Auto-updates
Updates that install themselves, and undo themselves.
Hatamoto fetches signed releases, backs up first, checks the site after the swap, and goes back by itself when something is wrong.
Example update flow
1. fetch signed release manifest
2. verify signatures and hashes
3. backup pre_update copy of the database
4. migrate expand-only schema change
5. swap new binary starts
6. check health checks for 60 seconds
7. keep, or roll back to the previous releaseUpdates are the chore people skip, and the reason sites get hacked.
Every manual update is a risk of its own, so it waits. A site that updates itself safely stays patched without anyone watching it.
What you get
-
Patch and minor releases install themselves
A new major version is only announced and waits for you.
-
A backup before every switch
A full pre_update backup is taken first, and the newest two are kept.
Backups and rollback -
A 60 second health check
After the swap the home page, sitemap, a published page and the admin login are checked, and the site rolls back if they fail.
The supervisor -
You choose the timing
Set a maintenance window, defer releases by up to 14 days, pin a minor version, or turn updates off.
Pin or turn off updates -
Channels
Run stable, edge or canary. Stable is the default.
-
Nothing about you is sent
The check is one anonymous request for a signed file, with no cookie and no identifier of your install.
The update agent
Under the hood
-
Expand-only migrations
A migration may only add to the schema, so the previous release keeps running on it and a rollback works.
-
Security fixes skip delays
Inside the same major, a security release ignores the defer, window and pin settings.
-
Offline updates
Download the binary and its signed record, then apply them with the CLI.
Questions people ask
Can I stop updates?
Yes. Set the mode to notify, or turn them off with HATAMOTO_UPDATES=off for no network call at all.
What if an update breaks my site?
The health check fails, the supervisor goes back to the previous release, and update status says why.