Maintain and update the appliance

Update the XOA-HL appliance in four steps: record what is installed, prepare a maintenance window, choose how updates run, then check the result. You work in the browser, signed in to XOA-HL as an administrator. A few read-only checks run inside the appliance, through its console or SSH.

1. Record your starting point

1. In the browser, open About (/#/about) as an administrator.
2. Note the XOA-HL version, the XOA-HL VM version, the appliance address and the original image tag. The VM version identifies the image build. Updating the application does not change it.

If you have authorized console or SSH access, run these read-only commands inside the appliance. Use root privileges where needed.

rpm -q xoa-hl nodejs
cat /etc/xoa-hl-vm-release
timedatectl
systemctl list-timers 'xoa-hl-*'

Keep the output with the release matrix and the release notes. The matrix lists the components that shipped together; it does not prove that they were tested together.

2. Prepare the update window

• Export the XO configuration. Keep the file and its passphrase outside the appliance.
• Separately record any changes you made to /root/.config/xo-server/config.toml, the TLS files and /etc/xoa-hl/update.conf. The web export does not include these files.
• Check that you can open the appliance console through XO Lite, in case the web interface is unavailable.
• Check that backups, restores and other management tasks have finished.
• Plan a window long enough for a service restart and, if needed, a later appliance reboot.

This page updates the XOA-HL VM only. Updating hosts is a separate task: see the update guide for the right target and commands.

3. Choose the mode and channel

Open Settings → XOA-HL Updates (/#/settings/xoa-hl-updates). To update by hand, follow the update procedure for Check for update and Update now.

Choose a Mode:

For a scheduled mode:

1. Check the Appliance timezone. The schedule uses it, not the host’s or the browser’s timezone. Compare it with the timedatectl output.
2. Set the Frequency, the Day for a weekly schedule, and the Local start time. The run starts at that time, with no random delay.
3. Select Save automatic update settings.
4. Check the saved settings, and the timer list from systemctl list-timers 'xoa-hl-*'.

In Update channel, keep Stable for routine maintenance. Testing adds candidate packages: use it only on a disposable test appliance. Changing the channel does not install anything, and does not downgrade a candidate package that is already installed.

The managed update runs a full dnf update, except for nodejs. Installing the application package restarts xo-server after the transaction, so the web page can disconnect. That alone does not mean that the update failed.

4. Check the result

1. Reconnect to the web interface and open About. Check that it shows the expected application version.
2. Check that the expected hosts are connected and that their inventory appears.
3. Read the update result. When the page opens, it shows the last stored check, including a scheduled one. Under Last automatic result, a failed automatic run appears in a red banner.

If the result is unclear, run these read-only checks inside the appliance:

systemctl status xo-server xoa-hl-update.service --no-pager
journalctl -u xoa-hl-update.service -u xo-server --since '1 hour ago' --no-pager
tail -n 100 /var/lib/xoa-hl/update.log
cat /var/lib/xoa-hl/auto-update.status
cat /run/xoa-hl/status

A manual installation does not update the automatic-run record. A check service can exit successfully and still report a problem, so read its result. Save the relevant logs before you try again.

Check: About shows the expected version, the expected hosts are connected, and the update result reports success.

If the update does not finish cleanly

There is no automatic reboot. The managed check and installer share a lock, but a dnf command that you start from a shell is outside that lock. While an update might be running, never start another dnf process, stop a running transaction or reboot to free a busy updater.