Updates and recovery

Signed software updates

The Settings page may check a signed release manifest, but it never applies an update. Connect to the host and run:

sudo dashboard-portal update

Normal installs use the stable channel. A self-hosted feed can be configured once with sudo dashboard-portal configure-update --manifest=https://… --public-key=/secure/key.pem. The host verifies the Ed25519 manifest signature and archive digest before staging the release.

Verify after every update

sudo systemctl is-active dashboard-portal hostmgr-deploy-helper nginx
curl -fsS http://127.0.0.1:3100/api/health
curl -fsSI https://YOUR-PORTAL-DOMAIN/

Check both API and static page. A health response alone does not prove the service can read and serve its static UI files.

Recover a lost owner password

sudo dashboard-portal --reset-pwd

The new random password is printed once, all sessions are invalidated, and the Portal service is restarted. Save it before closing SSH.

Back up recoverable state

Back up /etc/dashboard-portal/dashboard-portal.env and /var/lib/dashboard-portal together, encrypted and access-controlled. The first contains HOSTMGR_SECRET_KEY, which decrypts credentials and project environments in the second. A backup of only one cannot restore encrypted values. There is no shipped one-command uninstaller; do not remove services or managed files without a tested recovery plan.