Cutover (Handover)

Cutover is the final step in the OneLift lifecycle. It permanently removes all platform access from your server, transferring full ownership to you. After cutover, OneLift has no access to your server.

What Happens During Cutover

The cutover process runs 4 steps in sequence:

Before You Start

Checklist

1. Add your SSH key to the server's /root/.ssh/authorized_keys
2. Verify SSH access: ssh root@YOUR_SERVER_IP — must work with your own key
3. Run diagnostics: lift doctor --cutover — all checks should pass
4. Take a backup if you haven't recently

Pre-flight Checks

The dashboard runs 6 automated checks before allowing cutover:

How to Run Cutover

From the Dashboard

1. Open your project in the dashboard
2. Scroll to the Handover card
3. Click Run Checks — review the pre-flight results
4. If all checks pass, click Start Cutover
5. Confirm in the dialog
6. Watch the real-time step progress
7. After completion, you'll see the SSH command and a 24-hour checklist

From the CLI (Pre-check Only)

# Run cutover pre-handover checks
lift doctor --cutover

# Expected output:
# ✓ User SSH Key          1 user SSH key(s) found
# ✓ All Services Healthy  All containers running
# ✓ Cron Jobs Installed   3 cron job(s) configured
# ✓ Backup Recent         Last backup 5 minutes ago
# ✓ Disk Usage (<80%)     Disk usage: 42%

What Stays on Your Server

After cutover, your server retains everything it needs to run independently:

• All Docker containers and tools — running exactly as before
• Traefik reverse proxy — SSL auto-renewal via Let's Encrypt continues
• Backup system — daily incremental + weekly full backups via cron
• Firewall rules — iptables rules and fail2ban configuration
• Monitoring stack — Victoria Metrics at http://localhost:8428
• Server documentation — /opt/onelift/README.md with all server details

What Gets Removed

• OneLift SSH key — platform installer and management keys removed from authorized_keys
• OneLift user — the onelift system user is deleted
• Management tokens — .onelift-management-token and .onelift-api-config files
• Sudoers entries — /etc/sudoers.d/onelift* files
• Legacy users — onelift-installer and onelift-platform users if they exist

After Cutover

First 24 Hours Checklist

After the handover completes, verify everything works:

1. SSH access — Can you SSH into the server? ssh root@YOUR_SERVER_IP
2. Services running — Are all containers up? sudo docker compose ls && sudo docker ps
3. Website accessible — Can you access your site in a browser?
4. Backups working — Is the last backup recent? cat /var/log/onelift/last-backup.json

Important Directories

Useful Commands

# Check all running services
sudo docker compose ls
sudo docker ps

# Manual backup
sudo /opt/onelift/scripts/db-backup.sh full

# Restore from backup
sudo /opt/onelift/scripts/db-restore.sh --time "2026-02-27 14:30:00"

# Disk cleanup
sudo /opt/onelift/scripts/disk-cleanup.sh

# View backup schedule
sudo crontab -l | grep backup

Troubleshooting

Cutover Failed — How to Retry

If cutover fails, the project status reverts to failed. You can:

1. Fix the underlying issue (check the error message)
2. Click Retry on the CutoverCard in the dashboard
3. Or use Reset Status if the project is stuck

Pre-checks Failing

Locked Out After Cutover

If you cannot SSH into the server after cutover, you can access it through your cloud provider's console (Hetzner, Vultr, DigitalOcean, or Linode) and add your SSH key manually.

Related

• lift doctor --cutover - Pre-handover diagnostic checks
• Security - SSH key management and security features
• Zero-Downtime Deploy - Blue-green deployments