Updates

From the admin (recommended)

Settings → System & Updates → Check for updates → Update now.

What the updater does, in this order:

1. Checks the signature of the new release. Every release is signed with the RustCraft release key; the updater only trusts the keys listed in deploy/updater/allowed_signers of the version that is already installed, so a release can't bring its own key. Unsigned or wrongly signed releases are refused and nothing is changed.
2. Backs up the database to backups/pre-update-<version>-<date>.sql. Only root can read these files; the last 10 are kept.
3. Switches the code to the new release, rebuilds and restarts the shop.
4. Waits until the shop is healthy again (database reachable, migrations done), for up to 5 minutes.
5. If the build fails or the shop does not come back healthy, it goes back to the previous version automatically. Database migrations are all-or-nothing, so a failed one leaves the database unchanged.

During the update the admin is briefly unreachable while its own container is replaced. Wait a minute and reload the page.

The shop follows the stable channel by default. To test new features early on a test installation, switch to beta (see Release Channels).

Refuse unsigned releases

UPDATE_REQUIRE_SIGNED=true in .env (set during the Installation) makes the updater refuse every release that is not signed by a trusted key. Without it, signatures are still checked as soon as the installed version has trusted keys (all versions since 1.7.0), and only older installations without keys accept unsigned releases with a warning.

Rebuild the updater after some releases

The updater never rebuilds itself while it is running an update. When the release notes say so, rebuild it once:

cd /opt/rustwebshop
sudo docker compose up -d --build updater            # Podman: sudo DOCKER_BUILDKIT=0 docker-compose up -d --build updater

Coming from a version before 1.7.0? Update to the newest release, then rebuild the updater as above: only then are signature check, health check and automatic rollback active.

When something goes wrong

Message in the update log	What it means
… is not signed by a trusted key — refusing to install it. Nothing was changed.	The release is not signed with the RustCraft key. Don't install it; report it (see Reporting Issues).
UPDATE_REQUIRE_SIGNED is on, but the installed version has no trusted signing keys	The installed version is older than 1.7.0. Update manually once (below), then from the admin again.
The installation has local code changes, refusing to overwrite them	Someone edited files in /opt/rustwebshop. sudo git status shows which; undo them with sudo git checkout -- <file>.
… did not become healthy within 300 s — going back to …	The new version did not start. The shop runs the previous version again; check docker compose logs backend and see Troubleshooting.

Shop offline after an update (only db and updater are running): see Installation with Podman#updates — the same steps work with Docker (docker compose up -d --build).

Manually

cd /opt/rustwebshop
sudo mkdir -p backups && sudo chmod 700 backups
sudo docker compose exec -T db pg_dump -U shop_user shop_db | sudo tee backups/manual-$(date +%F).sql > /dev/null
sudo git fetch --tags
TAG="$(sudo git tag -l 'v*' | grep -v -- -beta | sort -V | tail -1)"
sudo git -c gpg.format=ssh -c gpg.ssh.allowedSignersFile=deploy/updater/allowed_signers verify-tag "$TAG" \
  && sudo git checkout "$TAG" && sudo docker compose up -d --build

The verify-tag line checks the release signature like the updater does; it must print Good "git" signature, otherwise nothing is installed. With Podman use sudo DOCKER_BUILDKIT=0 docker-compose instead of sudo docker compose.

Files the updater changes are owned by root; use sudo for manual git commands in /opt/rustwebshop.