ipa-csreplica-manage(1)

💖 ipa-csreplica-manage — manage an IPA CS replica 💖

okay bestie, welcome to the ipa-csreplica-manage manual page (that's the ipa-csreplica-manage(1) page from the IPA Manual Pages, mwah). this one's all about babysitting the CA replication agreements of your IPA server, but ONLY for domains sitting at domain level 0. sit down, grab a strawberry, let's go 🍓

---

✨ SYNOPSIS ✨

ipa-csreplica-manage [OPTION]...
[connect|disconnect|del|list|re-initialize|force-sync]

---

🌸 DESCRIPTION 🌸

So here's the tea: this tool manages the CA replication agreements of an IPA server for a domain at domain level 0. That's its whole job. It's giving very specific.

Heads up bestie 💅 if you wanna manage CA replication agreements in a domain at domain level 1, this is NOT the tool. Use the IPA CLI or the Web UI instead — peep ipa help topology for the extra info. iykyk.

Here's the command menu, one by one:

• connect [SERVER_A] <SERVER_B> — adds a brand new replication agreement between SERVER_A/localhost and SERVER_B. Only works at domain level 0, no cap.
• disconnect [SERVER_A] <SERVER_B> — removes a replication agreement between SERVER_A/localhost and SERVER_B. Also only at domain level 0.
• del <SERVER> — removes ALL the replication agreements plus the data about SERVER. Domain level 0 only, bestie.
• list [SERVER] — lists all the servers, or the list of agreements of SERVER. slay.
• re-initialize — forces a full re-initialization of the IPA CA server, pulling data from the server you named with the --from option.
• force-sync — immediately flushes any data that's waiting to be replicated from a server named with the --from option. no waiting around 💨
• set-renewal-master [SERVER] — sets the CA server that handles renewal of CA subsystem certificates to SERVER. main character energy honestly 👑

🦋 the whole topology thing 🦋

The connect and disconnect options are your tools for managing the replication topology. When a replica gets created, it's only connected to the master that created it — that's it, that's the whole starting friendship. So the connect option is how you introduce it to all the other existing replicas. social butterfly moment 🌈

Now listen: the disconnect option cannot remove the last link of a replica. Like, you can't just leave a replica with zero friends. If you actually wanna remove a replica from the topology, you use the del option instead. periodt.

⚠️ IMPORTANT SITCH ⚠️ if a replica gets deleted and then re-added within a short time-frame, then the 389-ds instance on the master that created it should be restarted before you re-install the replica. Why? because the master will have the old service principals cached, and that will make replication fail. so restart it. do not skip this. 😭

---

💅 OPTIONS 💅

• -H HOST, --host=HOST — the IPA server you wanna manage. The default is the machine the command is run on. ⚠️ Heads up: this one is not honoured by the re-initialize command. rude, but true.
• -p DM_PASSWORD, --password=DM_PASSWORD — the Directory Manager password to use for authentication 🔐
• -v, --verbose — give me MORE info, extra details, the whole lore ✨
• -f, --force — ignore some types of errors. living dangerously, love that for you 💀
• --from=SERVER — the server to pull the data from. Used by the re-initialize and force-sync commands.

---

🎀 EXAMPLES 🎀

List a server's replication agreements:

# ipa-csreplica-manage list srv1.example.com
srv2.example.com
srv3.example.com

Re-initialize a replica:

# ipa-csreplica-manage re-initialize --from srv2.example.com

This will re-initialize the data on the server where you execute the command, retrieving the data from the srv2.example.com replica. glow up via data transfer ✨

Add a new replication agreement:

# ipa-csreplica-manage connect srv2.example.com srv4.example.com

Remove an existing replication agreement:

# ipa-csreplica-manage disconnect srv1.example.com
srv3.example.com

Completely remove a replica at domain level 0:

# ipa-csreplica-manage del srv4.example.com

Completely remove a replica at domain level 1:

# ipa-replica-manage del srv4.example.com

👀 yes bestie, notice that at domain level 1 the command is ipa-replica-manage, not ipa-csreplica-manage. different tool, different vibe. don't mix them up.

And fr fr, using connect/disconnect is how you manage the replication topology. that's the whole plot 🫶

---

⭐ EXIT STATUS ⭐

• 0 — if the command was successful 🎉
• 1 — if an error occurred 😭

---

and that's the whole page, bestie! this was the ipa-csreplica-manage(1) page from the IPA manual, dated Jul 14 2011. go forth and manage those replication agreements, you absolute icon 💖🦋✨👑