Updates

Updates

secwatch installs as a git checkout of its repo, so updating a node is just git pull the latest release + restart the service. You can do it per-node, push it across the whole cluster from one peer, or let nodes update themselves.

From the dashboard

The Software updates card lives in two places:

• Settings → Software updates — on every node, clustered or not. This is where a standalone node checks for and applies updates.
• Cluster → Software updates — the same card, plus the fleet controls, when the node is in a cluster.

In the Cluster view each node also shows its running version as a badge, with an "update available ⬆" marker when it's behind the newest node in the fleet — so you can see at a glance who needs updating.

The card shows this node's running version, whether a newer release is available (it checks the origin), and gives you:

• Update this node — pulls the latest release, reinstalls dependencies only if they changed, and restarts the service. The dashboard blips for a few seconds while the service comes back on the new code.
• Update entire fleet (peers only) — pushes an update to every other node in the cluster. Reachable peers apply it immediately; leaf nodes (which nothing can reach inbound) pull it on their next sync cycle — so one click updates even firewalled edge boxes. The node you click from isn't touched (it's assumed to be the one already on the new version); update it with "Update this node".

How a fleet update propagates

1. A peer stamps an update campaign (a timestamp + target version) and pushes it to the peers it can reach.
2. Each peer that receives it re-broadcasts to its peers (so it floods the mesh) and then updates itself.
3. Leaves aren't reachable, so on their normal sync tick they pull the current campaign from a peer and update if it's newer than what they last applied.
4. Every node records the last campaign it applied, so a campaign runs once per node and can't loop — even across the restart.

A node updates to whatever its own origin points at (the public repo by default), so the whole fleet converges on the same release.

Config (update: block, or env)

update:
  auto: false          # SECWATCH_UPDATE_AUTO — check origin on a schedule, update if behind
  allow_remote: true   # SECWATCH_UPDATE_ALLOW_REMOTE — accept a fleet update from a peer
  # check_interval: 21600   # seconds between auto-update checks (default 6h)

• auto (default off) — the node checks its origin every check_interval seconds and self-updates when behind. Off by default so updates are deliberate.
• allow_remote (default on) — whether this node accepts a fleet update pushed or pulled from a peer. Set it false to pin a box (it still reports its version; it just won't act on a fleet push).

Notes & limits

• Updates are fast-forward only. If a node has local commits or an uncommitted change to a tracked file, the update is refused rather than clobbering your work — the card shows the error. Stash/reset and retry, or update it by hand.
• Non-git installs (unpacked tarball, distro package) can't self-update; the card says so. Reinstall to upgrade.
• The restart uses whatever unit install.sh created (a root/system unit or a per-user unit). If secwatch can't work out how to restart, it updates the code and tells you to restart the service manually.