls/ and every agent stops trusting the server: they'd all have to be installed again. Back up the whole folder, keys included, and keep the backup somewhere as safe as the server.
Backing it up
The database runs in WAL mode, so copy the folder with the service stopped, or the copy may miss the newest writes:
systemctl stop cermm
tar -czf /root/cermm-$(date +%F).tar.gz -C /var/lib cermm
systemctl start cermmWhile it’s stopped, agents retry (every 5 seconds for a minute, then at most every 2 minutes) and carry on when it’s back. On Proxmox, a snapshot or a vzdump backup of the whole container also does it.
Restoring
- Install CERMM on the new machine (Install), then stop it:
systemctl stop cermm. - Put the folder back:
tar -xzf cermm-….tar.gz -C /var/lib && chown -R cermm:cermm /var/lib/cermm. - Give the new machine the old one's address (or the name in
CERMM_URL): agents keep the address they were installed with. systemctl start cermm.
What's kept, and for how long
- Raw metrics: about 25 hours (the 24-hour chart).
- Alerts and the audit log: 400 days (for reports).
- Doc versions: the last 50 of each doc.