• type: documentation, docs, doc
• status: in-progress
• assigned: fredm
• priority: undefined
• keywords: migration, production, genenetwork
• interested-parties: pjotrp, zachs

Recent events (Late 2024 and early 2025) have led to us needing to move the production system from one machine to the other several time, due to machine failures, disk space, security concerns, and the like.

In this respect, a number of tasks rise to the front as necessary to accomplish for a successful migration. Each of the following sections will detail a task that's necessary for a successful migration.

We need to synchronise the authorisation database. We can copy this over from the production system, or the backups

• TODO: Indicate where the backups for the auth database are here!

Steps (flesh out better):

- Extract backup (or copy from existing production system) - Stop the (new) container (if it's running) - Backup the (new) container's auth-db file ( - Place the auth db file in the correct place in the container's filesystem: - Backup existing secrets - Login to the `/auth/admin/dashboard` of the auth server (e.g. https://cd.genenetwork.org/auth/admin/dashboard) - If client with the CLIENT_ID in the secrets exists - 1. update the uris for that client, if it doesn't exist, create an entirely new client and replace both the CLIENT_ID and CLIENT_SECRET in the secrets file. - 2. Click on the "Change Secret" button and generate a new secret. Replace the secret in the secrets file with the newly generated secret - If client with the CLIENT_ID in the secrets DOES NOT exist, register a new client, setting up the appropriate URIs and endpoints, and then add/replace both the CLIENT_ID and CLIENT_SECRET in the secrets file. - Restart (new) container

• Extract: detail this — link to existing document in this repo. Also, probably note that we symlink the extraction back to `/var/lib/mysql`?
• Configure: detail this — link to existing document in this repo

• TODO: List the necessary directories and describe what purpose each serves. This will be from the perspective of the container — actual paths on the host system are left to the builders choice, and can vary wildly.
• TODO: Prefer explicit binding rather than implicit — makes the shell scripts longer, but no assumptions have to be made, everything is explicitly spelled out.

We currently (2025-06-11) use Redis for:

- Tracking user collection (this will be moved to SQLite database) - Tracking background jobs (this is being moved out to SQLite databases) - Tracking running-time (not sure what this is about) - Others?

We do need to copy over the redis save file whenever we do a migration, at least until the user collections and background jobs features have been moved completely out of Redis.

• TODO: Detail how to extract/restore the existing secrets configurations in the new machine

• TODO: Add notes on building
• TODO: Add notes on setting up systemd

• TODO: Add notes on streaming and configuration of it thereof

• TODO: Add notes on acquisition and setup of SSL certificates

• TODO: Migrate DNS settings