Production & Updates

Use elowen install for an always-on installation. It configures supervised services. Put HTTPS in front of the Web UI and keep the daemon's general API private unless direct access is intentional.

Install on a server

On Debian or Ubuntu, with the package installed as described under Install, run:

sudo elowen install

Review the install plan before accepting system changes. The installer can configure a service user, localhost or domain access, a reverse proxy, HTTPS, and required runtime tools. Use elowen install --help to see all supported options. For a domain deployment, pass --domain example.com.

If Elowen is already installed on the machine, the bootstrap script asks for confirmation before it reinstalls, because a reinstall re-provisions a running instance. Without a terminal it refuses and names the alternatives. To reinstall anyway, set ELOWEN_FORCE=1. The script never reinstalls over a source checkout linked with npm link, even with ELOWEN_FORCE. For routine upgrades, use elowen update.

Check and restart services

elowen status
elowen restart all

A daemon restart waits briefly for running turns, checkpoints remaining work, and resumes recoverable work after boot. A forced stop can interrupt work.

On Linux, inspect service status and logs with systemd:

sudo systemctl status elowen-daemon elowen-web
sudo journalctl -u elowen-daemon -f
sudo journalctl -u elowen-web -f

Confirm a restart

After a restart, check that both services are active and that the routes answer. Replace the host and ports if your reverse proxy changes them:

systemctl is-active elowen-daemon elowen-web
curl -fsS http://127.0.0.1:4400/health
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:4500/chat

Then check the daemon log for paused in, boot recovery and plugin loaded lines. A plugin skipped line or an ERROR line means a plugin did not start. The curl checks only prove that the routes answer. They say nothing about how the UI looks or behaves, so open the Web UI and try a message after every restart.

Update Elowen

For a package installation, run:

elowen update

It asks the licensing server for the latest release covered by the licence and verifies the download by size and checksum. The same installer used by bootstrap runs npm ci against the release's reviewed production lock, with native build scripts enabled. It atomically switches the managed release link, refreshes root-owned files, and restarts the services. If boot checks fail, the existing recovery journal restores the previous release. A core update is not reversed merely because a local database has no approved resource policy: reconciliation reports the policy as operator-controlled and leaves the database settings unchanged, while drift in a policy that was already approved still fails. After successful checks, only the current and previous owned releases are retained. Check elowen status after the update.

When the install location is not writable by the service user, the update runs its install step as root through a sudoers line pinned to that exact command, with the licence token passed on standard input rather than as an argument. After migrating from an older installation, re-run sudo elowen install once so the new sudoers line is written; without it, updates fall back to asking for an operator password.

A refused update check fails and names the server's reason, such as a revoked licence, instead of reporting "already up to date". A locally expired licence stops the update until it is renewed. When the licensing server cannot be reached, no core release is installed, and the update reports that the server could not be reached. The privileged-file repair still runs, so drifted root-owned files are converged and reported as usual. A source checkout skips the core release but can update publisher plugins through the same service; update source core code from git and rebuild. Provision its update service with sudo elowen privileged refresh after building.

Queued plugin requests are activated by elowen-update-coordinator.path, provisioned by install or sudo elowen privileged refresh, including source checkouts. The watcher uses the instance's request file, so requests arriving just before a previous run exits are not lost. A failed receipt publication remains recoverable and does not count as a finished update. While a transaction is unfinished, changes to a plugin that the transaction touches are refused until it finishes.

Elowen reads only schema-2 update journals. An installation with an older journal transitions manually in an approved stopped window: finish recovery with the older updater, retain matching recovery artifacts, archive only inspected and proven terminal old journal/report records, then install the matching core/plugin set and refresh privileged files. Do not force an automatic old-coordinator upgrade or archive an active journal.

Automatic updates are optional. Where supported, an administrator can enable them in Settings → System.

Follow an update

In Settings, choose System and select Update now. The Update status panel shows the core update, and each plugin row shows its own status. The statuses you may see, in order, are Queued, Downloading package, Preparing, Stopping services, Applying, Checking startup and Finishing. The run ends with Completed. Each plugin row then shows its own outcome: Applied when the plugin was updated, or Skipped when Elowen deliberately left it out of the run, with the reason shown.

Queued means Elowen has accepted the request, not that installation is finished. Elowen prepares the download while serving, briefly stops the affected services, applies changes and checks that the new set starts. Independent plugin services can be briefly unavailable during this step too. Wait for Completed. If the check fails, Restoring previous version and then Rolled back show that the previous set is being restored. The panel gives the reason. Blocked before activation means the run stopped during preparation, before any service was stopped, so the installed version did not change.

Update or repair one plugin

In Settings, choose Plugins. A plugin with a newer version offers Update in its action menu. To update every plugin that has a newer version at once, select Update all plugins and confirm. Elowen updates the enabled plugins together, with one short restart, so several updates never mean several restarts. Disabled plugins stay disabled, and they are updated when you enable them. If a new version asks for additional permissions, review and approve them first. Declining leaves that plugin's current version untouched.

An installed plugin that cannot start remains listed as Not loaded, with the reason and a Repair button. Repair joins the same queue and startup check. Elowen also requests repair for missing or unloaded enabled publisher plugins at boot, but does not keep retrying a version whose startup check already failed. Your organization's own plugins are reported, not replaced.

A request can end with Consent required, Not licensed, Cancelled before execution, Failed or Operator attention required. Review the shown reason before retrying. Cancelled before execution means a newer request or a changed approved download replaced this one before it ran. For operator attention, preserve the update files and use the recovery command or contact your administrator:

elowen update --recover

Manual install, update and repair requests work even with automatic updates off. Changes to ordinary plugin configuration or enabled state retain their daemon restart behaviour. Connected chat users see the existing restart notice; recoverable work resumes after boot.

Back up before upgrading

Elowen has no built-in backup or restore command. Back up the PostgreSQL database and the complete instance root (<dataDir>) as one pair: a database restored against a different instance root cannot read its plugin data, because plugin-secrets.key lives in the root. The root also holds the licence record, provider credentials, plugin data, attachments and the update journal; installed services keep their logs in the log directory they were configured with. Collect the database and the root while Elowen is stopped, so the two describe the same state. Configuration shows the commands.

Database migrations run when the daemon starts. Keep a recoverable backup and inspect the service logs if the new version does not start. Do not remove migration or lock files to work around a failed upgrade.

Licence

Customers run Elowen on Debian or Ubuntu Linux only. Install it with the script from your licence server and an activation key:

curl -fsSL https://<licence-server>/hooks/licensing/v1/install.sh | bash

Preflight rejects a key that is already bound to another machine before it changes the host. Licence activation binds to one instance, and licence checks are periodic. Licences are Ed25519-signed. Core embeds only the public key and verifies the licence offline at boot. Without a valid licence the daemon will not run or update. The marketplace lists only plugins that your individual licence allows. Core updates come from the licence server through elowen update, and plugins are downloaded from it too. Do not use npm as an install or release channel.

The licensing plugin's signing key lives in your data directory (<dataDir>). Keep it in your backup, and never delete it or uninstall the licensing plugin.

Elowen is source-available under a commercial licence, not public open source. Versions already released under MIT remain MIT, and later versions are closed. The elowen npm package is deprecated, and the last-mit tags mark the final MIT source. There are no further public npm releases.

Next: Web UI