Decommissioning
Retiring Lumaft is more than stopping a container. The installation issued credentials, holds a license binding, and is the only copy of history your backends have since pruned. Work through this page in order; each step is short.
If you are moving Lumaft to a new host rather than retiring it, this is the wrong page: see Rebuilding the whole installation. If you are removing one backend, see Changing your backends safely.
1. Keep what you must
Decide, in writing, what must outlive the installation and for how long.
- Evidence exports. For each stack whose history you need to prove later, export its evidence for the full window from Operations → Export evidence (one backend, one layout, one stack, one accepted-time window per document). Exports carry bounded operation metadata, normalized changes, digests, and retention state — never raw state or transcript text — and each page is recorded in the export audit. They are the only artifact that survives every step below.
- A final cold backup, verified, together with the transcript and state key files if the installation used them. Without the keys, retained transcript and state bodies are ciphertext. Note the image digest the backup was taken under; a future restore needs that release or a newer one.
- The retention period for both, because a backup or an export you keep is data you still hold. Any deletion commitment you have made to a third party must account for it.
2. Revoke what the installation issued
| Credential | Action |
|---|---|
| Integration tokens | Revoke every token from Users & Access, then delete LUMAFT_TOKEN from every CI secret store and developer machine. Revocation is immediate; the secrets in CI are the part people forget |
| SCIM tokens (Enterprise) | Delete them from Users & Access → Identity and remove the provisioning integration at the identity provider |
| Provider registrations | Disable them, and delete the application registration at the identity provider so the callback URI cannot be reused |
| Local accounts | Nothing to do; they cease to exist with the database. Sessions end when the process stops |
Runners still pointing at the old LUMAFT_URL will report evidence delivery failed and
continue deploying unchanged; that is by design, but clean them up so nobody chases the warning.
3. Release the license
Business or Enterprise (connected). The agreement is bound to this installation's durable identity, and Deactivate in Administration → Licensing removes the key from the installation but does not release the service-side binding or erase the cached lease.
- If the agreement will be used by another installation, copy this installation's Installation ID from the Licensing page and ask the licensing operator for a controlled transfer (to a named destination) or reset (unbind) through the approved support channel. Both are audited, both revoke the old redemption keys, and a transfer returns a replacement key once.
- Expect overlap. An already-signed lease cannot be recalled and can remain valid for up to 21 days (Business) or 67 days (Enterprise) from its last issuance. Retire the old deployment under your own controls; the license service cannot switch it off.
- If the agreement is simply ending, deactivate and let the lease expire. Nothing further is required.
Enterprise Advanced Security (offline). The site license is organization-wide with no per-installation binding. Stop the installation; delete the license file with the rest.
Community. Nothing to release.
4. Stop
Stop the replica cleanly (docker stop -t 30, docker compose stop, scale the service or
Deployment to zero) so the WAL checkpoints. Confirm no lumaft.db-wal or lumaft.db-shm file
remains beside the database before taking the final backup in step 1 if you have not already.
5. Delete the installation
Work outward from the data.
| Layer | Delete |
|---|---|
| Database | The /data volume (EBS volume, managed disk, VMDK, or PersistentVolumeClaim) — or the PostgreSQL database and role |
| Secret files | admin-password, backends.json, the PostgreSQL URL file, key files, the audit-sink secret, license files |
| Secret manager | Secrets Manager / Key Vault entries for the password, backends document, and connection URL |
| Identity | The task role, execution role, instance profile, IAM policies, managed identity, and any static access key you created for the observer |
| Network | Load balancer, target group, security groups, DNS records, certificates |
| Compute | The service, task definition, instance, Deployment, or VM |
| Registry mirror | Mirrored images, if you keep a private registry only for Lumaft |
If the data volume was created with protect: true in the reference Pulumi program, unprotect
it deliberately before pulumi destroy; the protection exists so this step is never accidental.
Verify the observer identity is gone. The read-only role or key had access to your state
bucket. Confirm it no longer exists, or that its policy no longer grants the bucket, with
aws iam get-role or the equivalent.
6. What persists
- Backups and exports you chose to keep, under the retention you wrote down in step 1. They contain replay fences and audit rows as well as evidence; deleting the installation does not delete them.
- The service-side license binding, until the licensing operator resets or transfers it.
- Copies of the database anywhere you did not track — snapshots, image layers, developer laptops. A copied database is indistinguishable from the original, including its license identity. Find them.
- Downloaded transcripts and exported documents already outside Lumaft's retention boundary.
- Nothing in your state bucket changed. Lumaft never wrote there, and removing it removes nothing from Pulumi's own history.
Decommissioning checklist
- Evidence exported for every stack and window that must be provable later
- Final cold backup verified; key files backed up beside it; image digest recorded
- Retention period for backups and exports decided and recorded
- Integration tokens revoked;
LUMAFT_TOKENremoved from CI and developer machines - SCIM tokens deleted; provider registrations disabled; IdP applications removed
- License deactivated; transfer or reset requested if the agreement moves; lease overlap noted
- Replica stopped cleanly
- Data volume or database, secret files, secret-manager entries, IAM identities, network, and compute deleted
- Observer identity confirmed gone
- Stray database copies located and handled