Upgrade and rollback

Full-release upgrade with compatibility checks and guarded rollback.

Deployment methodThe commands on this page apply to the Docker Compose delivery. Open the matching Kubernetes and Helm procedure.
Terms used in this guide
  • A reverse proxy accepts external requests and forwards them to MassAccess services.
  • Transport Layer Security (TLS) encrypts connections to the public address.
  • A health check confirms that a service is ready to handle requests.
  • Enrollment binds an installed instance to the created license.

Upgrade

You do not need to re-download the package: upgrade.sh itself fetches the available version from the image registry and uses the saved access credentials.

bash
bash upgrade.sh --dry-run
bash upgrade.sh

What the upgrade.sh script does

  • Checks .env, licensing keys and the Compose configuration.
  • Obtains trusted release metadata and checks protocol/config/state, broker digest and actual database schemas.
  • After pulling all target images, saves private config/PKI and creates a cold backup of the stopped native installation’s owned volumes.
  • Pulls all images of the new version.
  • Recreates containers without deleting volumes and waits for all services to be healthy.
  • On failure, restores previous images/config only after proving backward state compatibility.
InformationPreviously pulled images are not removed during the upgrade — they remain in Docker and are used on rollback.

Version contract

The package version <X.Y> matches the image version in the registry and the VERSION variable in the delivered .env.

Rollback

Automatic rollback checks actual schemas and stops actors before restoring PKI/config. Incompatibility blocks rollback: keep failing/current state and restore a verified backup into an isolated copy. Data after backup time is absent from it; volumes are not deleted.

Verification after upgrade

Open On-premise → Webhook Ingress in your local installation to configure the Receiver, connect and check ingress. External DNS/NAT/firewall settings remain your responsibility.