> For the complete documentation index, see [llms.txt](https://docs.hivel.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hivel.ai/self-managed-hivel-deployment/virtual-private-cloud/aws/hivel-on-premises-deployment-guide-aws/uninstall-and-cleanup.md). # Uninstall and Cleanup **Goal:** Cleanly remove a Hivel deployment and AWS resources, with explicit decisions about what to retain. ### Step 1: Back Up Any Data You Still Need Before removing anything, preserve data if it may be needed later: * **If using RDS (managed database):** Take a final RDS snapshot * **If using self-managed PostgreSQL:** Run a final pg\_dump of the insightly database * **Logs:** Export any logs you want to retain from `/var/log/hivel/` on the VM ### Step 2: Stop Containers and Remove Networks On the VM, choose one method to stop services: **Method 1 (using deploy.sh):** ``` ./deploy.sh --stop ``` **Method 2 (using docker-compose):** ``` docker-compose -f services/vm/docker-compose.yml down ``` Then remove the shared network (regardless of which method you used): ``` docker network rm microservices_network ``` **Verify:** `docker ps -a` on the VM shows no Hivel containers running. ### Step 3: Decide on RDS Instance Retention The RDS instance exists independently of the containers: decide explicitly whether to keep it or delete it: **Option A: Keep RDS (for future reinstall or archival)** * No action needed; the instance remains **Option B: Delete RDS** Create a final snapshot, then delete: ``` aws rds delete-db-instance \ --db-instance-identifier \ --final-snapshot-identifier insightly-final-$(date +%Y-%m-%d) ``` Or delete immediately without a snapshot (data is not recoverable): ``` aws rds delete-db-instance \ --db-instance-identifier \ --skip-final-snapshot ``` If deleting RDS, also clean up associated resources: * Delete leftover automated snapshots and manual snapshots (if you no longer need them) * Delete the dedicated DB subnet group (if not shared with other resources) * Delete the parameter group (if not shared with other resources) * Delete the security group (if not shared with other resources) * Tear down RDS Proxy, Enhanced Monitoring, or Performance Insights if enabled ### Step 4: Terminate the EC2 Host In AWS Console or via CLI, terminate the EC2 instance. This removes everything on the host: * All containers and images * The microservices\_network * The caddy\_data volume, (only if you set up HTTPS via Caddy - see [DNS Setup](/self-managed-hivel-deployment/virtual-private-cloud/aws/dns-setup-aws.md).) * The .env file and license file copies * The log-rotation cron job * /var/log/hivel/ and host-level firewall rules No further host-level cleanup is needed. ### Step 5: Clean Up Remaining AWS Resources Terminating the EC2 instance does not automatically remove attached or related resources. Manually verify each of the following: **EBS Volumes:** * Confirm "delete on termination" was enabled for attached volumes, or delete them manually **Elastic IPs:** * Release any Elastic/static IPs assigned to the host **Security Groups:** * Delete security groups created specifically for this deployment (if they weren't auto-removed and aren't shared with other resources) **DNS and Load Balancing:** * Delete or repoint Route53 records (if you set up DNS) * Delete ALB listeners and target groups (if you set up an ALB) * Delete or repoint the Caddy DNS A record (e.g., hivel.yourcompany.com) if you set up HTTPS via Caddy ### Step 6: Revoke Local Credentials Revoke credentials that were stored outside the terminated instances (e.g., on your laptop or a jump host): **Docker Registry:** ``` docker logout 730335373269.dkr.ecr.ap-south-1.amazonaws.com ``` **AWS Credentials:** * Deactivate or rotate the AWS IAM key used for `aws configure` (if configured outside the EC2 instances) **License and Keys:** * Delete any backed-up copies of `license_signed.json` or `hivel_onprem_public.pem` stored in a secrets manager, config repo, or elsewhere **Custom ECR (if used):** * Revoke or delete IAM policies/users you created for your own ECR registry ### Step 7: Revoke Third-Party Integration Credentials If the following credentials were issued specifically for this deployment and aren't reused elsewhere, revoke them: * GitLab Personal Access Token * Jira API token * SonarQube token * Bitbucket App Password * Azure AD App Registration (for Outlook integration): delete the registration or at minimum expire the client secret (in Azure Portal) ### Step 8: Notify Hivel Email and request: * Deactivation of the license grant tied to your `license_signed.json` * Rotation or revocation of any ECR pull credentials issued to you. * Confirmation that no customer record, webhook, or monitoring tied to this deployment remains active on Hivel's end.
{% columns %} {% column %} Back to Upgrade and Rollback {% endcolumn %} {% column %} {% endcolumn %} {% column %} Security and Secrets {% endcolumn %} {% endcolumns %}