Uninstalling

Eight steps in a deliberate order, each destructive one a separate question asked by name.

A thin wrapper around the installer’s own teardown, so there is one implementation rather than two that drift.

sudo ./install/uninstall.sh --dry-run    # print the whole teardown, change nothing
sudo ./install/uninstall.sh              # do it
Do the dry run first

It prints every file it would remove, every service it would touch, every question it would ask and the exact answer it would take, and changes nothing at all. That is the flag to use to decide whether to trust it.

It finds the prefix from the installed unit rather than assuming the default, so an install elsewhere is uninstalled from there. Before anything under that prefix is touched, the directory has to look like a Loghound install — an absolute path, not a system directory, containing at least one file only this installer puts there. If it does not, the system integration is still unwound and the directory is left strictly alone.

01 · The order, and why
1 · UNITS AND BOTH TIMERS STOPso nothing re-creates what is about to go2 · THE OPENSOLR INDEXESwhile the credentials that authorise it still exist3 · THE VHOSTonly after the webserver validates without it4-6 · POOL, LINKS, CREDENTIALScredentials overwritten before they are unlinked7-8 · THE TREE, THEN THE USERgroup membership dropped first and separately

Figure 1 — the teardown order. Step 3 runs on boxes with other people’s sites on them: if the configuration test fails without the vhost, the server is not reloaded and keeps serving its last good configuration. Step 8 drops the log-read group membership first, so a failure to delete the account still leaves one that can no longer read the logs.

02 · What it asks, each question by name
  • Overwrite and remove the credentials? Default yes. That is the configuration file (the API key, the account email, the beacon signing secret, the address salt, any Solr password and the panel password hash), any half-written copy of it, a self-signed private key, the setup token and its ledger, the lockout ledger, the state and job databases, the setup working files, and every PHP session file — because a session file is a signed-in panel session.
  • Delete the install directory? Default no.
  • Delete the two Opensolr indexes? Default no, and this one is not something a blanket yes can answer — it takes the literal word DELETE typed at the prompt.
  • Remove the system user? Default yes.
Overwriting a file is not a guarantee

On a copy-on-write filesystem, an overlay, a snapshotted volume or any SSD with wear levelling, the write lands in new blocks and the originals remain on the media. Backups and virtual machine snapshots are untouched by definition. If this box is being decommissioned, sold or handed on, rotate the Opensolr API key. That is the only reliable remedy.

03 · Deleting the indexes, and what that costs
An index name is burned forever

Deleting an index destroys its data and burns its name: Opensolr index names are unique across the entire platform and are never released, so neither name can ever be created again, by you or by anyone else.

Only the two indexes this installation provisioned are ever offered. The names are derived from the stored installation id by the same function that created them, checked against the expected shape, required to match what is in the configuration, and then cross-checked against your account’s own index list. No name is read from the command line, no prefix is swept, and nothing else in your account is touched.

If any part of that cannot be checked — the platform is unreachable, the credentials are gone, the configuration is unreadable, the listing comes back empty — nothing is deleted. A check that could not be performed is a failed check. The two names are printed instead, so you can remove them in your control panel if you want to.

04 · What it deliberately does not remove

Printed at the end of every run, so you never have to guess:

  • The beacon script tag on your site. Only you can take that out of your templates.
  • A certificate for the panel hostname. Never deleted silently: other vhosts may be using it, and re-issuing after a mistake runs into rate limits. You get the command and the decision.
  • The panel’s own access and error logs in your web server’s log directory. Your logrotate owns those.
  • Anything you added by hand — a supervisor unit, a firewall rule, a reverse proxy entry, a monitoring check, a backup job. It removes what the installer created and refuses to guess at the rest.
  • Your source log files, which were never written to in the first place.

A half-finished install — no configuration, no user, units copied in but never enabled — uninstalls cleanly rather than aborting on the first missing thing.

05 · Unattended
sudo LOGHOUND_UNINSTALL_DELETE_TREE=yes \
     LOGHOUND_UNINSTALL_REMOVE_USER=yes \
     ./install/uninstall.sh --non-interactive
VariableDefaultEffect
LOGHOUND_UNINSTALL_SHRED_SECRETSyesset to no to leave the credentials on disk
LOGHOUND_UNINSTALL_DELETE_TREEnoset to yes to remove the install directory
LOGHOUND_UNINSTALL_REMOVE_USERyesset to no to keep the service user
LOGHOUND_UNINSTALL_REMOVE_LOGnoset to yes to remove the install log
LOGHOUND_UNINSTALL_DELETE_INDEXESnoset to yes to permanently delete the two indexes

If you only want to start over rather than remove it, that is a different and much smaller operation which deletes no data at all.

Loghound is open source and MIT licensed. Questions about the Opensolr half — the account, the indexes, the plan — go to opensolr.com/contact; questions about the software itself belong on GitHub.

Loghound Documentation