Uninstall

gardience uninstall removes Gardience's containers and data volumes from the server. It cannot be undone. The data volumes hold the audit log, the vault, run history and, in an all-in-one install, the Salt master key and every accepted agent key.

Before you start#

• Take a backup, even if you do not plan to come back. Store it encrypted and off this server, because it holds the vault key and node keys.

  Copy

  sudo /opt/gardience/gardience backup /root/gardience-final.tar.gz --passphrase-file /root/.gardience-backup-pass

  With a passphrase file, the backup is written as /root/gardience-final.tar.gz.enc, next to a .sha256 checksum file and a .mac integrity file. Keep all three together: a restore checks them.

• On a primary with a warm standby, remove the gardience standby-sync cron jobs first.

Uninstall#

To uninstall:

1. Run the command and type remove when asked:

   Copy

   sudo /opt/gardience/gardience uninstall

   Anything other than remove cancels.

2. The command stops and removes the containers, then removes the volumes NAME_gardiencedata, NAME_saltpki and NAME_saltcache, where NAME is the install's --name (gardience-server by default).

3. Delete the install folder when you are sure you no longer need it. It still holds the settings (.env), users, the TLS certificate and key, the license and any backups written there:

   Copy

   sudo rm -rf /opt/gardience

   Also delete the folder you extracted the release bundle into, if you kept it.

What uninstall leaves behind#

• The install folder, as described above. Until you delete it, the installer refuses to install into the same folder again, because it finds the old .env file.
• Container images. List them with docker image ls and remove the gardience/* images if you no longer need them. Upgrades also leave images tagged rollback.
• Agents on managed machines. Uninstalling the server does not touch them. They keep trying to reconnect. Remove the Salt agent with your usual software tools, or point it at another Salt master.
• Your Salt master, in attach mode. Uninstall does not change it. To remove Gardience from it, undo the steps in ATTACH.md: the extra file root, the console files, the gardience_vault external pillar, the environment variables, the two service accounts and their grants, the autosign folder and the drift reactor.
• Standby backups, on a standby server, in /var/lib/gardience-standby unless you chose another folder.

Reinstall later#

Install as usual into an empty folder. To bring back your data, install first, then restore the backup:

sudo /opt/gardience/gardience restore /root/gardience-final.tar.gz.enc --passphrase-file /root/.gardience-backup-pass

Agents reconnect with their existing keys when the restored server keeps the same name or address they use.

Related#

• Install on one server
• Upgrade
• Attach to an existing Salt master