Moving accounts to another host #

An operator winding a server down hands each account's data to its next host. This page is that handover, one account at a time or every account at once. A whole deployment moves by zone handoff instead.

Stop the writes #

didbot account lock <NAME> --server <HOSTNAME> refuses the account's writes and leaves its repository readable. An export taken after the lock is the account's last state. An export taken without one is still one snapshot with one head; writes after it are not in it.

Export #

didbot account export kestrel.agents.example --out ./kestrel --server pds.example
didbot account export --all --out ./evacuation --server pds.example

The first writes one account into ./kestrel. --all writes every account, one at a time, each into a directory beneath ./evacuation named by its host. The output directory must be new or empty. An account whose repository the server does not serve, because it is erased, suspended or deactivated, is listed with the server's reason and the run goes on.

On the dashboard, the Accounts tab's Show opens an account, and its Export downloads the same export as <host>.tar. tar -xf <host>.tar -C <DIR> unpacks it to the same files.

Each export holds:

File	What it is
repo.car	The repository as com.atproto.sync.getRepo answers it
blobs/<cid>	Every blob a record names, filed under its CID
did.json	The account's DID document
manifest.json	The DID, handle, head commit, revision, record and blob counts, export time and server revision

The server takes all of it from one snapshot of the repository, checks it against the account's own DID document, and hashes each blob as it streams. The command checks what arrived the way verify-export does. An export is a read: run it as often as needed.

Check #

didbot account verify-export ./evacuation

This takes one export, or every export directly beneath a directory, and needs nothing but the files. Every block and blob must hash to its name, the commit must verify against the #atproto key in did.json, did.json must claim the manifest's handle, and the manifest must agree with the repository. It prints the key each export verified against. A recipient compares that key with the document the account's name resolves to, https://<host>/.well-known/did.json, so the check does not rest on the server that wrote the export.

Hand over #

The next host imports repo.car with com.atproto.repo.importRepo and each blob with com.atproto.repo.uploadBlob.

The account's signing key stays on this server, and its DID document keeps naming this server's key and endpoint. Whether the key is exported, rotated to one the new host holds, or the account migrates another way is the owner's decision in evacuation, options B to D.