On-Premises Edition Operations Guide

About this guide

This guide summarises routine operation and maintenance for the IT staff running the on-premises album database. Work involving server commands should in principle be done by the same person who performed the installation.

Routine checklist

Backup operation

How automatic backups work

Root’s cron runs scripts/backup-cron.sh daily, producing dumps (*.sql.gz) of the management and album databases under backups/. The default retention is the latest 14 days plus 12 monthly generations; older dumps are pruned automatically.

Note: the script must run as root (because of backups/logs/ permissions). For a manual run use sudo ./scripts/backup-cron.sh.

Off-server copies (strongly recommended)

backups/ lives on the same disk as the server itself. To survive a server failure, copy dumps regularly to separate hardware (an internal file server, tape, etc.). In addition, always keep the following two items in a safe place off the server:

1. A copy of onprem.env — all settings and passwords
2. The encryption.key value — losing it makes encrypted connection secrets in the database unrecoverable

Restore

Small restores (rolling back a mistake, etc.) can be done from the console’s Backups screen (see the Admin Console Guide). Recovery from total server loss: install a new server per the Setup Guide, restore your onprem.env copy, then restore the off-server dumps. If in doubt, contact Power Office support before proceeding.

Upgrades

New versions — the distribution archive and its SHA-256 file — are downloaded from the product page on the member portal. The release notes bundled in the archive describe the changes, any new configuration keys, and the scope of re-testing required.

Outline (each version’s release notes are authoritative):

1. Take a pre-update backup: sudo ./scripts/backup-cron.sh
2. Verify the new archive’s SHA-256 and extract it over the existing directory (onprem.env, certs/ and backups/ are not overwritten)
3. Load the new images: docker load < images/rad-onprem-images-<new version>.tar
4. Bump APP_VERSION in onprem.env and add any new configuration keys listed in the release notes
5. Run ./scripts/update.sh and confirm the tail reports ✓ Update complete.
6. Perform the OQ re-test items listed in the release notes

Rollback

If the update goes wrong, roll back with the step-1 backup and the previous images:

1. docker compose --env-file onprem.env down
2. Restore the databases from the pre-update backup
3. Set APP_VERSION back to the previous version and run docker compose --env-file onprem.env up -d --wait

Renewing the TLS certificate

When the certificate approaches expiry, place the new tls.crt / tls.key under certs/ and restart the web server:

docker compose --env-file onprem.env restart web

Notes on configuration changes

onprem.env is read directly by the running application. When editing it, mind these two points:

1. sed -i and some editors’ save mechanisms may not propagate the change. Always confirm the change took effect
2. Restart the application after editing: docker compose --env-file onprem.env restart app

Reporting an incident

When contacting Power Office support, attach the following — it dramatically speeds up triage:

1. When it happened, and what was done immediately before
2. The on-screen error message (screenshot)
3. Server logs (output of the following command):

docker compose --env-file onprem.env logs --tail=200 --timestamps

4. Container status:

docker compose --env-file onprem.env ps

For the support contact point, see the information provided at contract time.

Support policy

Each release is supported for 12 months from its release date (fixes and security patches). It keeps working after that, but staying on a supported release requires upgrading.