Updates

This documentation describes the steps to update the LockSelf On-Premises solution.

____________________________________________________________________________________

Version updates

Updates are communicated to you by the LockSelf teams and are scheduled in advance. Updates are performed by sending a new Docker image.

As with the initial deployment, the LockSelf teams will send the update package. This package includes:

  • The container image: lockself-api-X.X.X.tar.gz
  • The container image signature: lockself-api-X.X.X.tar.gz.sig
⚠️ Before performing any operation, you must verify the signature attached to the container image.

The downtime will be a few minutes, the time needed to rebuild the container (except in a clustered environment).

To load the LockSelf image on the web server:

docker load --input lockself-api-X.X.X.tar.gz

You can check that the image is present with the following command:

docker images | grep lockself-api

Before any update

Before any update, we recommend performing a full backup of your environment in accordance with your usual backup procedures.

Deployment via a manual launch

If LockSelf was installed manually on your server (without Docker Compose or Docker Swarm), follow these steps:

  1. Stop the current container:

    # List the running containers
docker ps

# Stop the LockSelf container
docker stop CONTAINER_ID

  2. (Optional) Remove the old container:

    # Remove the stopped container (data is preserved if you use volumes)
docker rm CONTAINER_ID
  3. Start the new container:
    Use the same command as the one used for your last deployment. If needed, you can refer to the command provided in our documentation at the following address: Section 6.5.1

    ⚠️ Important: Use exactly the same parameters as your initial docker run command:
    - Same ports (-p)
    - Same volumes (-v)
    - Same environment variables (-e)
    - Same network options
    - Only the image version changes

    If database changes are required, they will be applied automatically when the container starts. No action is required on your part.

  4. Verify the startup:

    # Follow the logs in real time
docker logs -f CONTAINER_ID

  5. (Optional) Clean up old images:

    # List the images
docker images

# Remove the old version
docker rmi lockself-api-v3:old-version


Deployment via Docker Compose

If LockSelf is installed via Docker Compose, follow these steps:

  1. Update the docker-compose.yml file:
    Change the image version in your docker-compose.yml:

    version: '3.8'

services:
  lockself-api-3:
    image: lockself-api-v3:X.X.X # ← Change this line with the new version

  2. Restart with the new version:

    # Start with the new image
docker-compose up -d

    Docker Compose will automatically recreate the new container.

  3. Verify the startup:

    # Follow the logs in real time
docker logs -f lockself-api-3

  4. (Optional) Clean up old images:

    # List the images
docker images

# Remove the old version
docker rmi lockself-api-v3:old-version

Deployment via Docker Swarm

As indicated in the installation documentation, Docker Swarm can be used in different ways. It is therefore up to you to complete this procedure with your own deployment and verification commands. You can find all the details about how it works on its official website: https://docs.docker.com/engine/swarm/

Update your docker-swarm configuration file to change the version used:

version: '3.7'

services:
  lockself-api-3:
    image: lockself-api-v3:X.X.X # ← Change this line with the new version

Disk space optimization

After each container update, you can, if you wish, delete the old images as you go.

SSL certificate update

Two steps are required to update the SSL certificate (for the HTTPS connection) on your installation:

  • Replace the certificates on the application servers. In our example, in the /home/user/lockself/ssl/ folder, load the new files:
    • The certificate followed by the certificate chain, named: ssl-certificate.crt
    • The private key, named: ssl-certificate.key
    • Only for an SSO connection:
      • The certificate WITHOUT the certificate chain, named: sp.crt
  • Restart the container using the method you used.

Changing the domain name

If you wish to change the domain name of your LockSelf installation, follow this procedure:

  • Point the new domain name to the IP of your application server
  • In the "env" file, change the "domain" variable to the new domain you want to use
  • In the folder containing the SSL certificates (for example: /home/user/lockself/ssl/):
    • Replace the certificate followed by the certificate chain, named: ssl-certificate.crt
    • Replace the unencrypted private key, named: ssl-certificate.key
    • Only for an SSO connection:
      • Replace the certificate WITHOUT the certificate chain, named: sp.crt
  • Restart the application container

Please note: if an SSO interconnection is active, you will need to redo the connector creation procedure.

How do I verify the image signature before updating?

The signature of the .sig file associated with the container image must be verified before any update. This verification requires the official LockSelf public key. Please contact LockSelf support to obtain: the up-to-date public key, the exact verification command, and the procedure to follow if the verification fails.

Do not proceed with the update if the signature cannot be successfully verified.

Updated