Scheduled Host Maintenance

Choose your schedule

1. Open Settings → System maintenance → Configure maintenance as the host administrator.
2. Select Security updates only or All package updates.
3. Choose the first start time, timezone and repeat interval in calendar days. Decide whether to Reboot when required.
4. Select and configure the remote backup destination described below.
5. Review the playbook, approve it, enable scheduled maintenance and save settings.

Maintenance is disabled by default. Enabling it tests remote write access and checksum verification. Configure working notification delivery first. Use one automatic package-update scheduler; resolve a conflicting OS automatic-update timer before enabling the SSLNexus schedule.

The supplied playbook supports Debian 13 and AlmaLinux 10 within the installed OS release. Debian requires unattended-upgrades; AlmaLinux requires the DNF needs-restarting plugin. Security-only coverage depends on repository security metadata. The default excludes SSLNexus application upgrades and major OS upgrades.

Missed maintenance windows are skipped. A local time that does not exist during a daylight-saving change is skipped without shifting future windows.

Choose a remote backup destination

Existing target: select a supported target from your saved targets. SSLNexus reuses its existing access; you do not need to enter its credentials again.

Dedicated server: enter the host, port, username and authentication method. Linux and SSH-capable NAS destinations support an SSH key or username and password. Windows destinations use WinRM credentials. Use validated HTTPS for WinRM where configured. SMB-only NAS destinations are not supported.

For SSH, use the existing SSLNexus automation key, supply a key or generate a separate backup key. Follow the displayed instructions to add the public key to an existing account or create a dedicated backup account. Verify the SSH host public key directly on the destination before saving it. Give the account access to your chosen backup directory. Windows targets require the Ansible Windows collection and WinRM prerequisites.

Choose how many backups to retain. Before patching, SSLNexus stops its certificate service for a consistent backup, transfers the archive and compares its SHA-256 checksum with the remote copy. A failed backup or checksum blocks patching. Retention runs only after a verified copy is available.

Review, edit or restore the playbook

The full playbook is visible in Settings. Review its steps and edit it to suit your host before approving execution. Playbooks run with host administrator privileges. Changes pause the schedule unless you explicitly approve the new contents.

Use Download playbook to save your custom version. Restore default warns that custom changes will be lost and asks you to download a backup or copy and paste the contents somewhere safe before confirming. Restoring the default clears approval and leaves scheduling paused until you review it again.

Stay informed before and after maintenance

• 30 minutes before: receive the first notice of the scheduled update.
• 10 minutes before: receive the final advance notice.
• During the run: follow the recorded steps, their purpose and outcomes in Settings.
• After recovery: receive completion details once patching, any required reboot and verification have finished.

If an advance notification cannot be delivered, patching does not start. Late delivery delays the start to preserve the notice interval. Active certificate work is allowed to finish before disruption, and new work waits until recovery.

Enable independent recovery monitoring

Select Independent Authority monitoring to register the maintenance window with the Authority before SSLNexus stops for its backup. If recovery has not been confirmed within one hour, the Authority emails the verified email address on your registered account. It sends a follow-up when recovery is confirmed after an overdue alert.

This monitoring is available on every plan, including Free. It requires a registered installation, a verified account email and working Authority notification delivery. The one-hour deadline includes backup time; retries do not extend it. An overdue alert means recovery has not been confirmed and may also indicate a connectivity problem.

Reboot and recovery

When a reboot is required and authorised, SSLNexus resumes verification after the host starts. If automatic reboot is disabled, the run reports that action is required and waits for you to reboot. The independent monitoring deadline still applies while waiting for a manual reboot.

Completion requires service health, nginx configuration, SSLNexus preflight and security checks. A failed or interrupted run pauses future maintenance and retains its history. Review the failed step and the host package-manager state before scheduling again.

Disable maintenance prevents future runs; it does not interrupt an active package transaction. Backup restoration and operating-system rollback remain administrator actions. See Backup and Restore and Operations and Health.