Break-glass recovery
The deplo command on the host - the way back in when nobody can sign in, or the panel's address stopped answering.
Everything in Deplo is capability-gated, and the instance owner cannot be demoted, suspended or reset by anyone else. That is the point of the crown, and it means a lost owner account cannot be recovered from inside the dashboard.
The way back is a command on the host that runs the control plane. It answers to root on that machine and to nobody else.
The deplo command
install.sh puts it at /usr/local/bin/deplo. Run it over SSH on the host:
deplo| Command | What it does |
|---|---|
deplo recover | Break-glass account and address recovery, below |
deplo logs [lines] | Follow the control plane's logs |
deplo restart | Restart the control plane |
deplo update | Re-run the installer to the latest version |
Each deplo recover command starts a short-lived container, so it takes a couple of seconds
before it answers. That is also why it still works when the control plane itself will not start.
Updating is normally a button - Settings -> Deplo -> Updates. deplo update is the fallback
for when the dashboard is what is broken. See Upgrade.
Recovery commands
deplo recoverSee the accounts
deplo recover listEvery account with its username, email, and whether it is admin, owner or suspended. If the instance has no owner at all, this says so.
Take the account back
deplo recover password ada
deplo recover password ada -The first prompts for the new password with the terminal echo off. The second generates a strong one and prints it. Every session for that account is signed out, so whoever locked it out does not keep a cookie.
Restore ownership or access
deplo recover owner ada
deplo recover admin ada
deplo recover unsuspend adaowner hands over the crown, and with it instance admin and an un-suspended state. The previous
owner keeps their admin flag - demote them from Settings -> Users if that is not what you want.
When the address is what broke
If the panel's domain, its DNS or its certificate stops working, the dashboard is unreachable and cannot be used to fix its own address.
deplo recover panel-address deplo.example.com
deplo recover panel-address -- puts the panel back on its generated deplo-<hex>.nip.io backup address, and turns that backup
address back on if it had been switched off. The proxy is reconfigured on the spot. Restart the
control plane afterwards so install commands and links carry the new address:
deplo restartThere is a matching command for a server Deplo can no longer reach, when the address was simply mistyped:
deplo recover server-address eu-main-1 10.0.0.7
deplo recover server-address eu-main-1 10.0.0.7 9443It writes the address with none of the usual checks and no reachability probe, which is exactly what makes it useful when the panel refuses the correction.
No gates, no trail
These commands write to the database directly. They skip every capability check and they do not appear in Activity. Root on the host is the only credential they ask for.
From a source checkout
Running Deplo from a checkout instead of the image? The same tool is a package script, and the subcommands are identical:
bun run recover owner adaNext steps
Did this page help you?