Skip to main content
Data survives in the pg_data and app_data volumes. Migrations are forward-only and additive-first; the booting replica applies them exactly once under a Postgres advisory lock (concurrent replicas wait, then find nothing left to do). /readyz stays 503 until the schema is current.

Pinning versions

latest follows tagged releases. To pin, set in .env:
Tags published per release: latest, X, X.Y, X.Y.Z; the main branch publishes next and sha-<commit> for early testing.

Rollback

Take a backup before upgrading (./scripts/backup.sh). Rolling the image back works while the schema is compatible (additive migrations tolerate the previous app version). After a bad upgrade:

Manual migrations (AUTO_MIGRATE=false)

Operators who gate DDL run the same image once as a one-off: