11. System#

Updates#

Settings > Updates and Recovery. One button updates the system, the file services and the apps' platform: every package comes from OSM's update service (Debian's and OSM's, tested together and signed by OSM), and from nowhere else. See Updates and upgrades.

• Available updates: check now, see the list (security updates marked, each with its changelog and the CVEs it fixes), and Install all. Restart when an update needs it.
• What updates, and how: each part (OSM, the kernel and boot loader, the system apps, extra packages, the Debian base system, the apps, the App Catalog) with its version and updates; for each, whether its updates install by themselves in the maintenance window, or wait (and you are told, or not). Install installs one part's updates.
• Automatic updates: security updates by themselves in the maintenance window whatever a part says (on by default, and recommended; critical ones at once), the maintenance window itself (03:00 for two hours by default), and a restart at a set time when an update needs one.
• OSM's update service: the release in use and what is new in it, the next release rolling out and this server's place in line, the channel (Stable or Beta), the security advisories that concern this server, until when this version of OSM gets fixes, a release that waits because other servers had problems with it, and Report how updates go (off unless you turn it on).
• Update history: every update OSM installed, what changed, how it was started and how it ended.
• New kernels: on a server that starts with UEFI, a new kernel is tried once before it becomes the default: a kernel that does not start, or starts without a network, is set aside and the previous one starts. A server that starts with BIOS starts with the newest kernel at once.
• Restore points: one is made before every update, automatic or not. If a service that ran before stops or keeps restarting in the 15 minutes afterwards, OSM goes back to the restore point by itself and says so. Make one now keeps one before a change of your own. OSM never goes back to an older version than one it installed, except by that automatic undo.
• Configuration backup: Export saves, and Import... brings back on a new installation, Desktop Access, automatic updates, the server's screen, the groups, the shared folders with their permissions, and whether the firewall is on. It does not bring back the accounts and passwords, the network, the backup tasks or the apps. An import shows what it could not make.
• Software list (SBOM): the list of every package on the server, and the images of its container apps, as an SPDX file that vulnerability scanners read.
• Update from a file: for a server without internet, an offline update downloaded on another computer and brought on a USB drive (or uploaded from the browser): Check..., then Install. See A server without internet.
• The next Debian release comes through OSM's update service once OSM has been tested on it: there is nothing to do.

Updates and upgrades explains all of this.

Notifications#

The bell shows what happened. Settings > Notifications sends what matters (a failing disk, a degraded or full volume, a failed backup, an update that needs a restart) by email (your mail provider's SMTP server; Send a test message checks it), and by ntfy, Gotify, Telegram or a webhook (signed with HMAC-SHA256 if you give it a secret), each from a level up.

Each account can also get its notifications on its phone, without another app: Notify me on this phone on OSM's phone page (On your phone). Phones, at the end of Settings > Notifications, lists every account's phones, with when each last got a message; Remove stops one.

Monitoring#

• Activity shows the processor (and each core), memory, network and disks, live and over a day, a week or a month, with the processes, the open connections and each container's use.
• Settings > Monitoring:
  • Alerts: the processor busy for minutes, memory or a volume almost full, the server too hot: a warning in the bell (and by email), and a note when it is back to normal.
  • A Prometheus exporter and SNMP (v2c, or v3 with authentication and encryption) for your monitoring system, open to your local network only while the firewall is on.
  • A syslog server for the routers and switches of your network (a file for each device, rotated), and this server's own logs sent to another syslog server if you want.
  • Home Assistant (Apps).
  • Diagnostic bundle: one download with the logs and settings, passwords removed, for whoever helps you.
• Logs: the system journal by source and level, with search, and the source Administrator actions for what was changed; Download saves the journal since the last start. Devices shows the logs your network's devices send, and Support makes the diagnostic bundle.

Scheduled Tasks#

Settings > Scheduled Tasks runs things by themselves:

• What: a script (run as the account you choose), or an action: empty the recycle bins, run a backup task, start, stop or restart an app, restart a service, send a notification.
• When: on a schedule (daily, some days of the week, a day of the month, every few hours, once), at start-up, at shutdown, or when OSM notices something (a disk failing, a volume degraded or almost full, the UPS on battery, a backup failed, an update installed).
• Each run is kept with its output; run a task now, stop it, or turn it off for a while. A scheduled time the server was off for comes when it starts again.

Power and hardware#

Settings > Power and Hardware:

• Power profile: Performance, Balanced or Power saver. Each sets the kernel's own controls (the processor's speed policy, PCIe and SATA link power management) to the best this computer offers, and the page shows what each was set to and what the computer refused. The Server Status widget on the desktop shows the server's Power draw in watts where the processor or a UPS measures it.
• Power settings: what the power button does.
• Power schedule: shut down, restart or start at set times (starting needs the computer's clock alarm).
• UPS: a UPS plugged in by USB (shared with other servers of your network if you want: the firewall then lets your local network reach it, on NUT's port 3493), or one on another server. You are told when the power fails and comes back, and the server shuts down cleanly when the battery is low, or after the minutes you choose.
• Watchdog: restarts the server when it hangs, with the computer's hardware watchdog when it has one. A start after a hang, a crash or a power cut is reported.
• The server's own screen: what the screen plugged into the server shows; hide the addresses for a server in a public place.
• Other servers' power (IPMI): turn servers with a BMC on and off.
• After a power cut: set "Restore on AC power loss" to "Power On" in the computer's firmware for it to start by itself.

