Keep node settings in sync

The master’s settings for backups, off-site targets, retention, alert wording, customer letters, Let’s Encrypt, automatic updates and the brute-force scanner are sent to every worker node. The master always wins. The Cluster page shows where each worker stands and lets you run a pass at once.

Before you start

At least one worker is enrolled. The Cluster page under Settings does not exist without one.
Anyone with the Edit global settings capability can open the page and click Sync now. Only an Owner can change settings.
Know what syncs. The master sends these settings and nothing else.

Settings page	What is sent
Backups	What is kept, Local copies, Archive retention, Snapshot retention, the FTP/SFTP target and the trash switch and retention. The S3 targets travel too, so a worker’s scheduled backups reach them.
Alerts	The alert wording and the alert and billing languages.
Customer letters	The letter languages, the edited sentences and the Core Web Vitals settings.
HTTPS & previews	The Let’s Encrypt contact and the preview address template.
Panel	Whether automatic updates are on.
Brute-force & GeoIP	The scanner’s switch, window, ban times and thresholds.

These are not sent: placement, test nodes, two-factor sign-in, channel hardening, the outgoing mail relay (each node has its own) and the node’s own identity and listener settings.

Steps

Open Settings in the sidebar, then Cluster under the Cluster group.
In Node settings, find Settings sync. The badge reads all in sync, N of M behind, not checked yet or no workers.
Read the table. Each worker has a Status with a detail line and the time it was Checked.
To run a pass now, click Sync now. The page shows “Checking every node now — reload in about ten seconds to see where each one stands.” Reload after ten seconds.

What the statuses mean

Status	Meaning
`in sync`	The node has the master’s current settings, or took them in the last pass.
`old agent`	The node runs an agent too old to take the sync. It keeps its own settings and its node settings page stays editable. Update it.
`failed`	The master could not ask the node, or the node refused the settings. The detail line says which.
`not checked yet`	The first pass has not reached this node. It runs within a minute of the panel starting.

How the sync runs

A pass runs every five minutes, and about eight seconds after any save that changes a synced setting. If a pass cannot build its payload, it retries after one minute.
The master hashes its settings into a revision and asks each node which revision it applied. Only nodes that are behind receive the payload. A node that was down for a save, or enrolled later, catches up on a later pass.
A synced section replaces the node’s section. A synced key the master does not have is removed on the node, so the node uses the built-in default. Keys the sync does not manage are never touched.
Some sections are read only when the agent starts. The node restarts its agent once no job is running.
A synced node’s own settings page shows these values read-only, because the next pass would undo an edit. See Edit a node’s own settings.
After you save a synced setting on the master, the page says “the other nodes get it within a minute”.

Check that it worked

Settings sync reads all in sync and every worker shows in sync with a recent Checked time.
On Nodes, each worker’s row shows Settings sync in sync in its facts strip, and the verdict line lists no sync problems.
Open a worker’s settings page. The box at the top reads “Settings from the master: in sync.”

If it fails

failed with “did not answer within 15s”: the node did not respond. Test it from Nodes. See Check the health of your nodes.
failed with “refused them: …”: the node’s agent rejected a value. Read the reason, and update the node if it is on an older version.
old agent, and Nodes says “not taking the master’s settings — update it”: run Update with Hyperion ticked. See Update a node.
in sync but “skipped … it does not know yet — update it” in the detail: the node ignored settings its version does not know. Update it.
A save shows “… saved on this master, but one node did not take it: …”: the master kept the setting. The message names the node and the reason. Sites on that node keep the previous setting until the node takes it, and the Nodes page shows which nodes have the master’s settings.