Upgrading

Documentation for the image tag 1.0.0-rc1. See Versions for the documentation of a release.

Upgrading

Before you start

1. Read the release notes for the release you are moving to, and open the documentation for that version from Versions.
2. Take a backup and prove it: Backup and Restore. A newer release may migrate the database schema when the API service starts, and an older release cannot be assumed to read a migrated database. Your rollback is the backup.
3. Note your current image tag, so you can go back to it.

Single container

docker pull qertum/qertum:<new-tag>
docker stop qertum && docker rm qertum
# run again with the same -e, -p and -v options and the new tag

The data lives on the /data volume, so removing the container keeps it. Use the same QERTUM_HOST, ports and volume as before.

With Compose, change the tag in the compose file and run docker compose pull && docker compose up -d.

Multi container

# update QERTUM_IMAGE in .env, then
docker compose -f deploy/multi-container/docker-compose.yml \
  --env-file deploy/multi-container/.env pull
docker compose -f deploy/multi-container/docker-compose.yml \
  --env-file deploy/multi-container/.env up -d

Also refresh your copy of the deploy/multi-container/ folder from the same release, so the compose file matches the image.

Check afterwards

• docker ps shows every container healthy.
• You can sign in, and Settings, System shows the CA initialised.
• qca doctor reports no failures.

Roll back

1. Stop the stack.
2. Run the previous image tag.
3. If the new release already changed the database, restore the backup you took before upgrading. Do not point an older image at a newer database.

Notes

• The identity service rotates its own signing certificates at start-up when the newest is within IdentityService__CertificateRenewBeforeDays (default 90) of expiry. A container that never restarts never rotates, so restart at least once inside that window. Normal upgrades cover it.
• Webhook destination rules became stricter in some releases: private addresses are blocked unless an administrator adds an exact rule. If webhooks to an internal receiver stop after an upgrade, add the rule (Webhooks page, or qca webhooks destinations add).