Operations

Operations

This page covers day-to-day Trove operations.

Health checks

Server health:

curl http://SERVER:8080/healthz

Agents:

curl http://SERVER:8080/api/v1/agents

Services:

curl http://SERVER:8080/api/v1/services

Events:

curl http://SERVER:8080/api/v1/events

Logs

Docker Compose server:

docker compose logs -f server

Docker agent:

docker logs -f trove-agent-docker

Systemd server:

journalctl -u trove-server -f

Systemd local agent:

journalctl -u trove-agent-local -f

Kubernetes agent:

kubectl logs -f deploy/trove-agent -n <namespace>

Creating agents

Create one token per agent:

trove-server agent create <name>

Compose:

docker compose exec server trove-server agent create <name>

Save the token immediately. It cannot be recovered later because Trove stores only the hash.

Backups

Back up the SQLite database.

Recommended approaches:

• stop the server and copy the database
• use SQLite backup tooling
• use a filesystem snapshot

Avoid copying a busy SQLite database file with no snapshot/backup mechanism and assuming it is valid. It may work until the day it does not, which is the most SQLite sentence ever.

Restore

To restore:

1. stop trove-server
2. replace the database file with the backup
3. ensure ownership/permissions match the service user
4. start trove-server
5. check /healthz
6. check /api/v1/agents

Agents will resume pushing with their existing tokens if the restored database contains their token hashes.

Retention

Event retention:

TROVE_EVENT_RETENTION=720h

Removed-service retention:

TROVE_REMOVED_RETENTION=24h

Shorter retention keeps the database smaller. Longer retention gives richer history and digest context.

Alert testing

After changing alert variables:

trove-server alert test

Compose:

docker compose exec server trove-server alert test

Confirm the message actually arrived. An ok from a webhook only means the receiving endpoint accepted the request.

Registry credentials

Private registry credentials go on the server, not the agents:

TROVE_REGISTRY_AUTHS={"ghcr.io":{"username":"techdox","password":"..."}}

Restart the server after changing them.

Keeping the dashboard private

Until built-in auth exists, use one of:

• LAN-only binding
• VPN-only access
• reverse proxy with auth
• Cloudflare Access or similar front door
• firewall rules

Do not put the unauthenticated dashboard directly on the open internet.