Back up and update safely

Know your data

SQLite deployments keep configuration, policy, credentials, and history in ./data/policy.db. TLS files and Caddy state live under ./data/tls and ./data/caddy. MySQL deployments keep database records remotely and still need local TLS storage.

Back up before updating

1. Stop the stack with docker compose stop.
2. Back up .env and the complete ./data directory. Retain any SQLite WAL/SHM files; do not copy only a live database.
3. For MySQL, also take a separate remote database backup.
4. Protect backup copies and verify you can restore them.

Update a main checkout

docker compose stop
# Back up .env and ./data; back up remote MySQL separately.
git pull --ff-only
docker compose up -d --build

Read release notes and preserve local edits. If Git reports a conflict, resolve it without forcing or resetting the checkout. Existing release-tag checkouts should follow the upstream instructions for moving to main.

Verify and recover

Check Compose status, the console, list refresh state, and an authenticated API ping. Test a known blocked and allowed domain. If recovery is needed, stop the stack and restore a compatible application revision together with its matching data backup; do not assume a database downgrade is automatic.