The layout of a keyboard plugged into the server, for its menus, its sign-in prompt and an encrypted system's passphrase, is in Settings > Language and Time > Keyboard of the server's own screen (also K on its screen).

Settings > System Info shows the computer, its devices and drivers (Hardware, with missing firmware to install and Save a hardware report), its Sensors (temperatures, fans, voltages), a server board's BMC, and the other OSM servers on your network.

License#

Settings > License shows this server's license: OSM Free, or OSM Pro, Business or Enterprise from a product key, what it allows, and how many accounts it has of those it may have. Nothing else has a limit: apps, containers and virtual machines are the same in every license. The table at the bottom shows what each license adds; everything else, security updates first, is the same in all of them (Licenses says what each costs and who may use it).

• A product key: you get it on OSM's website, in your OSM account (Licenses) and by email. Type it in the installer's Product key step, or here, and press Activate. The server gets its license file from OSM's account service; the key itself is not kept on the server.
• No internet on this server? shows a link and a QR code. Open it on a phone or a computer that has the internet, type the key there and download the license file, then Upload a license file here. When the server cannot reach OSM's website, Activate says so and keeps the key, trying again every hour; the button is then in its note too. A key typed in the installer is activated at the first start: if the server cannot reach OSM's website then, a notification says the same.
• The server checks its license by itself, without the internet. Once a day, when it is online, it gets a new license file: with a renewal, an upgrade or more accounts in it when there are.
• A license file is valid for 90 days, and the daily one keeps it valid, so you never see it. A server that has not reached OSM's website for two months, or a server without the internet (whose downloaded file is valid for a year), gets a notification 30 days and 7 days before its file runs out; License file valid until shows the date. Then check its internet connection, or download a new file on another device (No internet on this server?). A file that runs out stops nothing: changes to paid features wait until the server has a new one.
• When a license ends, everything keeps working for 30 days, and Notifications say so before. After that, nothing stops and nothing is taken away, but changes to paid features are refused until you renew it: the server takes the renewed license by itself.
• What the license does not include is greyed out on the desktop, with a gold tag naming the license that has it: the Domain and Network Boot icons, and on their pages, and on Storage's, Settings' and Virtual Machines' pages, the buttons that would set them up (ZFS, an SSD cache, iSCSI, high availability, joining a directory, single sign-on, a PCI device in a virtual machine, an API token that may change things, speed limits). The pages still open, to look around. What turns a paid feature off stays on.
• A new server, or a new installation, is a new server for its license: type the same key there. A key in use on another server moves only when its owner agrees: the OSM account's email address gets a message to allow the move (or allow it on your OSM account, Licenses), and the new server activates the key as soon as you do. Its note here says it waits; Check now asks again at once. Three moves a year; more through your OSM account or OSM's support. A key nobody has activated yet needs no OK.
• A copied disk, a cloned virtual machine, or a new motherboard is a new server too: the server notices that it runs on other hardware than before, makes itself a new identity, and says so in Notifications. Its license and its OSM Connect link stay with the server it was copied from: activate the key again (it moves, as above) and turn OSM Connect on again. Moving a virtual machine to another host keeps it the same server.
• Remove the license takes it off this server, which is on OSM Free from then on (it does not come back by itself); the key stays yours, for another server or this one again.

Several servers#

The Servers app manages your other OSM servers from this desktop. Add one by its address (or as found on your network), check its certificate's fingerprint once, and give it a token made on that server (Let other servers watch this one). You then see each server's health at a glance.

To manage a server from here, give it also an API token made on that server by one of its Administrators (Change..., API token (to manage it from here)). Manage... then shows its updates and latest alerts, installs its updates or restarts it, and Install updates on every server updates them all.

High availability#

Settings > High Availability pairs two OSM servers as a cluster with one address of its own: SMB, NFS and the web desktop answer there, whichever server is active.

1. Add the other server in Servers with a health token, and pair the two both ways (Servers > High availability). Then Make a cluster on the server that will be active.
2. Choose the mirrored volumes: volumes that are empty when the cluster is made are mirrored as you write (DRBD), so the passive server always has the same data.
3. Both servers watch each other through a heartbeat every few seconds. When the active server has not answered for the time you set (Takeover after), and the Witness (usually your router) answers, the passive one takes the cluster's address and its services. History shows each switch-over.

Accounts and passwords, backup tasks and other settings are not copied: make the accounts alike on both servers (or use a directory). Use two similar servers with the same disks for the mirrored volumes, ideally with a second network link between them.

The command line#

Administrators can sign in over SSH (Settings > SSH) or use the Terminal app, and use sudo. As root, osm shows the server's status, volumes, apps, updates, backups, restore points and jobs, and runs any operation of the desktop (sudo osm --help). For scripts on other computers, use the API.