Removing dqx

dqx installs one binary and keeps its state in two directories. It also asks your system for two things that outlive it: a local certificate authority, and a DNS resolver for your local suffix.

Removing it is quick. Doing it in this order means nothing is left holding a port or trusted by your browser.

Read this before the last two steps

docker/data/ in a project is the database. The certificate authority and the resolvers are shared with other tools. Both are called out where they arise.

1. Stop everything

dqx kill --all

That stops every project on every backend, frees 80 and 443, and stops the runtimes themselves. dqx kill --dry-run says what it would stop first.

2. Remove the shared router

docker compose -p dqx-router \
  -f ~/.local/share/dqx/router/docker-compose.yml down

docker network rm dqx_router

The network is removed separately because dqx creates it outside the router's own stack, so that a project can join it before the router exists.

3. Remove dqx's state

rm -rf ~/.local/share/dqx     # the router stack, its certificates, the routes, xdebug directories
rm -rf ~/.config/dqx          # machine settings, if you ever set any

Nothing in either is irreplaceable. dqx sync writes the routes again and dqx up reissues that project's certificate.

4. Remove the binary

rm "$(command -v dqx)"

Usually ~/.local/bin/dqx. It is a single self-contained file, so that is the whole of it.

5. The resolver files, if nothing else needs them

macOS keys /etc/resolver by domain, one file per suffix:

ls /etc/resolver
sudo rm /etc/resolver/test

Shared with other tools

DDEV, Lerd and Herd each want /etc/resolver/test as well, and there is only one file with that name. If you still use any of them, leave it. Removing it makes their local domains stop resolving, which surfaces much later as a site that will not load.

A file named after your own suffix, such as /etc/resolver/local.example.eu, is only ever dqx's.

6. The certificate authority, if nothing else needs it

mkcert -uninstall     # removes the CA from the trust store; asks for your password

Also shared

This is mkcert's CA, not dqx's. Any other tool that issues local certificates through mkcert, including DDEV, relies on the same one. Removing it makes every locally issued certificate on the machine untrusted at once.

Leave it unless you are certain nothing else uses it. It is harmless where it is: a CA that issues nothing signs nothing.

mkcert -uninstall leaves the key material in ~/Library/Application Support/mkcert. Delete that directory too if you want the CA gone rather than merely untrusted.

Per project

A project's repository keeps working without dqx. What dqx generated is regenerable, and what it did not generate is yours.

.dq/config.yml	yours. The declaration, committed. Keep it even if you stop using dqx: it is the clearest description of what the project needs
everything else under .dq/	generated, gitignored, safe to delete
docker-compose.yml and docker/conf/	generated in a multi-repo project, and regenerable with dqx sync
docker/data/	the database. Deleting it discards every local database this project has
www/	your checkouts. Deleting it discards any uncommitted work in them
AGENTS.md, .ai/guidelines/dqx-environment.md	a generated block inside a file that may also hold your own writing. Remove the marked block, not the file

To take a project off dqx entirely while keeping it runnable, run dqx generate first and commit what it prints. That is the same stack, without a tool in front of it.

Checking it is gone

command -v dqx           # nothing
docker ps                # no dqx_router
ls /etc/resolver         # only what other tools need