📖 CodeB Laundry Portal — Help & GuideEN · DESign in

← All help topics

⛭ Cluster / Replication

Run the system as an active/passive cluster — the active node mirrors its data to a read-only standby you can promote.

The Cluster / Replication page (under Settings, built-in superuser only) lets you run this system as an active / passive cluster. The active node publishes its data and settings to a passive standby every hour; the passive only receives and imports them and stays read-only — a warm standby you can promote if the active is ever lost. Each tenant picks its own partner, so a single server can be active for one tenant and passive for another.

Note The bundle is encrypted end-to-end with a pairing key, so you can reach the partner by IP (no DNS or public certificate needed). The deployment .env (session secret, superuser login) is never replicated.

Pairing two servers

  1. On the passive (standby) server, for this tenant: set the role to Passive, tick Accept pushes, click Generate pairing key, and copy the key (it is shown once). Save.
  2. On the active (live) server, same tenant: set the role to Active, enter the passive’s IP and port (and, only if several domains share that IP on IIS, its domain for the Host header — otherwise leave it blank), paste the pairing key, and tick Replicate automatically. Save.
  3. Click Test connection, then Push now to seed the first copy. Replication then runs every hour on its own.
Note On IIS, connecting by IP alone is not enough when several sites share that IP: IIS routes a request to a site by its Host header and picks the certificate by SNI. So the active connects to the passive’s IP but sends the passive’s domain as the Host header + SNI. Leave the domain field blank to use this tenant’s own domain (the passive normally serves the same one); set it only if the passive site is bound to a different host name. No DNS is needed either way.

Push now and switching automation off

  • Push now sends an immediate copy — it works even while automatic replication is off, so you can verify a pairing before enabling it.
  • Replicate automatically is the on/off switch for the hourly push; turning it off keeps the pairing but stops the schedule (use Push now manually).
  • The newest few hourly backup zips are mirrored to the passive too, so the standby holds real rollback points. Re-sync backups re-sends them (e.g. after rebuilding the passive).

Promotion (manual failover)

A passive replica is read-only for everyone except the built-in superuser. If the active node is lost, promote the passive: change its role from Passive to Active (or Off) and save — that lifts read-only. Then point your users at it. When the old active returns, make the promoted node the active and the recovered node passive *first*, so a stale copy can’t overwrite the current data.

Note Replication is safe by design: the active pauses the push when its own store looks empty, and the passive refuses to import an empty bundle over good data or an older copy — so a bad state can never wipe or roll back the standby.
Watch out The bundle carries credentials (OIDC / PMS / fleet keys) — the payload is encrypted, but pair only with a server you trust and keep the pairing key secret. “Relaxed TLS” skips certificate verification (fine for a self-signed cert reached by IP); the encryption protects the data regardless.

Open Cluster / Replication

← Nextcloud Backup API & integrations →