Upgrades & TLS
Upgrade Fosnie safely, and serve it over HTTPS.
Upgrades
The current platform release is v0.7.1. Set APP_VERSION=0.7.1 in .env to pin it, then pull and restart the services. Pull the images even when upgrading an earlier 0.7.1 installation to the refreshed routing controls. Keep the existing .env and persistent volumes.
Docker Compose:
docker compose pull && docker compose up -dPin APP_VERSION in .env for reproducible upgrades (latest tracks the newest release). Database
migrations are forward-only and run inside the backend on boot – there's no separate migrate step.
Bare-metal / air-gapped: ship the new signed bundle, run verify-release.sh, swap the binary,
frontend/dist, and migrations, then systemctl restart. Updates are delivered as files, not pulled
from a registry.
Back up first – always take a backup before upgrading.
TLS / reverse proxy
Put a reverse proxy (nginx, Caddy, or Traefik) in front of Fosnie, terminate TLS there, and set
PUBLIC_URL to the resulting https:// URL.
A non-loopback PUBLIC_URL must be https – the backend refuses to boot otherwise. This protects
session cookies and enforces HSTS/CSP.
For a direct-IP host without a domain, a self-signed certificate is acceptable for internal use; for anything public, use a proper certificate from your proxy's ACME integration. Keep the backend and any model-engine ports bound to localhost or the internal network, so only the proxy is reachable from outside. Managed TLS is on the roadmap; the reverse-proxy recipe is the supported path today.