Destroy & Cleanup¶

Safely tear down a cloud deployment.

Irreversible Operation

Destroying a deployment permanently deletes cloud resources. For DigitalOcean, this includes the droplet, firewall, SSH key, and DigitalOcean Spaces bucket. This cannot be undone. Download a backup before proceeding.

Before You Destroy¶

Download a backup of your data:

dango remote backup
dango remote backup download backup-20260515-143000.tar.gz -o ~/dango-final-backup.tar.gz

Check server status to confirm which deployment you're destroying:
```
dango remote status
```

CLI Options¶

Option	Description
`--force`	Skip confirmation and backup download prompts
`--keep-spaces`	Keep the Spaces bucket and its contents (DigitalOcean only)
`--keep-ssh-key`	Keep the SSH key on DigitalOcean (DigitalOcean only)

Destroying a Deployment¶

DigitalOceanBYOS

dango deploy destroy

Step 1: Destruction Summary¶

The CLI shows everything that will be deleted:

Destruction summary:
  Droplet:   143.198.xxx.xxx (s-2vcpu-4gb, nyc1)
  Firewall:  dango-fw-abc123
  SSH key:   Will be DELETED from DigitalOcean
  Spaces:    Will be DELETED (my-dango-backups)

Step 2: Backup Download Offer¶

You're offered to download the latest backup before proceeding:

Download latest backup before destroying? [Y/n]:

Step 3: Type-to-Confirm¶

Type the server's IP address to confirm:

Type the server IP to confirm destruction: 143.198.xxx.xxx

Step 4: Resource Deletion¶

Destroying deployment...
  ✓ Deleted droplet
  ✓ Deleted firewall
  ✓ Deleted SSH key from DigitalOcean
  ✓ Deleted Spaces bucket
  ✓ Removed .dango/cloud.yml

Deployment destroyed.
Note: SSH key kept locally at ~/.ssh/dango_ed25519

Preserve Resources¶

Keep your Spaces bucket (with all backups) for archival:

dango deploy destroy --keep-spaces

Keep the SSH key registered on DigitalOcean (useful if redeploying soon):

dango deploy destroy --keep-ssh-key

Both:

dango deploy destroy --keep-spaces --keep-ssh-key

dango deploy destroy

Step 1: Destruction Summary¶

Destruction summary:
  Server:   203.0.113.50 (BYOS)
  Domain:   analytics.yourcompany.com

Step 2: Backup Download Offer¶

Download latest backup before destroying? [Y/n]:

Step 3: Type-to-Confirm¶

Type the server IP to confirm destruction: 203.0.113.50

Step 4: Cleanup¶

Cleaning up...
  ✓ Optionally stopped remote Dango services
  ✓ Removed .dango/cloud.yml

Local cleanup complete.
Note: The server and its data are still intact.

Server Not Deleted

BYOS destroy only removes the local cloud.yml configuration and optionally stops Dango services on the server. The server itself, its data, and any installed software remain untouched. To fully clean up the server, SSH in and remove Dango manually.

The --keep-spaces and --keep-ssh-key options are ignored for BYOS deployments (a warning is printed).

What Gets Deleted vs What Stays¶

DigitalOcean¶

Resource	Deleted	Notes
Droplet (VM)	Yes	Server and all data on it
Cloud firewall	Yes
SSH key (on DO)	Yes	Unless `--keep-ssh-key`
Spaces bucket	Yes	Unless `--keep-spaces`
Local `.dango/cloud.yml`	Yes
Local SSH key (`~/.ssh/dango_*`)	No	Kept for potential reuse
Local project files	No	Your code, configs, dbt models are untouched
Local DuckDB database	No	`warehouse.duckdb` is not affected

BYOS¶

Resource	Deleted	Notes
Remote server	No	Server stays running
Remote Dango data	No	Data remains at `/srv/dango/`
Remote Dango services	Optional	Offered to stop during destroy
Local `.dango/cloud.yml`	Yes
Local project files	No	Untouched

Verification¶

After destroying, confirm all resources are cleaned up:

Check Local State¶

# cloud.yml should be gone
ls .dango/cloud.yml
# ls: .dango/cloud.yml: No such file or directory

# SSH key still present locally
ls ~/.ssh/dango_ed25519

Check DigitalOcean Console¶

Log in to DigitalOcean
Droplets — verify the droplet is no longer listed
Networking > Firewalls — verify the firewall is removed
Settings > Security > SSH Keys — verify the key is removed (unless --keep-ssh-key)
Spaces — verify the bucket is removed (unless --keep-spaces)

Redeploying After Destroy¶

To deploy again after destroying, run the deploy wizard:

# DigitalOcean
dango deploy

# BYOS
dango deploy --byos

Your local project files, dbt models, and source configurations are preserved — only the cloud infrastructure was removed. The deploy wizard will provision new infrastructure and push your current local state.

If you kept the SSH key (--keep-ssh-key), the new deployment can reuse it.

Troubleshooting¶

Token authentication failed¶

Error: DigitalOcean API authentication failed

The API token may have expired or been revoked. Resource deletion requires a valid token. If you can't authenticate:

Generate a new token in the DO console
Set it: export DIGITALOCEAN_TOKEN=<new-token>
Retry: dango deploy destroy

If the token is permanently unavailable, delete resources manually through the DigitalOcean web console, then remove the local config:

rm .dango/cloud.yml

Partial deletion¶

If destroy fails midway (e.g., network error), some resources may remain:

# Retry
dango deploy destroy

# If retry also fails, clean up manually in the DO console
# Then remove local config
rm .dango/cloud.yml

Check the DigitalOcean console for orphaned resources: droplets, firewalls, SSH keys, and Spaces buckets with "dango" in the name.

BYOS services won't stop¶

If the optional service stop fails during BYOS destroy:

ssh root@<server-ip>
sudo systemctl stop dango-web
sudo docker compose -f /srv/dango/project/docker-compose.yml down
sudo systemctl stop caddy

Orphaned resources¶

If you suspect resources were left behind after a destroy:

DigitalOcean: Check Droplets, Firewalls, SSH Keys, and Spaces in the web console. Resources created by Dango are tagged with "dango".

BYOS: SSH into the server and check:

# Check if services are still running
systemctl status dango-web caddy
docker ps

# Check if data remains
ls -la /srv/dango/

Next Steps¶

DigitalOcean — deploy a new DigitalOcean server
BYOS — deploy to your own server
Backups — restore from a downloaded backup