Updating

Pull new GHCR images and recreate the api and app containers. Migrations run automatically on the api’s next boot — no manual migrate:db needed.

The api and app images are private on GHCR, so the user running docker compose pull must be logged in to ghcr.io first — see Registry login. The systemd timer below runs as root, so log in as root if you plan to use it.

Release channel

Both api and app pull the latest tag of whichever channel SANCHO_CHANNEL selects (defaults to prod, i.e. the master branch). Set SANCHO_CHANNEL=dev to follow develop-branch pre-releases.

Upgrade:

docker compose pull
docker compose up -d

Manual update

git pull
docker compose pull
docker compose up -d

Daily automatic updates (systemd)

Two unit files ship next to the compose: sancho-update.service and sancho-update.timer. They run docker compose pull api app + docker compose up -d api app + docker image prune -f every day at 04:00 UTC, touching only the api and app containers. The database, RabbitMQ, Redis, and Caddy are left alone.

Install once per host:

Edit the WorkingDirectory in sancho-update.service to the absolute path of the deployment/docker-compose directory (default: /opt/sancho/...):
Terminal window
```
sudo $EDITOR sancho-update.service
```

Copy both units into /etc/systemd/system/:

sudo cp sancho-update.service sancho-update.timer /etc/systemd/system/

Reload systemd and enable the timer (this also starts it):

sudo systemctl daemon-reload
sudo systemctl enable --now sancho-update.timer

Inspect:

systemctl status sancho-update.timer       # when it fires next
systemctl list-timers sancho-update.timer  # last / next run
journalctl -u sancho-update.service        # output of previous runs

Trigger an out-of-cycle run:

sudo systemctl start sancho-update.service

Disable:

sudo systemctl disable --now sancho-update.timer