opschain admin settings prune
Included from Basic tier
Strips the stored global settings document down to the keys the Go server
actually reads, removing the legacy Rails-era keys (and the Rails-only
sub-keys inside kept blocks such as git_remote) that only
pollute the configuration. The prune is safe by construction in two ways:
without --confirm it only previews what would be removed, and every
applied prune writes a new document version while the old one stays in the
history — any pruned value is recoverable with
opschain admin settings show and its version flag, which the prune output
reminds you of by number.
The stored licence key is deliberately not pruneable: it holds the
uploaded legacy licence file the server's licence info is computed from.
maintenance_mode is not pruneable either — the server still reads it for
the /api/info maintenance_mode? display, so pruning it would silently
clear the flag. The whole stored ldap block IS pruneable: the ldap.*
settings were removed completely — directory sign-in is a
kind: ldap identity provider connection, and the upgrade's boot seed
consumes and strips the stored block itself — so anything prune finds there
is an inert leftover. The retired auth_strategy/auth.providers chain
selectors are pruneable for the same reason (login-surface
amendment): sign-in ordering is per-connection display_order on the
identity provider connections, and only that same boot seed reads the
stored selectors. (The former per-flag migration lane and its
config-catalog precondition are retired with the settings they guarded.)
The retired requires_approval_from approver entries are pruneable too —
the server ignores them everywhere, and approval policies are their
enforced successor. Convert them first with
opschain approval-policies convert-settings-approvers, which reads the
stored entries until they are pruned. The retired product_name setting
is pruneable as well: the product name is fixed, new session tokens stamp
the fixed iss claim, and token verification never reads iss — tokens
minted under a previously customised value keep validating, so a stored
leftover is inert.
Flags
| Flag | Meaning |
|---|---|
--confirm | Apply the prune. Without it the command previews the keys that would be removed and changes nothing. |
A server target is required (--server <url>, OPSCHAIN_SERVER, or the
active context). -o json|yaml prints the pruned keys and new version as a
machine document on an applied prune.
Exit codes
| Code | Meaning |
|---|---|
| 0 | Preview printed, prune applied, or nothing to prune. |
| 1 | The read or the PATCH failed. |
| 2 | Usage error — no server target. |
Named errors
the system configuration carries no settings document reference— exit 1.
Examples
Preview, then apply:
opschain admin settings prune
would prune 3 legacy key(s) the Go server does not read:
- pod_per_change_step
- pod_templates
- runner
current version 7 is preserved in the document's history. Re-run with --confirm to apply.
opschain admin settings prune --confirm
pruned 3 legacy key(s): pod_per_change_step, pod_templates, runner
See also
opschain docs cli/admin-settings-show— the pruneable-keys advisory and the history any pruned value is recovered from.